- Does frostiede/composer-dependency-list-bundle work in Laravel?
- No. It is a Symfony bundle that relies on Symfony bundle registration, a kernel boot cycle, DI extensions, and compiler passes, none of which Laravel provides. Only the small framework-agnostic logic that enumerates installed Composer packages could be reused. In a Laravel app you would need to fork and strip the bundle scaffolding or reimplement the feature.
- How do I install frostiede/composer-dependency-list-bundle in a Laravel project?
- You can run composer require frostiede/composer-dependency-list-bundle, but installing it does not make it usable in Laravel because there is no bundle registration mechanism. Any Symfony component version constraints may also collide with the Symfony components Laravel already depends on. The practical route is to fork the source under an internal namespace and bind the remaining reader class in a Laravel service provider.
- Which Symfony and PHP versions does composer-dependency-list-bundle support?
- The exact ranges must be checked in the package composer.json before you consider it. The bundle is plausibly pinned to Symfony 4 or 5 components, which can conflict with the Symfony 6 or 7 components required by Laravel 10 and 11. Verify constraints first because a failed composer update resolution is the most likely outcome.
- How can I list installed Composer dependencies in Laravel without this package?
- Composer already ships the data you need. Use Composer\InstalledVersions::getAllRawData() or read vendor/composer/installed.json at runtime, and use composer show --format=json or composer licenses --format=json for CI and reporting. This avoids a third-party dependency and works in every Laravel installation.
- Is it safe to expose Composer dependency versions in a Laravel application?
- A dependency inventory reveals exact package versions, which helps attackers match known CVEs. Never register a route that returns this data in production, and gate any diagnostic command behind local environment checks and an authorization gate. Prefer a console command or CI artefact over an HTTP endpoint.
- What is the difference between a Symfony bundle and a Laravel package?
- A Symfony bundle uses Bundle classes, DI extensions, compiler passes, and kernel registration to integrate with Symfony. A Laravel package uses service providers, facades, and Artisan commands registered through Laravel's container. Laravel borrows individual Symfony components but does not run the Symfony kernel or support bundle registration.
- Can I use composer-dependency-list-bundle with Laravel 10 or 11?
- Not directly. Laravel 10 and 11 depend on newer Symfony components, and the bundle's constraints may not resolve alongside them. Even if Composer resolves, the bundle layer still cannot register in Laravel. Fork it, pin the fork to a commit SHA, remove the bundle and extension classes, and expose the reader through a service provider.
- Does composer-dependency-list-bundle read composer.lock at runtime?
- You need to audit the source to confirm. Many dependency readers use composer.lock, which is often absent from optimised production images, so prefer code that uses Composer\InstalledVersions or vendor/composer/installed.json. If the package reads the lock file, plan for failures in production deployments.
- Is frostiede/composer-dependency-list-bundle maintained?
- Treat it as effectively unmaintained until proven otherwise. It has no stars, no dependents, a single maintainer, and little evidence of production use or tagged releases. If you reuse the code, fork it under MIT, pin to a specific commit, and accept the audit and upgrade debt yourself.
- What are the best alternatives to composer-dependency-list-bundle for dependency reporting?
- For runtime inspection, use Composer\InstalledVersions directly in a small Laravel service or Artisan command. For CI and audits, use composer show --format=json, composer licenses --format=json, or an SBOM tool. If you need an admin dashboard, build a thin reader over installed.json and gate it carefully.