- Is rz/user-bundle a Laravel package or a Symfony bundle?
- Despite often being labelled as a Laravel/PHP package, rz/user-bundle is a Symfony bundle derived from FOSUserBundle. It relies on Symfony's dependency injection container, Doctrine persistence, and Symfony's security firewall and auth guard model, none of which exist in Laravel. If your target stack is Laravel, the evaluation stops there because the underlying primitives are wrong.
- Can I install rz/user-bundle in a Laravel app with Composer?
- You can technically run composer require, but the package provides no Laravel service providers, no Eloquent models, and no Laravel auth guards, so nothing will wire up. There is no configuration path that makes a Symfony bundle behave like a native Laravel package. Use Laravel Breeze, Fortify, or Jetstream instead of attempting an adapter layer.
- Which Laravel versions does rz/user-bundle support?
- None. The package is a Symfony bundle and has no Laravel version compatibility matrix, so it targets no release of Laravel 8, 9, 10, 11, or 12. For any supported Laravel version, choose the framework-native auth starter kits or a maintained community package.
- How do I install and configure rz/user-bundle in a Symfony project?
- Installation follows the classic bundle pattern: add the requirement via Composer, register the bundle in config/bundles.php, then configure the user class, Doctrine mapping, and security firewall. Because the repository is archived, pin an exact version and expect friction across PHP major versions, Symfony majors, and Doctrine ORM. Treat the bundle as a schema and behaviour reference rather than a fresh dependency, and plan a clone-and-audit spike before committing.
- Is rz/user-bundle still maintained or archived?
- The repository is archived, with zero stars and no known dependents, which means there is no upstream patch stream and no community evidence of production use. Archived Composer packages only decay in compatibility, so every PHP or framework upgrade in your own stack widens the gap. Any adoption effectively becomes a private fork with a named internal owner and a funded maintenance line.
- Is rz/user-bundle safe to use for production authentication?
- It is high risk because the code touches the most security-critical surface in an application: password hashing, session handling, registration, password reset tokens, and role checks. With no CVE response path, unknown version compatibility, and no trustworthy test coverage, unpatched auth code becomes a standing liability. Signing off on it requires an explicit security owner and an ongoing maintenance budget, which most teams should not accept.
- What should I use instead of rz/user-bundle for Laravel authentication?
- Use Laravel's first-party options: Breeze for a simple scaffold, Fortify for a headless backend, or Jetstream for a fuller starter kit, paired with a maintained permissions package such as spatie/laravel-permission. On Symfony, use the native Security component and a supported user provider instead of a legacy bundle. Both routes are patched upstream and come with documentation and active community support.
- Does rz/user-bundle handle roles, permissions, and profile management?
- Yes, the bundle advertises role and permission support plus extensible user entities and profile update flows, so it can act as a useful behavioural reference. The catch is that you would own all of that code and its security patching indefinitely once you fork it. For narrower concerns such as roles or password reset, a maintained package is almost always the cheaper option.
- How do I migrate an existing application off rz/user-bundle?
- Frame the work as technical-debt remediation rather than a feature investment, because the defensible path is migration off the bundle, not onto it. Use the existing schema and user flows as a behavioural reference, then rebuild on framework-native auth: Breeze, Fortify, or Jetstream on Laravel, or the native Security component on Symfony. Sequence the work around password hashing compatibility and reset-token handling so existing users are not locked out.
- How do I test rz/user-bundle and which PHP and Symfony versions does it support?
- Compatibility is unknown and unverifiable without a clone-and-audit spike, and the archived state means there is no maintained CI or test suite to rely on. Expect friction across PHP versions, Symfony majors, Doctrine ORM, and modern password-hashing defaults. If you must proceed, write your own integration tests around registration, login, password reset, and role checks before touching production data.