- Is liverbool/media safe for production Laravel applications?
- Based on the available signals, no. It is described as a temporary port of Sylius Media, published in May 2016 and never released again, with zero stars and no known dependents. File-upload and image-processing code is a high-risk attack surface, and unpatched 2016 dependencies can carry known vulnerabilities. Treat it as reference code, not a supported production dependency.
- Does liverbool/media support Laravel 10, 11, or 12?
- There is no evidence of support for modern Laravel versions. A 2016 package will likely declare PHP 5.x/7.0-era constraints and old Symfony or Imagine dependencies, so Composer resolution on PHP 8.1+ and Laravel 10/11/12 is expected to fail without forced overrides. Check composer.json and test in a throwaway project before assuming compatibility.
- How do I install liverbool/media with Composer?
- The Composer name is liverbool/media, but installation is not recommended for new Laravel applications. If you only need to inspect it, require it in a disposable project and review composer.json transitively for Doctrine, Symfony, Gaufrette, or LiipImagine. Do not add it to a production application without confirming dependency resolution and provenance.
- What PHP versions and dependencies does liverbool/media require?
- The exact constraints are not established in the provided context, so inspect its composer.json. Given its May 2016 publication, expect legacy PHP and Symfony/Doctrine-era constraints rather than modern Laravel-ready dependencies. The key question is whether it pulls a parallel Symfony stack into your application.
- Can liverbool/media attach uploads to Eloquent models?
- The package advertises a fluent API for associating media with Eloquent models, but that behavior is not independently validated. The technical assessment warns it is likely a namespaced copy or thin wrapper around Sylius Media, which was built for Symfony and Doctrine. Verify with integration tests before relying on Eloquent relationships, metadata, ordering, or collections.
- Does liverbool/media store files on S3 or Laravel filesystem disks?
- The overview claims storage on local, S3, or other Laravel disks, but the package predates modern Laravel filesystem conventions and may retain Gaufrette or Flysystem-style Symfony abstractions. Confirm which disk adapter it actually uses and whether it respects Laravel's Storage configuration. For new work, Laravel's native Storage disks plus Flysystem adapters are the supported path.
- Can liverbool/media generate image conversions and responsive variants?
- It advertises image conversions and responsive variants, likely via legacy Imagine or LiipImagineBundle-style code. That is a high-risk area because image processing handles untrusted uploads, and unpatched libraries can have known CVEs. Use a maintained Laravel-native stack such as spatie/laravel-medialibrary with intervention/image v3 or Glide if you need conversions.
- How does liverbool/media compare with spatie/laravel-medialibrary?
- spatie/laravel-medialibrary is maintained, Laravel-native, and widely adopted for media models, conversions, disk abstraction, and collections. liverbool/media has no observable consumer base, no releases since 2016, and likely carries Symfony or Doctrine coupling. For new Laravel applications, the maintained package is the conventional choice; liverbool/media is at best reference code.
- What are the main technical risks of using a 2016 Sylius media port in Laravel?
- The risks are high: file-upload and image-processing attack surface, unpatched dependency CVEs, PHP 8 and Laravel 10+ incompatibility, autoloading and namespace collisions, and unclear provenance for copied Sylius code. MIT licensing is permissive, but you should confirm upstream attribution and any NOTICE requirements. The package also lacks third-party validation in production Laravel applications.
- How do I migrate away from liverbool/media if it is already in my codebase?
- Freeze and fence it by vendoring the package into a private VCS or app/Support namespace and removing the Packagist constraint. Introduce internal contracts such as MediaRepository, ImageProcessor, and MediaStorage, and route every call site through them. Characterize current upload validation, path conventions, and variant dimensions with integration tests, then dual-run in staging before swapping in a maintained stack.