Templated Uri Bundle Laravel Package

Technical Evaluation

Architecture fit. The category mismatch stands and is the headline finding: this is a Symfony Bundle, not a Laravel package. A bundle expects a Kernel, a DependencyInjection container, registration in config/bundles.php, and Symfony's RequestContext. Laravel has no bundle concept. The naming discrepancy also persists — the repository is goetas/TemplatedUriBundle while the dependency it wraps is hautelook/templated-uri-router, so the artifact you composer require and the code you audit are still two lineages. Release 3.5.0 does nothing to change this: the entire diff is a single dependency bump (hautelook/templated-uri-router to 4.0, PR #5). There are no new features, no Laravel affordances, no framework-agnostic entry point.

The architecturally relevant point remains that the value, if any, lives in the underlying library — an RFC-6570 URI Template router/generator — and Laravel's routing is built on symfony/routing, so component-level adjacency exists. The bundle wrapper adds nothing to a Laravel stack and should still be ignored entirely.

Integration feasibility. Low as shipped, though 3.5.0 introduces one genuinely new variable. Three viable paths, unchanged in order of preference:

1. Do not install this bundle. Use rize/uri-template or league/uri for expansion-only needs; maintained, well-adopted, Laravel-native in usage.
2. Extract the standalone library (hautelook/templated-uri-router v4) and wrap it in a Laravel ServiceProvider. Still inherits that library's maintenance posture, but 4.0 may have modernized its PHP/symfony/routing constraints — worth a composer.json read before ruling it out.
3. Vendor/fork the RFC-6570 expansion or matching code if inbound template matching is a hard requirement.

Technical risk. Still high, with one item downgraded and one new item added:

• Adoption signal: unchanged. The bundle remains effectively unused. 3.5.0 is the only release activity since 2023-01-19, and a single merged PR does not materially reduce the "you own every defect" exposure.
• Maintenance posture: slightly better than before, still weak. One first-time contributor landed a version bump. That is a positive maintenance signal — someone is watching the dependency graph — but it is a dependency bump, not a support program. The underlying router just took a major-version upgrade (4.0), meaning the bundle's own diff is not the whole story: breaking API or semantic changes inside the router can reach you transitively through the bundle.
• Composer conflict risk: still the top risk, now the first thing to test. A 2023-era bundle likely pins symfony/routing to ^4|^5 while Laravel 11/12 require ^7. The router 4.0 bump may have relaxed inner constraints, but the bundle's own composer.json constraint is what gates installation. Unverified either way.
• RFC-6570 conformance: still unverified. "RFC-6570 compatible" at README level says nothing about Level 3/4 operator support, reserved-expansion semantics, or prefix modifiers — and a major router bump makes re-verification necessary rather than optional.
• Regression surface: new. Adopting 3.5.0 means adopting router 4.0's breaking changes second-hand, with no changelog review in the release notes.

Key questions before any commitment (revised priority order):

• What are the bundle's composer.json constraints on PHP and symfony/routing as of 3.5.0, and can a Laravel 11/12 install resolve them cleanly?
• What are the breaking changes in hautelook/templated-uri-router 4.0, and does 3.5.0 pin ^4.0 only or ^3|^4?
• Which RFC-6570 levels and operators are implemented and tested in the 4.0 library?
• Does the router match inbound URIs against templates or only generate? (Matching is the differentiator; generation is commodity.)
• Is the library usable standalone without the bundle, and is it the same codebase as the linked repo?
• Is there a security disclosure channel, and who is the active maintainer — @Nathanael-Shermett, the original author, or nobody?
• How does RequestContext behave behind a load balancer / trusted proxy?

Integration Approach

Stack fit. Unchanged: component-level affinity via symfony/routing, framework-level incompatibility. Any integration is an adapter you write and own, not a package integration.

Migration path. Do not frame this as a migration; it is a spike-then-decide. The 3.5.0 release adds one step at the front and leaves the rest intact:

