- Does jeroendesloovere/vcard-bundle work with Laravel?
- No. It is a Symfony2 bundle: it ships a Bundle class extending Symfony\Component\HttpKernel\Bundle\Bundle, XML service definitions, and a DependencyInjection extension. Laravel has no bundle auto-discovery, no AppKernel registration, and no Symfony compiler pass to hook into, so nothing wires into Laravel's container, facades, or config publishing.
- Can I install jeroendesloovere/vcard-bundle in a Laravel 10, 11, or 12 app?
- In practice, no. The composer.json was last touched in 2018 and constrains symfony/framework-bundle to 2.x/3.x, while modern Laravel resolves Symfony components at ^6/^7. Composer will either fail outright or force a downgrade of shared Symfony packages that Laravel itself depends on, which is a hard blocker rather than a nuisance.
- How do I generate vCard (.vcf) files in Laravel without the Symfony bundle?
- Adopt the framework-agnostic library the bundle wraps, jeroendesloovere/vcard, which is plain PHP and can be consumed directly from Laravel. Register your own VCardService or VCardBuilder value object as a singleton, inject it into the export controller or queued job, and keep the default version and charset in config/vcard.php published by a service provider you write. That is roughly half a day of scaffolding and gives you the generator without the dead Symfony layer.
- Is jeroendesloovere/vcard-bundle still maintained?
- No. The last release is dated 2018-11-30, roughly seven years without a commit, with no PHP 8.x validation and no security response path. It has about 16 stars and zero dependents, so it is effectively single-maintainer with a bus factor of one. For code that touches customer contact data, that is a strong negative signal.
- What is the difference between jeroendesloovere/vcard and jeroendesloovere/vcard-bundle?
- The bundle is a thin Symfony integration layer that registers the underlying jeroendesloovere/vcard library as a service and adds helpers for returning downloadable .vcf responses from Symfony controllers. The library itself only builds vCard output from PHP data and has no framework coupling. In a Laravel app, only the library is salvageable.
- What are the best alternatives to jeroendesloovere/vcard-bundle for a Laravel project?
- sabre/vobject is the usual recommendation: it is maintained, widely deployed, and handles both vCard generation and parsing. If you only need to write cards, a thin RFC 6350 writer behind your own interface is a few hundred lines and cheaper to own than a fork of an abandoned bundle. Either way, wrap it in a Laravel service so the implementation stays swappable.
- Should I generate vCard 3.0 or vCard 4.0?
- vCard 3.0 is materially safer if Outlook interoperability matters, and it covers most contact-export use cases. vCard 4.0 (RFC 6350) is the modern spec but client support is uneven, and this bundle has no 4.0 work at all. Pick 3.0 unless you have a concrete requirement that demands 4.0.
- How do I return a downloadable .vcf response from a Laravel controller?
- Build the card through your service, then return a response with the text/vcard content type and an attachment Content-Disposition header carrying the filename. In Laravel that is a normal response()->make() call with those headers, so you do not need any bundle helper. Keep the raw generator output untouched apart from the headers, since re-encoding is a common source of broken files.
- Is generating vCards from user profile data safe from injection?
- Not automatically. vCard properties are newline-delimited, so unescaped newlines or literal \n sequences in fields such as ORG, TITLE, or NOTE allow property injection into the generated card. If you build cards from user-supplied profile data, you must add explicit sanitization yourself. The same code path also needs correct 75-octet line folding, CRLF handling, and charset declaration, which are easy to get subtly wrong.
- How should I test vCard output before shipping to production?
- Validate against the strictness of each target client: iOS Contacts, Outlook, Google Contacts, and Android all fail differently on folding, encoding, and charset issues. Byte-level assertions on the generated file plus manual import tests on real devices catch what unit tests miss. Also confirm your vCard dependency is maintained, since an abandoned package in a GDPR-relevant contact data path is a procurement and audit liability.