Laravel Composer Laravel Package

Product Decisions This Supports

• Build vs. buy on installation tooling. The decision this package actually informs is whether to adopt a third-party Composer plugin for install-time behavior, versus using Composer's native event system plus composer/installers. On Composer 2, native coverage is broad enough that "buy" rarely wins here.
• Modular / monorepo Laravel architecture. If the roadmap calls for installing packages into non-vendor/ locations (e.g., app/Modules/*, custom plugins/), this repo is a reference implementation of plugin-driven install paths — but composer/installers + oomphinc/composer-installers-extender is the maintained route.
• Release-lifecycle automation. Per-package install/update/uninstall hooks map directly to Composer's native pre-package-install, post-package-install, pre-package-update, post-package-update, and post-package-uninstall events. This package is best used as evidence in a "do we actually need custom tooling?" decision, not as the tool itself.
• Supply-chain and CI hardening. Any Composer plugin executes code at build time. Evaluating this package forces an explicit decision on allow-plugins policy, lockfile pinning, and vendor trust — useful input to a security review even when the outcome is "don't adopt."
• Does not inform product roadmap or user-facing features. It is build-time devtooling with no runtime surface area; don't let it consume prioritization bandwidth beyond a one-time adopt/skip call.

When to Consider This Package

Consider it only if all of the following hold:

• You maintain a Rinvex-derived codebase that already depends on it transitively, and removal cost exceeds replacement cost.
• You need custom install paths for a defined set of packages and have confirmed installer-paths in composer/installers cannot express your layout.
• Your lifecycle hooks cannot be expressed with native Composer scripts — effectively a Composer 1 environment, which is EOL.
• You can accept an archived dependency and are prepared to vendor or fork it (MIT permits this).

Look elsewhere if:

• You need custom vendor paths → composer/installers (plus oomphinc/composer-installers-extender for exotic paths).
• You need post-install/update/uninstall scripts → native Composer scripts with post-install-cmd and the *-package-* events.
• You need to merge multiple composer.json files (a common modular-Laravel need) → wikimedia/composer-merge-plugin.
• You need maintained, security-reviewed build tooling → all of the above. This repo is archived, has ~11 stars, and no disclosed security process; at score 0.0875 it is a health signal, not a capability signal.

How to Pitch It (Stakeholders)

Executives. "This is a build-time developer tool, not a product feature — zero user-facing impact. Our recommendation is do not adopt. It is archived and low-adoption, and both of its core capabilities (installing packages outside vendor/, running scripts on install/update/uninstall) are already delivered by Composer itself and by composer/installers, both actively maintained. Adopting an unmaintained plugin that executes arbitrary code during our CI builds is a supply-chain risk with no offsetting benefit. The only action item is confirming we don't already pull it in transitively through a Rinvex package."

Engineering. "Rinvex Composer hooks the Composer Plugin API for two things: custom install destinations and per-package lifecycle scripts. Composer 2 covers the second natively via the pre-/post-package-install|update|uninstall events; the first is covered by composer/installers with installer-paths. The package is archived, so there are no Composer 2.x plugin-API guarantees and no security response path, and from Composer 2.2 onward it must be explicitly allow-listed via allow-plugins — which we should not do for unmaintained code. Replacement cost is low; the cost of keeping it is a permanent audit exception. If we have a genuine modular-install requirement, spike composer/installers + installer-paths first and only consider forking Rinvex if we hit a concrete gap."