- Is league/uri-parser still maintained, or should I use league/uri v7 instead?
- league/uri-parser is archived and its last release was in November 2018, so it no longer receives compatibility, correctness, or security updates. For new development, use league/uri v7, the maintained successor that covers parsing plus URI manipulation and validation helpers. Existing applications can retain league/uri-parser as a compatibility dependency, but it should be contained behind an adapter with a migration plan.
- How do I install league/uri-parser with Composer in a Laravel application?
- Install it with composer require league/uri-parser and use it as a plain PHP library. There is no Laravel service provider, facade, or configuration file to publish. Pin the exact version in composer.json, commit composer.lock, and call the parser from an application-owned service rather than directly from controllers.
- Does league/uri-parser work with Laravel and which PHP versions are supported?
- The package is framework-agnostic and has no Laravel coupling, so it can run inside a Laravel application as a Composer dependency. However, because the last release was in 2018, its Composer constraints may not install cleanly on current PHP or Laravel versions. Verify installation on your target stack before adopting it, and prefer league/uri v7 for new projects.
- What is the difference between league/uri-parser and PHP's parse_url()?
- league/uri-parser is an RFC 3986/RFC 3987 compliant parser that returns URI components such as scheme, authority, user info, host, port, path, query, and fragment. PHP's parse_url() is built in and convenient but has known edge cases and less strict handling for malformed or relative URIs. Neither one is a validator, so parsing must still be followed by explicit policy checks.
- Can league/uri-parser validate URLs or prevent SSRF and open redirects?
- No. league/uri-parser parses URI components but is not a URL validator, HTTP client policy layer, or security boundary. Preventing SSRF, open redirects, host confusion, scheme downgrades, and user-info obfuscation requires explicit allow-lists, scheme checks, host normalization, and tests in your application. Do not rely on parsing alone when handling untrusted redirects or callback URLs.
- How do I migrate from league/uri-parser to league/uri v7?
- First inventory usage with composer why league/uri-parser and a codebase search for direct references. Wrap all call sites behind an application-owned adapter, then build a parity test corpus covering absolute URLs, relative references, IPv6 hosts, encoded delimiters, Unicode input, and malformed strings. Swap the adapter internals to league/uri v7 and run the parity tests before removing the old dependency.
- Does league/uri-parser support IDN, IRI, or Unicode hostnames?
- The package is described as RFC 3986/RFC 3987 compliant, but it is not an IDN or IRI resolver and does not perform punycode conversion or DNS resolution. Unicode and internationalized hostnames should be normalized or converted with dedicated IDN functions before you apply host-based security policy. Test Unicode and IDN inputs explicitly if they can reach your parsing code.
- How should I use league/uri-parser safely in a Laravel application?
- Wrap it in a small application-owned adapter, such as UriParserService, that exposes only the operations your product needs. Do not let League\Uri\Parser arrays leak across controllers, jobs, or middleware. Keep validation policy and security rules outside the parser so a future replacement with league/uri or another RFC-compliant parser stays contained.
- What URI edge cases should I test when using league/uri-parser?
- Cover absolute URLs, relative references, scheme-relative URLs, IPv4 and IPv6 hosts, user-info components, empty components, encoded delimiters, Unicode or IDN inputs, and malformed strings. Add parity tests comparing behavior with league/uri v7, parse_url(), and any PSR-7 URI implementation you use. These tests are especially important if parsing sits on a trust boundary such as redirect or webhook validation.
- Is league/uri-parser a security risk if it is already a transitive dependency?
- Risk is elevated because URI parsing often sits on a trust boundary, and an archived package will not receive upstream fixes if a bypass or edge-case defect is found. Use composer why league/uri-parser to determine whether it is a direct or transitive dependency and identify what is pulling it in. Contain it behind an adapter, pin versions, and plan migration to league/uri v7; the MIT license itself is low-risk.