Weave Code
Yaml Laravel Package
symfony/yaml
The Symfony Yaml component parses YAML files into PHP arrays and dumps PHP data back to YAML, with support for inline syntax, custom flags, and clear parse exceptions. A lightweight, dependency-free way to handle configuration and fixtures.
Loads and dumps YAML files
Frequently asked questions about Yaml
- How do I install symfony/yaml in a Laravel application?
- Install it with Composer using composer require symfony/yaml. Laravel applications already ship with several Symfony components, so this adds a familiar, framework-agnostic parser without a service provider or published config. You can then call Symfony\Component\Yaml\Yaml::parseFile() or Yaml::parse() directly in your code.
- Is symfony/yaml compatible with Laravel 10 and 11?
- Yes. symfony/yaml is a plain PHP library rather than a Laravel-specific package, so compatibility depends mainly on your PHP version and Composer constraints. It is already present in many Laravel vendor trees through Symfony components such as console, finder, and var-dumper. There is no Laravel integration layer to configure.
- What is symfony/yaml used for in Laravel projects?
- Common uses include configuration management, data serialization for fixtures and seed files, queue payloads, and test fixtures. It is also useful when you need to load YAML-defined data into typed DTOs or config objects. The component provides both parsing and dumping through Yaml::parse() and Yaml::dump().
- How do I parse a YAML file with Symfony Yaml in Laravel?
- Use Yaml::parseFile($path) for a file or Yaml::parse($yamlString) for an in-memory string. Both return PHP arrays or scalars and throw parse exceptions for invalid YAML. In Laravel, you can wrap these calls in a small service or helper if you load YAML from package config or fixture directories.
- How do I disable PHP object unserialization in Symfony Yaml?
- Symfony Yaml supports disabling custom tag parsing through its flags-based path, and the v8.1.x patch releases keep that path intact. Add the bundled PHPStan rule by including vendor/symfony/yaml/PHPStan/UnsafeUnserialize.neon in phpstan.neon. These mitigations target the !php/object and !php/unserialized vector, but they do not change the parser's default behavior.
- Why did my YAML parse output change after upgrading symfony/yaml?
- Patch releases v8.1.2 through v8.1.8 fixed parser bugs around block scalars, tabs, explicit tags, and nested parser line offsets. Because these are silent correctness fixes, YAML that was previously mis-parsed can now parse differently or throw an exception. Review the intermediate changelogs and add golden-file tests before pinning if you rely on those constructs.
- How should I test YAML fixtures in Laravel with symfony/yaml?
- Parse fixtures with Yaml::parseFile() and assert on the resulting values, not just that parsing succeeds. Golden-file tests catch silent parse changes introduced by parser bug fixes. Also check any tests or alerts that assert on YAML exception messages or line numbers, since nested-parser offsets were corrected in v8.1.x.
- Does symfony/yaml support multiline strings and block scalars?
- Yes. It supports literal block scalars with | and folded block scalars with >. The v8.1.x patch releases fixed tab handling inside block scalars and comments following empty block scalars, and explicit !!str and !!float tags on block scalars now resolve correctly. YAML that previously produced silently wrong string content may now parse differently.
- What are alternatives to symfony/yaml for Laravel projects?
- For untrusted data, JSON is often the safer choice because PHP's native json_decode() does not support object-instantiation tags. Other YAML parsers exist, but symfony/yaml is the standard choice in Laravel because Symfony components are already in the vendor tree. It has minimal overhead and no published configuration.
- Is symfony/yaml safe for untrusted user input?
- Not by default. YAML's !php/object and !php/unserialized tags can be dangerous if you parse untrusted input, and the v8.1.x patch releases do not address that vector. Disable custom tag parsing, enable the PHPStan UnsafeUnserialize rule in CI, and whitelist trusted YAML sources. For truly untrusted data, prefer JSON instead of YAML.
Weaver
How can I help you explore Laravel packages today?