Forgot Password Bundle Laravel Package

Product Decisions This Supports

• Feature scoping for account recovery. The package covers one flow end-to-end: reset request → token issue → email delivery → token expiry → validate → consume → password set. That's the table stakes slice; it does not cover MFA reset, SSO account recovery, account unlock, or authenticated "change password." Use it to draw a clean boundary around the v1 auth story rather than letting stakeholders assume "forgot password" closes the whole recovery epic.
• Build vs. buy, with a third option. A production-grade reset flow (hashed single-use tokens, TTL, throttling, enumeration-safe responses, email templating, localization) is typically 3–5 dev days plus QA and a security review. The "buy" case here is thin: MIT license is fine, but 0 stars, 0 dependents, and a last release of 2021-01-27 means you're not buying a product — you're vendoring an abandoned branch. The realistic decision is build on framework defaults (Laravel's native Password broker + a notification, or Fortify/Breeze for the UI) versus fork-and-own if you're on legacy Symfony.
• Roadmap sequencing. If password reset is currently blocking activation or support ticket volume, framework defaults ship it this sprint. If the real pain is "users can't get back in," the higher-leverage roadmap item is usually support-assisted recovery plus better session/remember-me UX, not a new dependency.
• Stack triage. Critical input: this is a Symfony 2 bundle, not a Laravel package. For a Laravel roadmap this is a non-starter; for a legacy Symfony estate it's a candidate. That distinction belongs in the decision log before any engineering time is spent.

When to Consider This Package

Adopt only if:

• Your codebase is Symfony 2.x/3.x and you cannot justify a rewrite or a migration to modern Symfony.
• You need a configurable reset flow (token TTL, email templates, storage adapter) and are willing to own a fork — budget for a named maintainer and a periodic security review, because upstream patches will not arrive.
• You want a reference implementation of the reset state machine to port, not a runtime dependency.

Look elsewhere if:

• You're on Laravel — hard no. Illuminate\Auth\Passwords already provides the broker, token repository, expiry, and throttling; Notifiable handles delivery; Fortify/Breeze/Jetstream supply the routes and views. Adopting this adds a dead dependency to reimplement what you have.
• You're on modern Symfony — use symfonycasts/reset-password-bundle, the actively maintained successor in this exact lineage. Same concepts, current PHP support.
• You need compliance evidence — audit trails, configurable lockout policy, and documented CVE response are not available from a project with a 2021 freeze date.
• You need passwordless/magic-link auth — different problem, different library.

How to Pitch It (Stakeholders)

Executives: Password reset is a must-have, not a differentiator — customers expect it to work and never notice it. My recommendation is to not add this package to the dependency tree. It's a 2021-frozen fork of a Symfony bundle with zero adoption, which turns a solved problem into a standing maintenance and security liability with no vendor behind it. We get identical functionality from framework defaults in roughly the time it takes to configure an email template, and we keep the security-review surface inside code we already own.

Engineering: This is a fork of coopTilleuls/forgot-password-bundle targeting Symfony 2 — zero stars, zero dependents, no release since January 2021. On Laravel it's the wrong ecosystem entirely: the native password broker plus a queued notification covers request, token issue, TTL, throttling, and confirm, and Fortify gives us the UI. If any legacy Symfony service still needs it, use symfonycasts/reset-password-bundle instead. The only thing worth taking from this repo is its state machine as a design reference — request, issue, expire, validate, consume — not the code itself.