Cors Bundle Laravel Package

Product Decisions This Supports

• Build vs. buy for API cross-origin access. CORS is a commodity capability, and this bundle (2 stars, 0 dependents, last release Feb 2023, quality score 0.21) is not a defensible "buy." The decision it informs is "buy nothing here — use the platform or write ~100 lines ourselves."
• Framework standardization. Critically, this is a Symfony bundle, not a Laravel package. For a Laravel roadmap it answers a question nobody asked: Laravel already ships HandleCors middleware and config/cors.php since v7. For Symfony tracks, it competes with nelmio/cors-bundle, the ecosystem default.
• Roadmap / opportunity signal. The high opportunity score (8.8) against a low quality score (0.21) is the real product insight: there is demand for maintained, framework-agnostic CORS middleware, but this repo doesn't satisfy it. That argues for an internal shared middleware package or an OSS contribution — not adoption of this dependency.
• Reference implementation for a feature spec. Useful to read to confirm expected header semantics before writing our own: Access-Control-Allow-Origin, -Methods, -Headers, -Credentials, -Max-Age, and Vary: Origin.
• Dependency-risk triage. Zero dependents and no release in ~2 years is a portfolio red flag for anything on a support, audit, or security-review path.

When to Consider This Package

Consider only if:

• You are on Symfony (legacy or otherwise) and want a deliberately minimal, single-responsibility bundle, and you have explicitly rejected nelmio/cors-bundle.
• You want a code-reading reference for how preflight OPTIONS and response headers should be emitted — as a spec, not a runtime dependency.

Look elsewhere when:

• You're on Laravel. Use the built-in HandleCors middleware and config/cors.php. No third-party package is justified. Confirm this before any ticket is filed — the repo is a Symfony bundle.
• You're on Symfony and want the maintained default. Use nelmio/cors-bundle; it has the adoption, docs, and release cadence this doesn't.
• You're on Slim, Laminas, or plain PSR-15. Use a PSR-15 CORS middleware instead of a Symfony-specific bundle.
• You need active maintenance, security patching, or credential-bearing + wildcard edge cases handled correctly at scale. Last release 2023-02-21, 0 dependents, 2 stars → fails the maintenance bar.
• You need per-route policy configuration beyond a small bundle's surface area.

How to Pitch It (Stakeholders)

Executive summary. CORS is a solved, commodity problem. This package is a small Symfony bundle with negligible adoption and no recent release. Recommendation: do not add it as a dependency. Our cost to own this capability is roughly a hundred lines of middleware plus a config file — cheaper than the security-review and upgrade burden of carrying a 2-star dependency.

For engineering. Treat the repo as a reference for header semantics, not a runtime dependency. If we implement in-house, ensure we: emit Vary: Origin, correctly short-circuit preflight OPTIONS, never combine wildcard origin with credentials, and make allowed origins config-driven per environment.

Platform note to flag early. The package is Symfony-specific. Our Laravel services should use the framework's built-in CORS middleware; our Symfony services should standardize on nelmio/cors-bundle. Either way, this package is out of scope.

If we want to act on the opportunity signal. The 8.8 opportunity score suggests real demand for a well-maintained, framework-agnostic CORS middleware. That's a candidate for a small internal shared package — or a low-cost OSS contribution that buys us ecosystem credibility — rather than a reason to adopt this repo.