Weave Code
Feed Io Laravel Package
php-feed-io/feed-io
feed-io is a PHP library to read and write RSS, Atom, and JSONFeed feeds. It offers auto-discovery, PSR-7 responses with cache headers, PSR-18 HTTP client integration, a CLI, logging, and content filtering for only the newest items.
A PHP library to read and write feeds in JSONFeed, RSS or Atom format
Frequently asked questions about Feed Io
- How do I install php-feed-io/feed-io in Laravel?
- Run composer require php-feed-io/feed-io; v6 requires PHP 8.1 or newer. There is no Laravel service provider or facade, so register a singleton in your own AppServiceProvider that constructs FeedIo\FeedIo with a PSR-18 HTTP client and a PSR-3 logger. Laravel's logger satisfies PSR-3 and Guzzle 7 satisfies PSR-18, so the binding is only a few lines.
- Is feed-io a Laravel package or a framework-agnostic PHP library?
- It is framework-agnostic: no service provider, facade, config file or published config ships with it. Integration happens through constructor injection on the FeedIo\FeedIo class, which takes exactly an HTTP client adapter and a PSR-3 logger. That fits Laravel's container cleanly, but you own the wrapper, config array and domain interface. Alternatives to compare include alexdebril/feed-io, SimplePie and laminas-feed.
- Which PSR-18 HTTP client should I use with feed-io in Laravel?
- Any PSR-18 compatible client works; Guzzle 7 ships with Laravel and implements PSR-18. Wrap it in FeedIo\Adapter\Http\Client and inject that adapter into FeedIo\FeedIo. Be careful with the README, which still shows the deprecated FeedIo\Adapter\Guzzle\Client in places, so treat the adapter directory in src as authoritative. You can also use php-http/guzzle7-adapter if your setup expects it.
- How do I fetch only new feed items since the last poll with feed-io?
- Use getItemsSince() with a DateTimeInterface representing your last successful poll, and optionally a filter chain to limit content further. For network efficiency, persist the Last-Modified or ETag value and send conditional GET headers so unchanged feeds return 304. getNextUpdate() can drive poll scheduling, but you still need to persist per-feed state in your database or cache.
- Can feed-io generate a PSR-7 response with cache headers for my own feed?
- Yes; feed-io reads and writes RSS, Atom and JSONFeed, and can generate a PSR-7 response with computed cache headers. That makes it viable for serving your own syndication feed from a Laravel route or controller. You still own routing, authorization, ETag/If-None-Match handling and any custom cache-control policy.
- Is feed-io safe for user-submitted feed URLs, or does it create an SSRF risk?
- feed-io will not stop SSRF; any feature that lets users paste a URL turns your server into an outbound HTTP proxy. You need an allowlist or denylist, private-IP and link-local blocking, redirect-target re-validation, and infrastructure-level egress restrictions. Redirect handling with loop protection only landed in 6.2.0, so treat that surface as recently hardened rather than long-hardened.
- Does feed-io protect against XXE and malicious XML or JSON payloads?
- It parses attacker-controlled XML, so verify libxml external-entity handling explicitly instead of trusting defaults and disable external entity loading. Add a payload size cap before parsing, and remember that v6.3.0 fixed invalid JSON causing a TypeError, which shows hostile-input hardening is ongoing. Treat feed parsing as untrusted input and add your own validation around it.
- Do I need to sanitize feed HTML before rendering it in Blade?
- Yes; feed-io parses and re-emits feed content but does not sanitize HTML. Any title, description or content field rendered to users must pass through your own sanitizer such as HTMLPurifier or an equivalent allowlist-based cleaner. If an XSS ships, that is your application's defect, not the library's.
- Is php-feed-io/feed-io maintained and is it the canonical repository?
- Community validation is thin: about 23 stars and zero dependents for a package that parses untrusted third-party XML. It appears to be a continuation or fork of the long-standing alexdebril/feed-io, which has far more adoption. Before adopting, confirm which repository is canonical, who maintains it, its release cadence and whether it has a security disclosure process. Treat that as a blocking evaluation question, not a footnote.
- Does feed-io have global state that breaks in queue workers or Laravel Octane?
- Yes; getDateTimeBuilder()->setFeedTimezone() is process-wide mutable state. In queue workers, Octane or any long-lived process, failing to reset it can silently corrupt timestamps for every later feed parsed in that process. Wrap timezone changes in try/finally in your wrapper, or avoid changing the global timezone altogether.
Weaver
How can I help you explore Laravel packages today?