- Can I use kocal/biome-js-bundle in a Laravel application?
- Not idiomatically. This is a Symfony bundle that relies on bundle registration, a DI extension, and Symfony console wiring, none of which Laravel provides, so it cannot simply be composer required and used as intended. For a Laravel team its value is as a reference implementation: the same behaviour is roughly a hundred lines inside one Artisan command. The underlying pattern ports cleanly because Laravel already ships symfony/console and symfony/process transitively and has Guzzle available for the download step.
- How do I install kocal/biome-js-bundle?
- Install it with Composer and, if you use Symfony Flex, accept the recipe so the bundle is registered in config/bundles.php automatically. Outside Flex you register the bundle manually and then run the bundle's console commands for checking and formatting frontend assets from the Symfony console. No Node.js toolchain is required in the runtime or CI image because the bundle fetches the Biome binary itself.
- Does this bundle require Node.js or npm installed?
- No. The bundle downloads the platform-specific Biome binary from GitHub releases and shells out to it through symfony/process, so PHP is the only runtime dependency you need. That is the main reason to consider it at all: Biome is a Rust binary, so you avoid maintaining a Node toolchain just to lint and format JS, TS, JSON, and CSS. The trade-off is that you now depend on network access and on GitHub release asset availability at install or deploy time.
- How do I configure Biome's rules with this bundle?
- The bundle ships sensible defaults but reads project-level Biome configuration, so you place a biome.json at your project root and it overrides what the bundle provides. That keeps your linting and formatting rules in the standard Biome format rather than inventing Symfony-specific configuration keys. Commit that file so local runs and CI enforce the same rules.
- Which Symfony and PHP versions are supported?
- Version 2.1.2 added CI coverage against the Symfony 8 stable line, which implies a PHP 8.4+ leg in the test matrix. Check composer.json to see whether Symfony 8 is a declared constraint or only a tested one, because those are different promises. None of this helps a Laravel project directly: Laravel does not track Symfony majors, so Symfony forward compatibility says nothing about your framework.
- Can I pin the Biome version the bundle downloads?
- Yes, the target Biome version is configurable, and you should always pin it rather than floating on latest. Pinning keeps formatting output stable across machines and CI runs, and it makes checksum verification meaningful. Note that asset naming has changed across Biome releases and platform targets vary, so an unpinned upgrade can break the download step without any PHP code changing.
- Is downloading and executing a native binary at install time a security risk?
- It is the single largest risk in the package. Pulling a platform-specific executable from GitHub releases and running it means an unreviewed remote-code-execution path into your CI and developer machines unless you pin versions and verify checksums. The .gitattributes fix in 2.1.2 only reduces the number of files shipped in Composer dist installs; it does nothing for the download risk. If your threat model does not accept that, use the official Biome Docker image or a pre-baked binary in your image instead.
- Does it work in CI, Docker containers, or air-gapped builds?
- Anything that needs network access at install or deploy time breaks in air-gapped builds, restricted CI runners, and read-only container filesystems. There are also silent failure modes: an architecture misdetection, such as Rosetta-emulated arm64 runners, or a missing musl build fails later at lint time rather than at install time, which makes it look like a Biome bug. Baking the binary into your image ahead of time avoids both problems.
- What is the Laravel equivalent for running Biome without Node?
- You have three sane options that do not involve adopting this bundle. Write a small Artisan command such as php artisan biome:install that downloads and caches a pinned binary, add a Composer post-install-cmd script that does the same, or use the official ghcr.io/biomejs/biome Docker image in CI. All three remove Node from the equation; only the first requires code you own, and none of them depend on a Symfony DI extension.
- Is kocal/biome-js-bundle actively maintained and production ready?
- It is maintained but unproven. The project has roughly 32 stars, zero dependents, and a single maintainer, so there is effectively no bus factor; the MIT license means you can fork it if it is abandoned. Release 2.1.2 is a patch with two maintenance items, Symfony 8 test coverage and a .gitattributes fix, which is evidence of upkeep rather than adoption. Treat it as a low-risk read and a higher-risk dependency for anything critical.