Weave Code
Composer Plugin Laravel Package
phar-io/composer-plugin
Archived proof-of-concept Composer plugin that adds phive:run and phive:info commands to integrate Phive with Composer (e.g., install phar tools like PHPUnit). Unsupported, likely insecure, and may not work with current Composer—do not use in production.
At a glance
Frequently asked questions about Composer Plugin
- Is phar-io/composer-plugin safe to use in Laravel 10+ projects?
- No, this package is archived, unsupported, and likely incompatible with Laravel 10+ (PHP 8.1+). It may introduce security risks due to unmaintained PHAR handling and deprecated Composer plugin APIs. Avoid using it in production.
- Can I use this plugin to install PHPUnit as a PHAR in a Laravel project?
- Technically, the `phive:run` command could install PHPUnit as a PHAR, but it’s not recommended. Modern Laravel projects rely on Composer’s native autoloading, and PHPUnit now provides stable Composer packages (e.g., `phpunit/phpunit`). PHARs add unnecessary complexity.
- Will this plugin work with Composer 2.x and Laravel’s autoloading?
- Unlikely. The plugin targets older Composer versions (pre-2.x) and may conflict with Laravel’s `composer dump-autoload` or `optimize` commands. PHARs in `vendor/` can disrupt Laravel’s class loading, leading to runtime errors.
- Are there modern alternatives for PHAR-based CLI tools in Laravel?
- Yes. Instead of this plugin, use Composer’s native `bin-dir` in `composer.json` to install CLI tools (e.g., `phpunit/phpunit`) or leverage Docker containers for self-contained environments. For custom PHARs, consider `box/spout` or `phar.io/manifest` for generation.
- How do I check if my Laravel project depends on PHARs via this plugin?
- Run `composer show --installed` to list dependencies. If PHARs appear in `vendor/`, they’re likely installed via this plugin or manually. Audit `composer.json` for `extra.installer-paths` or custom scripts referencing `phive:run`.
- Can I fork or maintain this plugin for Laravel 10+ compatibility?
- Yes, but it’s not trivial. You’d need to update the Composer plugin API calls, test PHP 8.1+ compatibility, and address PHAR security risks (e.g., deserialization). Modern Laravel projects should avoid PHARs unless absolutely necessary for legacy tooling.
- Does this plugin interfere with Laravel’s `optimize` or `dump-autoload` commands?
- Yes, it could. PHARs in `vendor/` may conflict with Laravel’s autoloader optimizations, causing missing class errors. The plugin’s `post-install-cmd` hooks might also clash with Laravel’s own Composer scripts, requiring manual configuration.
- What are the security risks of using this plugin in production?
- Major risks include unpatched PHAR deserialization vulnerabilities, outdated cryptographic functions, and Composer plugin API exploits. Since the package is abandoned, no security updates are provided. Modern Laravel projects should avoid unmaintained dependencies entirely.
- How do I migrate from this plugin to a modern PHAR solution?
- Replace `phive:run` with Composer’s native `require` for CLI tools (e.g., `composer require phpunit/phpunit`). For custom PHARs, use `box/spout` for generation and store them in `storage/app/phars/` with custom Laravel service providers. Avoid `vendor/` for PHARs.
- Are there Laravel-specific use cases where this plugin might still be relevant?
- Only for legacy systems relying on PHAR-based tools (e.g., old PHPUnit versions) or custom vendor binaries. Even then, modern Laravel prefers Composer-managed executables or Docker. The plugin’s lack of maintenance makes it a poor choice for new or critical projects.
Weaver
How can I help you explore Laravel packages today?