- How do I install league/uri-schemes in a Laravel application?
- Install it with composer require league/uri-schemes. It is PSR-4 autoloaded and needs no service provider, config file, or facade. In a modern Laravel stack the install will often fail at dependency resolution rather than at runtime, because the package pins league/uri 5.x and its companion packages.
- Is league/uri-schemes compatible with Laravel 10, 11, and PHP 8.2?
- Not officially. The code targets the PHP 7.0 to 7.2 era and was archived in 2018, so expect deprecation noise and edge-case breakage on PHP 8.2+ from stricter type handling and dynamic property changes. There is no upstream maintainer to ship a fix. Composer installation only succeeds when the rest of your dependency tree still allows league/uri 5.x.
- Why does composer require league/uri-schemes fail with a league/uri version conflict?
- The package requires league/uri 5.x together with league/uri-components and league/uri-hostname-parser. Most current Laravel and PHP packages pull in league/uri 6 or 7 transitively, so Composer hard-fails on update. Run composer why-not league/uri ^7 to see exactly which dependency is holding the legacy tree in place.
- What is the difference between league/uri-schemes and league/uri?
- league/uri-schemes was a standalone collection of scheme value objects such as Http, Ftp, and Mailto. From league/uri 6 onward those classes moved into the main package, for example League\Uri\Http, and the accessor API was largely preserved. That means league/uri 7 is the maintained successor and league/uri-schemes is effectively absorbed upstream.
- How do I migrate from League\Uri\Schemes\Http to League\Uri\Http?
- Swap the imports from League\Uri\Schemes\Http to League\Uri\Http, then adjust your exception handling to League\Uri\Contracts\UriException. Expect stricter default validation to reject some inputs the legacy version accepted, so add regression tests around your parsing call sites. The work is mechanical and typically takes one to three engineer-days per service.
- Is league/uri-schemes safe to use in production?
- Treat it as a risk-register item rather than ordinary tech debt. The package has had no maintainer since 2018, no security response process, and no CVE triage. Because URL parsing often sits on a security boundary such as SSRF allowlists, redirect validation, or OAuth callback matching, an unmaintained parser there is an audit finding. Move to league/uri 7 where possible.
- Can I use league/uri-schemes to validate redirect URLs and prevent SSRF?
- It can parse, normalize, and rebuild URIs, which is useful for constructing scheme and host allowlists. It does not implement SSRF protection by itself, and because it is unmaintained its parsing behavior on modern PHP is untested. For anything security-relevant, prefer league/uri 7 and pair it with DNS resolution checks and explicit scheme, host, and port allowlists.
- Does league/uri-schemes support international domain names and IRIs?
- IDN handling comes through league/uri-hostname-parser and ext-intl, so it depends on that extension being available in every environment. The legacy hostname parser also behaves differently from the modern one used in league/uri 6 and 7. Verify ext-intl across your environments and test punycode output before relying on it.
- Do I need a service provider or facade for league/uri-schemes in Laravel?
- No. The package ships zero Laravel integration, so there is no service provider, config, facade, validation rule, cast, or middleware. If you want it resolved from the container you must write your own thin wrapper and binding. Keep that wrapper minimal, since the dependency itself is temporary and should not become load-bearing.
- What should I use instead of league/uri-schemes in Laravel?
- Use league/uri 7, which provides the same immutable value-object model under League\Uri\Http and related scheme classes with active maintenance. For many cases Guzzle PSR-7 and Symfony HttpFoundation already cover URL handling in a standard Laravel install. Replacing the few call sites is usually cheaper than carrying a permanent abandoned dependency.