- What is ocramius/package-versions used for in Laravel?
- It is a Composer utility that lets you read installed dependency versions at runtime without file I/O, using PackageVersions\Versions::getVersion. In Laravel it is best limited to narrow diagnostic uses such as health endpoints, release tagging, cache-key derivation, and audit tooling. It is not a Laravel package and has no service provider, facade, config, or framework coupling. Avoid putting it into domain or business logic.
- How do I install ocramius/package-versions in a Laravel application?
- Run composer require ocramius/package-versions; no Laravel registration step is needed because the package exposes a static API. The README recommends enabling optimize-autoloader or running composer dump-autoload --optimize to avoid autoload I/O. In Laravel deployments, verify that your CI and production build scripts actually use optimized autoloading. Also check whether the package is already present transitively before adding it directly.
- Is ocramius/package-versions compatible with Laravel 10, 11, and 12?
- Technically it is compatible with Laravel 10, 11, and 12 on PHP 8.x with Composer 2, because it is a framework-agnostic Composer library. However, it is not idiomatic Laravel integration and provides no Laravel-specific features. For modern stacks, Composer 2's native Composer\InstalledVersions API usually removes the need for this dependency. Treat it as a legacy convenience rather than a strategic capability.
- How does PackageVersions\Versions::getVersion work without runtime file I/O?
- Version data is compiled from composer.lock during composer install or composer update, so calling getVersion does not need to read files at runtime. The README recommends an optimized Composer autoloader to keep autoload I/O out of the lookup. The returned value is typically in version@reference format, for example 1.0.0@sha. Consumers must decide whether they need the pretty version, the reference, or both.
- Should I use ocramius/package-versions or Composer\InstalledVersions in Laravel?
- If Composer 2 is guaranteed across local, CI, and production, prefer Composer\InstalledVersions directly because it provides installed package versions at runtime without an extra dependency. ocramius/package-versions is functionally superseded and mainly useful for legacy code or existing transitive usage. If you keep it, wrap it behind a small adapter so you can switch to InstalledVersions later without changing callers. Do not inject package versions into cached Laravel configuration.
- Why does getVersion return version@reference and how should I parse it?
- The package returns a combined string that usually contains a pretty version and a commit reference, such as 1.0.0@0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33. Your application must define whether it needs the version, the reference, or both, and parse consistently. Centralize parsing in an adapter or helper rather than doing ad hoc string splitting in controllers, jobs, and Blade templates. Plan for format changes and handle malformed or missing values explicitly.
- Does ocramius/package-versions work with Laravel Octane and optimized autoloaders?
- It is compatible with Laravel Octane because the package is designed for no runtime file I/O, but workers must be restarted after deployments so cached version data is not stale. The README recommends optimize-autoloader or composer dump-autoload --optimize, and Laravel deployments commonly already use optimized autoloading. Verify your build pipeline does not use --no-scripts or read-only vendor constraints that break install-time generation. Also confirm that CI artifacts contain the matching composer.lock data.
- What happens if a package is missing or composer.lock changes after deployment?
- getVersion can throw an exception when the requested package is not present, so consumers should handle missing-package cases consistently. Version data is derived from composer.lock and install-time generation, so if vendor directories are built in CI and promoted as artifacts, reported versions must match that artifact's lock file, not the runtime repository state. Avoid relying on post-deployment lock changes without reinstalling or regenerating autoload data. Centralized error handling makes diagnostics and health endpoints safer.
- Is ocramius/package-versions still maintained and safe for production?
- The package is MIT-licensed and has a history of use, but it is a legacy convenience now that Composer 2 offers native runtime metadata. Version 2 changed the project from a Composer plugin to a library and removed PackageVersions\Versions::ROOT_PACKAGE_NAME, so legacy code using older constants or generated-class assumptions needs review. The supplied metadata reports 0 dependents despite many stars, which should be validated against Packagist before treating it as an ecosystem standard. Define support expectations, ownership, and whether Tidelift coverage matters for your organization.
- Can I use ocramius/package-versions in tests or should I mock package versions?
- You can call it in tests, but because it returns real installed versions it is usually better to mock or adapt version lookup at the boundary of your application. Wrap the static API in a service or helper so tests can return controlled version strings and missing-package exceptions. This also lets you replace the package with Composer\InstalledVersions later without touching test doubles. Avoid asserting exact commit references unless the test environment is pinned to a known lock file.