Ezmbpaex Ls Laravel Package

Product Decisions This Supports

• Framework-fit triage (immediate). Despite the brief, this is not a Laravel package. It is an eZ Publish legacy extension (ezmbpaex — password expiration / password-policy enforcement for eZ Publish 4.x–5.x, with multibyte-aware handling). Any Laravel roadmap item it appears to serve is a false match: it cannot be installed via composer require into a Laravel app in any supported way.
• Build vs. buy on password policy. Its only real value to a modern team is as prior art: a reference for how password-age enforcement, expiry windows, and reuse/history checks were wired into a CMS user model. Read it, don't depend on it.
• Security/compliance roadmap direction. Password rotation is now actively discouraged (NIST SP 800-63B, NCSC guidance). The decision this package should trigger is the inverse of adoption: invest in breach-list checking, MFA, session revocation, and step-up auth rather than forced expiry.
• Migration audit signal. Finding this in a dependency tree is evidence of an eZ Publish legacy estate. That is a roadmap input (migrate to Ibexa DXP or off the platform entirely), not a feature decision.
• Use case that would justify it: only an inherited eZ Publish legacy install under a contractual/regulatory mandate for periodic password change, where migration cannot land inside the compliance window.

When to Consider This Package

Consider it only if all of the following hold:

• You operate eZ Publish legacy (not Ibexa DXP, not eZ Platform) in production and cannot migrate this quarter.
• You have a written compliance requirement for password expiry that you cannot renegotiate.
• Legal has cleared the license. GitHub reports NOASSERTION — the license is not machine-identifiable. eZ legacy extensions were typically GPL-2.0, but "probably GPL" is not a clearance; get it confirmed in writing or vendor/fork with explicit terms.
• You accept vendor-and-own: you are forking, patching, and carrying the maintenance cost, because upstream won't.

Look elsewhere — decisively — when:

• Any Laravel or modern PHP target. Use framework-native primitives: Password::defaults() with min()/uncompromised(), password.confirm middleware, Fortify/Breeze flows, and a password_changed_at timestamp with a lightweight middleware guard. That is roughly a day of work and is fully maintained.
• Any Ibexa DXP target. Use the platform's own user/password policy configuration.
• Abandonment risk is unacceptable. Archived, last release 2020-01-09, 0 dependents, 16 stars. A password-handling component with no security-response path is a liability, not a dependency.
• You are reading the opportunity score as a buying signal. It isn't. Low competition in a dead ecosystem looks identical to low competition in an underserved one. The 0.3 composite is the honest number; 13.88 measures whitespace in a niche nobody is entering.

How to Pitch It (Stakeholders)

To executives: This surfaced in a package scan and we are recommending against adoption. It is an abandoned extension for a platform generation we are moving off of, with no identifiable license and no downstream users. Adopting it would add legal exposure and an unpatched security surface in the most sensitive part of the product — authentication — in exchange for functionality we can build natively in about a day. Recommendation: log it as evaluated and rejected, and treat its presence anywhere in our estate as a legacy-platform flag for the migration roadmap.

To engineering: Don't pull this in. Implement password policy in-app: a password_changed_at column, a middleware that redirects to the change-password flow when the age exceeds policy, and Password::defaults() rules including uncompromised() for breach checking. If a compliance auditor still requires rotation, make the interval configurable per tenant so it can be disabled as guidance evolves. If you genuinely need the eZ legacy behaviour, fork it explicitly, pin the commit, and record the license determination in the dependency register — do not take it as a transitive dependency.