- Is ivory/serializer compatible with Laravel 11?
- There is no Laravel service provider, facade, or published config, so Laravel 11 compatibility is not guaranteed by the package itself. The repository is archived and advertises PHP 7.0+ constraints, while modern Laravel requires PHP 8.1+, so you must prove compatibility on your target PHP and Laravel matrix. Any integration would be manual wiring behind your own adapter rather than a supported framework integration.
- How do I install ivory/serializer with Composer?
- Install it like any other Composer package with composer require ivory/serializer, then instantiate the serializer classes directly in your code. There is no Laravel auto-discovery, so you will not get a registered service provider or facade after installation. Because the repository is archived, pin an exact version and commit your composer.lock so installs stay reproducible.
- Does ivory/serializer provide a Laravel service provider or facade?
- No. It is a framework-agnostic PHP library and ships no service provider, facade, configuration publishing, or Laravel conventions. In a Laravel application you would bind it manually in a service provider or resolve it through the container yourself. Keeping it behind an internal interface prevents package-specific types from leaking into controllers and domain services.
- What formats does ivory/serializer support?
- It acts as a thin layer over Symfony Serializer components and covers JSON, XML, YAML, and CSV through per-format encoders and decoders plus format constants. The public surface is small: a deserialize call, format constants, and the per-format classes. That keeps the integration surface low but does not reduce the risk of parsing untrusted input.
- Can ivory/serializer deserialize JSON into PHP DTOs?
- Yes, it can hydrate PHP classes using Symfony's normalizer pipeline. Hydration depends on no-argument constructors and setters, and failures often surface deep inside Symfony's normalizer with messages that are hard to diagnose. If DTO mapping is your main requirement, using symfony/serializer directly gives you the same capability with maintained upstream support.
- Is ivory/serializer safe for untrusted XML, YAML, or CSV input?
- Treat it as high risk for untrusted data. XML parsing raises XXE and entity expansion concerns, YAML can allow unsafe object instantiation, and CSV opens formula injection and encoding mismatch issues, plus memory pressure on large payloads. If you must use it, disable external entities and YAML object support, escape CSV output, enforce size and row limits, and restrict input to trusted sources.
- Is ivory/serializer maintained and production-ready?
- The repository is archived, has roughly three stars and no dependents, and receives no security patches or bug fixes. That means your team owns every future fix and compatibility update. It is best treated as a design reference or requirements checklist rather than a strategic production dependency.
- What are the best alternatives to ivory/serializer in Laravel?
- Use native json_decode for JSON, symfony/serializer when you need object mapping, league/csv with streaming readers for CSV, and spatie/array-to-xml, SimpleXML, or XMLReader for XML. symfony/yaml covers YAML, while Laravel form requests handle validation and queued jobs handle bulk imports. These options are maintained and avoid the archived-dependency risk.
- How should I test an ivory/serializer integration in a Laravel app?
- Wrap the package in a single internal DeserializerInterface adapter so it stays isolated from controllers, jobs, and domain services. Add per-format contract tests using representative production payloads on your real PHP and Laravel matrix, including malformed and oversized inputs. Also audit transitive dependencies for abandoned packages and known CVEs before gating any limited production use on test coverage.
- Does ivory/serializer handle nested objects, arrays, and collections?
- Yes. It provides a configurable normalizer and encoder pipeline intended to represent nested objects, arrays, and collections consistently. Custom serialization strategies are supported, but you should validate recursion depth, memory use, and scalar type coercion on your own payloads. For new work, replicate the pattern with maintained libraries instead of adopting the package.