- How do I install zbateson/mail-mime-parser in a Laravel application?
- Run composer require zbateson/mail-mime-parser on PHP 8.1 or newer and the library is immediately usable, because it is framework-agnostic and ships no Laravel service provider. In Laravel you typically register the MailMimeParser class as a singleton in a small custom service provider, passing a PSR-3 logger such as Log::getLogger() plus a config array for the parser limits. From there, inject the parser into a queued job or service that feeds it raw message bytes from your mail transport.
- Can zbateson/mail-mime-parser replace PHP's imap_* functions?
- Only partially. The library parses raw RFC 822/5322 message bytes into a structured message object; it contains no IMAP, POP3 or SMTP client, so it cannot fetch mail on its own. You still need a transport such as ext-imap, webklex/php-imap, a provider webhook or a raw file drop, and then hand the bytes to this parser. That separation is deliberate and lets you swap either half independently.
- Which PHP and Laravel versions does zbateson/mail-mime-parser support?
- Version 4.x requires PHP 8.1 or newer and is tested through PHP 8.5, which lines up with the requirements of Laravel 10, 11 and 12. It needs no ext-imap or ext-mailparse, only Guzzle PSR-7, PHP-DI and PSR interfaces, so it drops into most Docker images and shared hosts without adding extensions. Guzzle PSR-7 v3 has been supported since version 4.0.3.
- How do I read the text body, HTML body and attachments from a parsed message?
- Call getTextContent() and getHtmlContent() on the returned message object for the decoded bodies, and getHeaderValue() with the HeaderConsts constants for subject, from, to and cc. For attachments, enumerate the parts (for example getAllAttachmentParts()), then use getContentStream() to obtain a PSR-7 stream or saveContent() to write it out. Because bodies and attachments are streams, you can push them straight to S3 or Flysystem without staging temporary files.
- How do I configure parser limits so a huge message cannot exhaust memory?
- The 4.x parser accepts a configuration array, so set maxMimePartDepth, maxHeaderCount, maxHeaderSizeBytes, maxMessageHeaderCount and maxMessagePartCount explicitly in your service provider instead of relying on defaults. This matters in production: 4.0.6 lowered the default maxMessagePartCount from 10,000 to 1,000, so a legitimately large thread or digest can now be truncated silently. Pin at least 4.0.6 and tune the caps against the real p50 and p99 message sizes in your inbound corpus.
- Is zbateson/mail-mime-parser safe for parsing untrusted inbound email?
- Parsing attacker-controlled mail is exactly this library's threat model, and several CRLF header injection and CPU/memory exhaustion issues have been fixed in 3.0.6, 4.0.2 and 4.0.6, tracked as CVE-2026-61815, CVE-2026-61816 and related advisories. Treat 4.0.6 as the minimum acceptable version and combine it with explicit DI limits and a timeout around your worker process. Someone on the team should also own monitoring upstream advisories and define a patch SLA for mail-path CVEs.
- Why did my parsed message come back without a body or attachment instead of throwing an exception?
- The library is deliberately forgiving and does not throw on malformed input; it records problems on an ErrorBag and returns whatever it could parse. That resilience is the right default for real-world mail, but it means silent body or attachment loss is a realistic production failure if nobody reads those errors. Always check getErrors() after parsing and forward the results to a log channel or your monitoring so malformed messages are visible.
- How do I unit test email parsing in a Laravel application?
- Both entry points accept a string, a resource or a PSR-7 StreamInterface, so you can point them at fixture .eml files or in-memory strings in your tests. Use the procedural Message::from() for quick tests, or bind a parser instance in the container and swap it for a fake when testing the surrounding job or service. Storage::fake() combined with a real .eml fixture gives solid coverage of the attachment-to-object-storage path.
- Does zbateson/mail-mime-parser support S/MIME or PGP/MIME signature verification?
- Not in the core package. S/MIME and PGP/MIME support live in the separate mmp-crypt-smime and mmp-crypt-gpg plugins, which bring their own OpenSSL or PEAR dependencies. Treat them as a distinct scope decision with an additional threat surface rather than enabling them by default.
- Who maintains zbateson/mail-mime-parser, and is it production ready?
- It is a single-maintainer open-source project with roughly 552 GitHub stars and no commercial support or SLA, which is a genuine bus-factor consideration for a mail-ingestion path. Security responsiveness has been good, the code base is thoroughly tested and it is BSD-2-Clause licensed (attribution only), and the reported zero dependents looks like a dataset artifact worth re-checking on Packagist. If you need a managed alternative, compare it with IMAP clients such as webklex/php-imap or PEAR Mail_mime, but note they solve different problems.