- Is hshn/npm-bundle compatible with Laravel?
- No. hshn/npm-bundle is a Symfony2 bundle that registers through AppKernel and reads configuration from the hshn_npm key in Symfony's config tree. Laravel has no Bundle system, so there is no supported way to load or boot it inside a Laravel application. Using it in Laravel would require rewriting it as a service provider.
- Can I install hshn/npm-bundle with Composer in a Laravel app?
- Composer may resolve it, but the package pulls Symfony 2.x and 3.x constraints that collide with the Symfony 6 components shipped in Laravel 9 and later. You will either get a dependency resolution failure or a downgrade cascade across your whole application. Even if it installs, nothing in Laravel will discover or boot the bundle.
- What does hshn/npm-bundle actually do?
- It integrates npm into Symfony projects so you can declare node module dependencies for each bundle and run npm tasks as part of the asset and build workflow. It bridges Symfony console tooling with npm commands rather than managing frontend assets itself. The functionality is roughly a few hundred lines of dependency resolution and script running.
- Which Laravel versions does hshn/npm-bundle support?
- None. The package was built for Symfony 2 and Symfony 3, and the last release was in August 2017, long before modern Laravel versions existed. It has no PHP 8.x compatibility work and no Laravel service provider, facade, or config file. Treat Laravel support as zero.
- What is the best Laravel alternative to hshn/npm-bundle?
- Vite via laravel-vite-plugin is the first-party answer, wired into the @vite Blade directive and manifest resolution. For older applications, Laravel Mix with webpack.mix.js remains a workable option. Both replace the bundle's purpose with maintained tooling and explicit npm ci and npm run build steps in your deploy pipeline.
- Is hshn/npm-bundle still maintained?
- No. The repository is archived, the last release was August 2017, and it has only a handful of stars and no dependents. There is no active maintainer, no issue triage, and no roadmap. Any bugs you hit, including npm-side drift, will stay unfixed upstream.
- Does hshn/npm-bundle work with modern npm and package-lock.json v3?
- Unlikely to work cleanly. The bundle was written against 2017-era npm behavior and does not account for npm workspaces, package-lock v3, or npm ci semantics. Since the project is archived, there is no upstream path to fix compatibility. Modern projects should run npm directly rather than through a PHP wrapper.
- How is hshn/npm-bundle configured, and can Laravel read that config?
- Configuration lives under the hshn_npm key in Symfony's config.yml or config/packages tree, and the bundle is registered in AppKernel. Laravel reads config/*.php files through its own repository and has no loader for Symfony bundle extension classes. You would have to re-express every option as a Laravel config file plus an AssetServiceProvider.
- Can I fork hshn/npm-bundle into a Laravel service provider?
- Technically yes, but it is a re-implementation rather than an integration. You would extract the dependency-resolution and script-runner logic, wrap it in a service provider, move configuration into config/assets.php, and swap Symfony event hooks for Laravel's dispatcher. That is a multi-day fork to reproduce behavior Vite gives you in under an hour of setup.
- Does hshn/npm-bundle have a security response process?
- No. As an archived repository with no maintainer and no dependents, there is no CVE channel and no one to ship a patch. Any vulnerability in the bundle or in the npm behavior it wraps would remain unaddressed. Most security policies for production applications will not permit archived dependencies without a response path.