Our subscription platform had grown into a Laravel app with 400 models in one namespace, and every change risked breaking billing. We restructured it into modules with nwidart/laravel-modules: what a module owns, how modules talk through contracts and events, and where a module is the wrong tool.
Many developers want to contribute to open source and stall at the first step. A practical path from choosing a project and an issue to reproducing the bug, following CONTRIBUTING rules, making a small change, writing the pull request, handling review and DCO or CLA requirements.
We published an internal package to our private Packagist and every app failed to require it: could not find a version matching your minimum-stability (stable). The package had no tags, only a main branch, so Composer saw only dev-main. How stability flags, tags and branch aliases work.
A new module built with nwidart/laravel-modules worked on every laptop, then production threw Class not found for its service provider right after deploy. The module's composer.json was never merged into the root autoloader in the image build, and an authoritative classmap froze the result.
Attackers copy popular repositories, add malware and promote the copies with similar names and fake stars. A practical guide for maintainers and users: how fake clones and repojacking work, how to make the real project verifiable with signed releases and provenance, and what to check before installing.
A narrative of one on-call night on a subscription payments platform: the 01:40 page, a settlement job stuck on a lock, a provider returning timeouts that were actually successes, the decisions under pressure, and the blameless review that followed. Details changed, mistakes and lessons real.
A small share of users reported that their authenticator codes were rejected, but only sometimes. One application server's clock ran 70 seconds behind, so codes failed whenever a login reached it. How we found it, fixed time sync, and kept a tight verification window with replay protection.
We extracted a webhook signature verifier from three Laravel apps into a public package. The steps from a folder of classes to an installable Composer package: structure, composer.json, service provider and auto-discovery, Testbench tests, a CI matrix across Laravel versions, tags and Packagist.