Weave Code
Plugins Bundle Laravel Package
sylius/plugins-bundle
A Sylius bundle for organizing and managing plugins in your e-commerce application. It provides a structured approach to registering plugins and integrating extensions, helping keep customizations maintainable as your Sylius store grows.
Installable plugins bundle for Symfony2 applications.
Frequently asked questions about Plugins Bundle
- Can I install sylius/plugins-bundle in a Laravel application?
- No. sylius/plugins-bundle is a Symfony2 bundle that registers itself through AppKernel and loads services via Symfony's YAML/XML container compilation. Laravel has no bundle concept, no AppKernel, and no bundle registry, so there is no path where this package is installed into a Laravel app. Composer resolution will also fail on the PHP constraints before any runtime concern appears.
- Does sylius/plugins-bundle support Laravel 10 or 11?
- It does not support any version of Laravel. The package targets Symfony2, which reached end of life in 2018, and its PHP constraints are 5.x/7.0-era. A modern Laravel application on PHP 8.2+ will hit a hard Composer conflict rather than a soft warning.
- Why doesn't sylius/plugins-bundle work with Laravel service providers?
- Laravel's extension model relies on Composer package auto-discovery via extra.laravel.providers, service providers, and PHP config files. This bundle instead depends on symfony/framework-bundle and symfony/http-kernel and registers through Symfony's bundle registry and compiler passes. The two extension models are structurally incompatible, so there is no adapter or shim that bridges them.
- Is sylius/plugins-bundle still maintained?
- No. The repository is archived with no releases, no issue triage, and no security response process. Archived Composer packages remain installable, which means the realistic risk is not choosing it deliberately but having a legacy dependency drag it into your lockfile. Once there, it is permanently unpatched.
- What PHP version does sylius/plugins-bundle require?
- The package's constraints are PHP 5.x through 7.0-era, matching its Symfony2 runtime. That conflicts directly with the PHP 8.2+ floor of current Laravel releases. Expect Composer to stop resolution rather than install it alongside a modern stack.
- What can Laravel developers learn from sylius/plugins-bundle?
- Its transferable value is design prior art, not code: the plugin manifest schema, discovery conventions, and the installed, enabled, disabled, and update-available lifecycle states. You can treat the repository as read-only reference documentation and write a short internal spec from it. You then reimplement that contract natively in a small package you own and can patch.
- How do I build a plugin system in Laravel instead of using this bundle?
- Reimplement the ideas natively: Composer-based discovery, a plugins table for state, a PluginServiceProvider, and Laravel's own package auto-discovery for registration. That is days of work and produces something your team owns and can patch. First decide whether the real requirement is third parties extending your product, which justifies a plugin abstraction, or your own team toggling modules, which is a feature-flag and configuration problem needing no plugin framework.
- What are the alternatives to sylius/plugins-bundle for Laravel?
- Look for Laravel-native modular packages that provide Composer auto-discovery, provider registration, and enable/disable state with active maintenance. There are also Sylius-adjacent forks, but they carry the same Symfony coupling and do not help a Laravel codebase. Evaluate any candidate against your PHP floor and its security response process before adopting it.
- Is sylius/plugins-bundle safe to run in production?
- Technical risk is high and concentrated in the supply chain rather than code quality. Bundles of this class typically resolve plugins from a remote index; if that endpoint is dead the feature fails silently, and if it fetches and unpacks remote artifacts it becomes a code-execution boundary with nobody to triage CVEs. With no maintainer and no security process, that risk cannot be remediated by anything you do at the application layer.
- What should I do if sylius/plugins-bundle appears in my Composer lockfile as a transitive dependency?
- Treat it as a supply chain finding rather than a feature decision. Run composer why to identify what pulled it in, then plan to replace or remove that dependency, because the archived package will never receive a patch. Also confirm whether the bundled plugin resolution makes outbound network calls and to which host, since that determines your exposure.
Weaver
How can I help you explore Laravel packages today?