- Can I use hrombach/json-validation-bundle in a Laravel application?
- No. It is a Symfony bundle registered through AppKernel or bundles.php with a DependencyInjection extension, and Laravel has no bundle kernel to register it with, so the integration surface simply does not exist. There is also no service provider, facade, config publishing, queue hook, or validation rule integration. To validate JSON Schema in Laravel you should install justinrainbow/json-schema or opis/json-schema directly and bind your own validator service in a first-party provider.
- What does this bundle actually add over justinrainbow/json-schema?
- Very little. It is a thin container-wiring layer that registers the underlying library as a service and possibly exposes a config-driven schema path. All validation semantics come from justinrainbow/json-schema, which is independently installable via Composer. If the wrapper only contributes roughly one service definition, it does not justify an extra dependency.
- Which Laravel and PHP versions are supported by this package?
- None officially, because it was never a Laravel package. The repository naming and era suggest Symfony 2.x constraints such as symfony/symfony ~2.x and justinrainbow/json-schema ~1.x, which target PHP 5.x and conflict with PHP 8.1+ requirements in Laravel 10 and 11. Even on modern Symfony 6 or 7, the old extension would likely fail to compile against current container conventions.
- How do I install and configure hrombach/json-validation-bundle?
- As a Symfony bundle you would composer require it, register HeroJsonValidationBundle in AppKernel (or bundles.php on Symfony 4+), and supply configuration through the bundle's DI extension. In Laravel there is nothing to install or configure, since no provider or config file ships with the package. Given zero stars, zero dependents, and no maintenance signal, we would avoid it even in a Symfony codebase.
- Is it safe to use in production?
- It carries real risk. Zero stars, zero dependents, and an unpinned maintenance posture mean there is no security patching path, and Composer audit surfaces would be blind to it. The larger concern is the unmaintained transitive dependency on an old justinrainbow/json-schema major, which has had CVEs around $ref resolution and remote schema fetching. For production workloads, choose a maintained engine and wrap it yourself.
- Which JSON Schema drafts does this package support?
- Draft-04 only, inherited from the justinrainbow/json-schema 1.x line. There is no support for JSON Schema 2019-09 or 2020-12 features such as unevaluatedProperties or $dynamicRef. If your payload contracts target modern drafts, this is a dead end and opis/json-schema is the better fit.
- What are the best alternatives for JSON Schema validation in Laravel?
- opis/json-schema is the strongest option: it supports modern drafts, is actively maintained, and is framework-agnostic. justinrainbow/json-schema at a current major also works if your schemas stay in the draft-04 to draft-07 era. Either way, wrap the engine in a first-party service provider and expose it as a custom validation rule or FormRequest helper rather than adopting a bundle.
- How should I wire JSON Schema validation into a Laravel app?
- Define a small contract such as JsonSchemaValidator with a method like validate(array $payload, string $schemaRef): ValidationResult, then bind a concrete engine to it in a service provider so it is swappable. Inject that contract into FormRequests, jobs, and webhook handlers so malformed data is rejected at the boundary before reaching application logic. Keeping the adapter thin also makes future engine migrations a one-class change.
- How do I test JSON Schema validation rules?
- Unit test the adapter, not the framework wiring: feed known-valid and known-invalid fixtures through the validator and assert both the pass/fail outcome and the structured error payload. Keep schema files in tests/fixtures with stable $id values, and add a feature test through a FormRequest or middleware to confirm the container binding resolves correctly. With PHPUnit or Pest this stays fast because no network or database access is involved.
- Is this package still maintained and will it receive updates?
- There is no sign of active maintenance: zero stars, zero dependents, and a repository structure consistent with a Symfony 2.x era internal tool. Assume no Composer constraint bumps, no PHP 8 compatibility work, and no security patches. Treat it as read-only reference material at best, and plan a migration to a maintained library if you currently depend on it.