1. Requirements triage. Confirm whether the need is (a) hypermedia link generation for HAL/JSON:API/Siren, or (b) inbound route matching against templated paths. For (a), use league/uri and stop.
2. Constraint audit (new first gate). Read the 3.5.0 composer.json and resolve PHP plus symfony/routing constraints against the target Laravel version in a throwaway branch. If it does not resolve without --ignore-platform-reqs, the evaluation ends. This is now cheaper to run than before because the bump may have modernized the subtree.
3. Router 4.0 changelog review (new). Read hautelook/templated-uri-router 4.0 release notes for breaking changes, dropped PHP versions, and changed namespace or API surface. Do not accept a bundle-level version bump as a proxy for a safe transitive upgrade.
4. Standalone-library spike. Pull the library, not the bundle, into a scratch application. Exercise Level 1–4 expansions and any matching behavior against a fixture suite of real API templates.
5. Adapter build. Implement a ServiceProvider binding the generator/matcher, plus a facade if ergonomics demand it. Keep it behind an interface so it can be swapped for league/uri later.
6. Parity testing. Diff output against native route()/url() for every route where both are used — host, scheme, port, trailing slash.
7. Feature flag, then production. Single endpoint family, instrument, widen.

Compatibility. Assume breakage until proven otherwise. Verify PHP 8.2/8.3 support, symfony/routing v6/v7 alignment, symfony/deprecation-contracts noise under modern Laravel, and — critically — behavior under route:cache, where a router that does not participate in the compiled route collection will diverge between local and production.

Sequencing. Timebox the spike to roughly one week of engineering, with Step 2 and 3 consuming less than a day. The 3.5.0 release does not shorten the sequence, but it does make the first gate answerable without cloning anything unusual. Never sequence this as a hard dependency of a shipping feature; it is an optional capability layer.

Operational Impact

Maintenance. Still treat this as fork-and-own, not dependency management. The 3.5.0 release is a mild positive — evidence of a live dependency-tracking reflex and a second contributor — but a single version bump after a multi-year gap is not a maintenance program. There is still no release cadence, no documented support window, no security process, and no evidence of a second reviewer with commit rights. Budget for a named owner, a vendored copy, and a documented patch process. Assume no upstream fixes on any timeline you would find acceptable.

Support. No vendor, no commercial backing, negligible community footprint. A dependency-only patch release does not change the 2 a.m. on-call calculus: Stack Overflow and issue history will not rescue you, and the documentation remains thin and Symfony-idiomatic.

Scaling. Unchanged and benign. Template expansion is stateless and CPU-cheap with no external service dependency. The only scaling concern is route-matching cost in the hot path — regex-driven template matching will not benefit from Laravel's compiled route collection. Benchmark against native routing before putting it on every request; for outbound link generation in API responses the impact is negligible.

Failure modes to plan for:

• Composer resolution failure or silent downgrade of symfony/routing, breaking unrelated framework behavior. Highest probability, most expensive to diagnose. Test this first.
• Transitive major-version breakage (elevated by 3.5.0) — router 4.0 semantics changing underneath the bundle, surfacing as runtime exceptions rather than install-time errors.
• Route cache divergence — correct locally, wrong in production after route:cache.
• Proxy/load-balancer misconfiguration producing wrong scheme or host, causing broken hypermedia links and redirect loops.
• Open-redirect / SSRF if templates are influenced by external input (OpenAPI, HAL, user data); requires explicit trust boundaries and a template-source allowlist.
• Unsupported template operator throwing at runtime, surfacing as 500s on a subset of endpoints.
• Abandonment — no security patches. Plan a re-evaluation checkpoint or a vendored fork as the end state.

Ramp-up. Moderate. RFC-6570 is a compact spec, but the package API and docs are Symfony-idiomatic and read as foreign to a Laravel team, and the 4.0 bump means any tutorial or prior art you find may describe the old API. Expect roughly 1–2 engineer-weeks for the spike, adapter, and parity test suite, plus a small ongoing ownership tax and the standing cognitive cost of explaining to future engineers why this non-standard router exists and where its boundaries are.

TPM recommendation. Do not adopt the bundle; do re-open the standalone-library question. Release 3.5.0 is the first meaningful signal of life this package has shown, and if the router 4.0 bump relaxed the symfony/routing and PHP constraints, the blocking Composer conflict may have cleared — that is a one-day check, not a project. The recommendation logic itself is unchanged: the 1-star/0-dependent profile, the Symfony-bundle category mismatch, and the absence of a security process all still point away from this artifact. If URI-template capability is genuinely required, prefer a maintained standalone library (league/uri / rize/uri-template) and build the thin Laravel adapter yourself — same capability, active security posture, clean swap path. Reserve hautelook/templated-uri-router v4 for the narrow case where inbound URI-template matching is a hard requirement and no maintained alternative exists; even then, vendor it with a named owner and a documented exit plan. Re-assess on the next substantive release — a second consecutive release cadence would be a real signal; another lone dependency bump is not.