Requirements
Requirements
Taken from composer.json. These are the constraints Composer enforces — nothing here is
an aspiration.
Runtime
| Requirement | Constraint |
|---|---|
| PHP | ^8.4 |
ext-json |
* |
illuminate/contracts |
^12.0 || ^13.0 |
illuminate/http |
^12.0 || ^13.0 |
illuminate/support |
^12.0 || ^13.0 |
guzzlehttp/promises |
^2.0 || ^3.0 |
psr/http-message |
^1.1 || ^2.0 |
psr/log |
^3.0 |
Both the current and the previous Laravel major are supported, so the package installs on an application that has not migrated yet.
The two HTTP packages are interface-only and arrive with Laravel's HTTP client anyway; they
are declared because the outbound signing middleware type-hints against them, and a package
should require what it references rather than rely on someone else's tree. The classes that
use them load only when Http::webhookSignature() is called.
No cryptography library is required. Signatures use PHP's own hash_hmac() and
hash_equals(), which are part of the standard hash extension and enabled by default —
see the honest-crypto stance.
Development
| Requirement | Constraint |
|---|---|
larastan/larastan |
^3.0 |
laravel/pint |
^1.30 |
orchestra/testbench |
^10.0 || ^11.0 |
pestphp/pest |
^4.0 || ^5.0 |
CI runs the suite on PHP 8.4 and 8.5 against both Laravel majors.
Optional, depending on what you enable
Replay protection needs a cache store shared by every node — Redis, Memcached, or a database store. It is off by default precisely because the package cannot tell whether the configured store qualifies. See replay protection.
Twilio verification needs Laravel's trusted-proxy configuration to be correct, because the signature covers the request URL. Behind a load balancer with proxies unconfigured, the URL your application reconstructs is not the one Twilio dialled.