- What is samsonasik/package-versions used for in a Laravel application?
- It is a Composer plugin that generates a PackageVersions\Versions class at install or update time so you can look up installed dependency versions without runtime filesystem IO. In a Laravel app it is not a typical package: there is no service provider, config file, facade, or container binding. It is only useful for legacy stacks that need programmatic version lookups and cannot use Composer 2's built-in API.
- How do I install samsonasik/package-versions?
- Run composer require samsonasik/package-versions and then composer dump-autoload --optimize to avoid autoload IO when calling the API. On Composer 2.2+ you must also allow the plugin in config.allow-plugins, which is a security and governance decision. There is no Laravel service provider to register or publish.
- Does samsonasik/package-versions support Laravel 10 or 11 and PHP 8?
- No. The package is a PHP 5.6 backport with a last release in 2016 and is not tested against modern Laravel 9, 10, or 11, which require PHP 8.1+. On current Laravel applications you should use Composer\InstalledVersions, which ships with Composer 2 and needs no plugin. Treat this package as legacy-only.
- What is the difference between samsonasik/package-versions and Composer\InstalledVersions?
- samsonasik/package-versions generates a static class from composer.lock and predates Composer 2's native runtime API. Composer\InstalledVersions is built into Composer 2, requires no plugin allowlist, and provides getPrettyVersion(), getVersion(), and getReference(). For any Composer 2 project, the built-in class is the supported, safer choice.
- Why does Composer block this plugin, and how do I allow it?
- Composer 2.2 and later block plugins by default, so you must explicitly add the package to config.allow-plugins in composer.json. That is a deliberate security control, not a bug. Only allow it after confirming you actually need this legacy plugin and have an exit plan.
- Why do I get a PackageVersions\Versions class conflict with ocramius/package-versions?
- This package uses the same PackageVersions\Versions fully qualified class name as ocramius/package-versions, so having both in the dependency graph causes a collision. Check with composer why ocramius/package-versions before adopting. If the upstream package is present directly or transitively, do not install this backport.
- Does PackageVersions\Versions perform filesystem IO at runtime?
- No runtime IO is performed by the API because the version map is compiled into the generated class during composer install or update. However, the data reflects composer.lock at build time, so stale caches, partial deploys, or an outdated lock file can surface incorrect versions. Re-run composer install or dump-autoload as part of deployment.
- How do I retrieve full, short, and major package versions?
- Call PackageVersions\Versions::getVersion('vendor/package') for the version plus commit reference, getShortVersion() for the clean version, and getMajorVersion() for the major number. The package name must match the Composer package name exactly. Wrap these calls behind your own resolver if you adopt, so migration is easy.
- Is samsonasik/package-versions maintained and safe for production?
- It is effectively unmaintained: the last release was 2016-07-21, it has a single maintainer, and it is not certified for PHP 8. There is no active security patching or issue triage, so production use carries abandonment and compatibility risk. Use it only in a narrow legacy PHP 5.6 or 7.x environment where Composer 2 is unavailable, and document an exit plan.
- How do I migrate away from samsonasik/package-versions?
- Introduce a thin internal wrapper such as App\Support\PackageVersionResolver around the three static methods, then replace its implementation with Composer\InstalledVersions. Remove the samsonasik/package-versions dependency, delete its allow-plugins entry, and run composer update. Because the API surface is only three methods, the exit cost is small if you insulate call sites from the start.