- How do I install rodneyrehm/plist in a Laravel project?
- Run composer require rodneyrehm/plist, then verify what the package name actually resolves to and confirm the source URL in composer.lock before using it. The library is pure PHP and does not register a Laravel service provider, facade, or config file. Wrap the vendor classes in an application-level adapter so controllers, jobs, and models never reference the package directly.
- Does rodneyrehm/plist work with Laravel 10, 11, and 12?
- It has no framework coupling, so Laravel version support depends mainly on PHP 8.2+ compatibility and the package's Composer platform constraints. It should slot into Laravel 10–12 behind your own adapter, but you must test the resolved codebase on PHP 8.2–8.4 for deprecations such as dynamic properties and implicit nullable parameters. Also check whether it defines global helper functions or constants that could collide in a Laravel app.
- Can the library read binary plist files as well as XML plists?
- Yes, the capability described is parsing and emitting both XML property lists and Apple binary plists in bplist00 form. That matters because XML-only tools such as SimpleXML or spatie/array-to-xml cannot read binary plists at all. Use it only where a workflow actually ingests binary data, such as Info.plist files from IPA bundles or macOS metadata.
- Is rodneyrehm/plist safe for parsing untrusted plist files?
- Do not assume safety from the catalog metadata; audit the exact resolved source tree. Check that XML parsing disables external entity loading and network access, for example with LIBXML_NONET and without LIBXML_NOENT. Also verify that binary parsing bounds nesting depth and element counts, and consider a fork if the upstream code does not meet those requirements.
- What Laravel use cases actually require a plist parser?
- Typical cases include iOS enterprise distribution manifest.plist files, .mobileconfig MDM profiles, Info.plist extraction from uploaded IPA or app bundles, and macOS or iOS backup metadata. If none of your Laravel workflows ingest plist payloads, the package is dead weight. Answer that workflow question before writing any adapter code.
- Does rodneyrehm/plist round-trip Date, Data, UID, and float values correctly?
- That is not established by the metadata, so treat it as a verification task. Apple plists include tricky types such as Date, Data blobs, UID or CF$UID values, and floats that can coerce unexpectedly through PHP arrays. Build a fixture corpus from real artifacts and assert parse, serialize, parse round trips to catch regressions that synthetic arrays will miss.
- Why is the Composer name rodneyrehm/plist different from the GitHub repository moodlehq/CFPropertyList?
- The package name and linked repository point at two different codebases: rodneyrehm/plist is an older XML and binary plist library, while moodlehq/CFPropertyList is a Moodle fork of a CFPropertyList port. This provenance mismatch is a serious flag. Resolve what composer require rodneyrehm/plist actually installs, confirm the source URL in composer.lock, and audit that specific tree rather than trusting catalog metadata.
- How should I integrate rodneyrehm/plist cleanly in Laravel?
- Create a PlistCodec contract in app/Support/Plist with parse(string): array and serialize(array, Format): string methods, then implement it with a thin wrapper around the vendor classes. Bind the implementation in AppServiceProvider and keep the vendor namespace out of controllers, jobs, and models. This roughly 20-line adapter confines the dependency and makes swapping to a fork or in-house reader a one-file change.
- What are the alternatives to rodneyrehm/plist for binary plists in PHP?
- SimpleXML and spatie/array-to-xml handle XML plists only, so they cannot replace this package for binary bplist00 data. Other CFPropertyList ports and a hand-rolled bplist reader are the main alternatives, and each carries its own maintenance and security tradeoffs. If you already use SimpleXML for XML plists, keep it and adopt this only for the binary path to limit blast radius.
- Is rodneyrehm/plist production-ready and actively maintained?
- Adoption is very thin, with only a handful of stars and effectively no dependents, so community vetting is minimal. A February 2025 release is reassuring but does not establish a maintenance cadence, and the upstream lineage has gone quiet before. Ask whether the maintainer responds to security issues and whether you can fork under your organization if not; gate rollout behind a Pennant feature flag per workflow.