- Is liverbool/media-bundle compatible with Laravel?
- No. Despite frequently being listed alongside Laravel packages, liverbool/media-bundle (repository dos-media-bundle) is a Sylius/Symfony bundle extracted from the legacy Sylius MediaBundle. It depends on Symfony bundle mechanics such as kernel registration, compiler passes, XML/YAML service definitions, and Doctrine mapped superclasses, none of which map onto Laravel's service provider and container model. Bridging it would be a rewrite rather than an integration, so it should be struck from any Laravel evaluation set before engineering time is spent.
- How do I install liverbool/media-bundle with Composer?
- You would run composer require liverbool/media-bundle, but on any modern stack the dependency graph will not resolve. Composer rejects it because its constraints target the PHP 5.5 to 7.0 era with Symfony/Sylius 2.x, 3.x, and 0.x components. Forcing the install surfaces removed container APIs, deprecation flooding, and Doctrine mapping drift at cache warmup. The cheapest decisive check is a dry run against your real constraints rather than a full install attempt.
- What PHP and Symfony versions does liverbool/media-bundle require?
- Expect composer.json to pin PHP to roughly 5.5 through 7.0 and Symfony/Sylius to the 2.x, 3.x, and 0.x lines. Under PHP 8 and Symfony 6 or 7 the graph will not resolve at all. There is no release history suggesting those constraints were ever widened, since the last tagged release was in 2016.
- What should I use instead of liverbool/media-bundle in Laravel?
- Use spatie/laravel-medialibrary together with Laravel's filesystem and Flysystem integration, plus intervention/image for conversions. Medialibrary is the de facto standard for attaching files to Eloquent models, is actively maintained, and supports PHP 8 and current Laravel releases. It covers single and multiple attachments, configurable storage disks, automatic file naming and metadata, and URL and Blade helpers natively.
- Is liverbool/media-bundle still maintained?
- No. The last release was 2016-05-24, leaving roughly a decade of drift with no security response path. It has zero stars and zero dependents, so there is no issue history, no incidental bug-finding community, and no tutorial or Stack Overflow coverage to fall back on. Treat it as a code sample, not a dependency.
- Can I use liverbool/media-bundle in a modern Sylius project?
- It is technically native to that ecosystem, but it is still redundant. Sylius has shipped first-party media and image handling for years, and the supported path is Sylius core media with LiipImagineBundle for filters and thumbnails, VichUploaderBundle for uploads, and Flysystem for storage. A 2016 third-party bundle adds supply-chain risk without adding capability.
- How do I quickly verify whether liverbool/media-bundle will work in my project?
- Run a time-boxed spike of roughly half a day executing composer require liverbool/media-bundle --dry-run against your target PHP, framework, and Doctrine constraints. A failed dependency resolve is the deliverable, and it closes the ticket with evidence instead of opinion. If it somehow resolves, follow up with a cache warmup and a smoke test of the upload and file-serving path before going any further.
- Does liverbool/media-bundle handle uploads, storage disks, and image thumbnails?
- Its description promises storage integration, image processing, and flexible configuration for attaching files to application entities, which is typical of the old Sylius MediaBundle extraction. In its own ecosystem most of that is now covered by Sylius core plus LiipImagineBundle and VichUploaderBundle. In Laravel the equivalent feature set comes from spatie/laravel-medialibrary with intervention/image and Flysystem-backed disks, so there is no reason to port this bundle.
- What are the security risks of using liverbool/media-bundle?
- Media bundles sit directly on file upload, storage paths, MIME validation, and public serving, which is the highest-severity vulnerability class: path traversal, unrestricted upload, and private file exposure. Severity here is critical because the package has had no releases since 2016, no security response channel, and stale transitive dependencies that likely carry unpatched advisories. Verify the license before any code reuse, since an unmaintained vendor bundle may not carry clear terms.
- How do I migrate an existing project off liverbool/media-bundle?
- First establish whether the bundle is already in a lockfile or running in production, because an inherited install needs a removal plan rather than a fresh evaluation. Capture its database schema and storage layout so existing media records and file paths can be mapped to the replacement. Then move to Sylius core media with VichUploaderBundle, LiipImagineBundle, and Flysystem on the Symfony side, or spatie/laravel-medialibrary on the Laravel side, re-indexing files so URLs and metadata stay consistent.