- Can I use etshy/php-zip-bundle in a Laravel application?
- Not practically. It is a Symfony bundle that depends on Symfony's dependency injection container and kernel layers to expose its ZIP services, and there is no documented framework-agnostic public API. Pulling it into Laravel means dragging in Symfony container wiring to call functionality you can write yourself in about a day. Treat it as a reference implementation for structure, not a dependency.
- Does etshy/php-zip-bundle conflict with Laravel's pinned Symfony components?
- It can. Laravel pins specific symfony/* versions, and a bundle that declares its own Symfony constraint bounds may collide during Composer resolution. The TPM assessment flags this as one of two hard compatibility gates. Check the bundle's composer.json constraints against your Laravel version before attempting an install.
- How do I install etshy/php-zip-bundle?
- As a Symfony bundle you would normally require it via Composer and register it in config/bundles.php, with settings in config/packages. There is no documented Laravel service provider or package discovery support. Before installing anywhere, confirm the package is actually published on Packagist with semver tags and a recent commit, because the TPM notes zero adoption and no verified release cadence.
- Is etshy/php-zip-bundle actively maintained?
- There is no evidence of an active release cadence, and the package shows zero stars and zero dependents. The assessment recommends assuming it is abandoned and planning accordingly. Adoption transfers full ownership of bug fixes, PHP version drift, and Symfony DI schema drift to your team.
- Is it safe to extract untrusted ZIP archives with this bundle?
- Unverified. The evaluation explicitly lists Zip Slip, zip bombs, and file I/O extraction as a high-severity attack surface, and asks whether extraction sanitizes entry names, blocks ../ and absolute paths, and rejects symlinks. No documented guards or size/entry-count limits were found. If you handle user-supplied archives, implement explicit path-traversal checks and size limits regardless of which library you use.
- What are the alternatives to this bundle for ZIP handling in Laravel?
- Use PHP's native ZipArchive class directly behind an app-owned ArchiveService interface, which is the assessment's recommended path. If scale demands streaming, ZipStream-PHP is a viable swap later. The key point is keeping the implementation behind an interface so the vendor choice stays reversible.
- Does etshy/php-zip-bundle require ext-zip, and is that extension enabled by default?
- The package is described as using native php-zip, which implies a dependency on ext-zip, though the assessment flags the dependency target as ambiguous between ext-zip and a third-party wrapper. ext-zip is not enabled by default in many PHP base images. Plan on installing libzip-dev and running docker-php-ext-install zip in your runtime images and CI.
- Does this package stream ZIP archives or build them in memory?
- Unclear from the available documentation. The evaluation lists streaming versus in-memory as an open question and notes it determines whether large-export roadmap items are even feasible. If you need to generate large archives, assume in-memory unless you verify otherwise, and design around per-job temp directories.
- How much work is it to replace etshy/php-zip-bundle with first-party code?
- Roughly one engineer-day. Inventory which service methods are actually called, which config keys are read, and which exceptions are caught, then reimplement those exact behaviors behind an interface covering create, extract, list, and stream. The interface, not the implementation, is the durable asset.
- What should I verify before adding etshy/php-zip-bundle to our dependency register?
- Confirm Packagist publication, semver tags, last commit date, and whether it targets ext-zip directly or a third-party wrapper, since that changes transitive supply-chain risk. You also need the license and a security contact for the dependency register. The assessment treats this as a one-hour go/no-go gate, with the default decision being to build in-house.