micayael/form-generator-bundle
A bundle for generating and managing dynamic forms in PHP applications, with support for configurable fields, reusable form definitions, and streamlined form rendering.
Verdict up front: this is a low-confidence candidate. It is presented as a Laravel/PHP package, but the name (...-bundle) and the Spanish description ("Bundle para generar formularios mediante yaml y json") indicate a Symfony bundle, not a Laravel package. A Laravel application cannot consume it without the Symfony Form component and a bundle-registration shim. Combined with 0 stars, 0 dependents, and an opportunity score of 26.65, this should be treated as an unvetted, unproven artifact — a reference implementation to study, not a dependency to adopt.
*Bundle class, DependencyInjection/, Resources/config/, and service definitions wired through Symfony's container. Laravel's container, facade, and package-discovery model are not compatible out of the box.symfony/form. The package generates FormType/FormBuilderInterface structures from declarative config. That means the entire Symfony Form rendering, validation, and data-mapping pipeline — plus symfony/options-resolver, symfony/property-access, and typically Twig form themes — comes with it. This is not a leaf dependency; it is a parallel form subsystem alongside Laravel's Blade/validation stack.type maps to arbitrary class names, or if options are passed through unvalidated, you have a deserialization/injection surface. Any adoption requires a strict allowlist of field types and options.Illuminate\Support\ServiceProvider, and bridge Laravel's validator to Symfony's constraints.Validator rules.| Risk | Severity | Notes |
|---|---|---|
| Symfony/Laravel impedance mismatch | High | Two DI containers, two templating engines, two validation models |
| Unmaintained / single-author | High | 0 stars, 0 dependents implies no maintainer incentive and no external bug reports |
| Security of dynamic form generation | High | Untrusted YAML/JSON → class instantiation and option passthrough |
| Symfony major-version coupling | Medium | Symfony Form has breaking changes across majors; no signal the package tracks them |
| PHP/Laravel version compatibility | Medium | Unverified against PHP 8.2+/Laravel 10/11 |
| Documentation in Spanish only | Low–Medium | Adds onboarding friction; may indicate a regional/niche user base |
| No visible test suite or CI | Medium | Assume none until proven |
composer.json constraints for php, symfony/form, and symfony/framework-bundle?type resolve to a concrete class — allowlisted registry, or arbitrary FQCN from config? Is there an extension point for custom types?Because there is nothing to migrate from on day one, the meaningful path is an exit path — design the integration so removal is cheap:
FormSchema (value object) + FormSchemaLoader (YAML/JSON → FormSchema) + FormRenderer (Blade) + FormValidator (Laravel rules).symfony/yaml or spatie/laravel-yaml-style parsing is fine as a leaf dependency; JSON via json_decode).FormSchema interface and is never referenced by application code.^5.4, ^6.x, ^7.x) and whether symfony/form can coexist with Laravel's illuminate/* version pins. Symfony components generally install cleanly alongside Laravel, but symfony/http-foundation is a shared conflict point — check composer why-not before committing.Yaml::parseFile(..., Yaml::PARSE_...) flags appropriate to the config (no object deserialization).composer.json, identify the field-type resolution mechanism. Decision gate.FormSchema + loader + Blade renderer against one real form (ideally a tenant-configurable form). Compare output fidelity with the package in the same week.| Failure | Impact | Mitigation |
|---|---|---|
| Malicious/malformed YAML or JSON | Arbitrary type instantiation, exception storms | Strict allowlist of field types and options; parse with safe flags; schema validation before use |
| Symfony upgrade breaks the bundle | Forms silently malformed or hard-fatal at render | Pin exact versions; integration tests over golden-file rendering |
| Bundle abandoned upstream | No security patches | Fork + vendor; add to dependency review queue |
| Unsupported field type in config | Runtime exception surfacing to end users | Fail at schema-load time, not render time; surface as a config validation error |
| Twig/Blade theme divergence (if Twig introduced) | Inconsistent UI, accessibility regressions | Avoid Twig entirely |
| No test coverage → regressions undetected | Silent behavioural drift | Own the test suite from day one; snapshot rendered HTML |
How can I help you explore Laravel packages today?