- Is lidaa/twig-bundle a Laravel package?
- No. lidaa/twig-bundle is a Symfony bundle, not a Laravel package — there is no service provider, facade, or config/twig.php, and it registers extensions through Symfony's DI twig.extension compiler tag. It will not boot on Laravel. The only viable route is porting the extension classes into your own Laravel package.
- Can I install lidaa/twig-bundle in Laravel with Composer?
- Composer may resolve it, but the bundle will not boot in a Laravel application because it depends on Symfony's DI container and the twig.extension compiler tag. To use Twig in Laravel you would pair rcrowe/twigbridge with source-level ported extensions registered via a service provider. Treat the bundle as a reference implementation, not a runtime dependency.
- What Twig extensions does LidaaTwigBundle provide?
- It ships roughly 14 extensions including php, image, url, css, js, tag, session, number, sf, unset, form, and html. The css, js, tag, html, number, unset, url, and image classes are thin and mostly stateless, making them portable to Laravel. The form, session, and sf extensions are tightly coupled to Symfony Form, SessionInterface, and Symfony facades.
- Is the php Twig extension safe to use?
- No. The php extension exposes php_function() and php_call(), which turns every template into an arbitrary-code-execution surface — any CMS- or admin-editable template becomes an RCE vector. It is the package's headline feature and its single largest liability. Do not port it, and make its exclusion an explicit written policy.
- Does Lidaa Twig Bundle support Twig 3 and PHP 8.2?
- The extension inventory reads as Twig 1.x, using getName(), initRuntime, and Twig_Extension — all removed in Twig 3. Several extensions will need mechanical rewrites just to compile on a modern Twig 3 / PHP 8.2 target. Check the declared php, twig/twig, and symfony/* constraints before assuming any of it resolves without --ignore-platform-reqs.
- How do I use Twig in Laravel instead of this bundle?
- Use rcrowe/twigbridge to add Twig to Laravel's view system, then register your own extension classes through a Laravel service provider and the twigbridge extension hook. Do not install the Symfony bundle — it cannot be a runtime dependency of a Blade-first Laravel stack. This also lets you drop php and session before anything reaches a template author.
- Can I port the css, js, tag, and html extensions to Laravel?
- Yes, with modest effort. These are thin, mostly stateless classes, and the main work is swapping Symfony's assets and router helpers for Laravel's url(), asset(), and Vite manifest. Expect roughly 1–2 days of rework per extension plus test coverage.
- What is the maintenance and security risk of lidaa/twig-bundle?
- The project has about 24 stars, zero dependents, a single maintainer, and a low health score, so there is no downstream validation, issue triage, or advisory stream. Assume zero upstream fixes and no composer audit coverage. Vendor it at a pinned commit hash or fork it into your monorepo — never depend on a semver range.
- Does LidaaTwigBundle work with Symfony's form and session extensions?
- Yes inside Symfony, but the form extension needs Symfony Form and form themes, session is typed against SessionInterface, and sf is a Symfony facade. None of those port to Laravel without reimplementation. Plan to drop or rewrite them rather than lift them.
- What is the recommended integration approach for Laravel teams?
- Do not install the bundle. Harvest the portable extension classes — css, js, tag, html, number, unset, url, image — into an internal Laravel package registered through a service provider and twigbridge. Scope this as a reference-implementation decision, not a dependency decision, and gate it behind a license and security review.