PHPackages gumslone/laravel-package-url - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. gumslone/laravel-package-url ActiveLibrary[Security](/categories/security) gumslone/laravel-package-url ============================ Package URL (purl) for Laravel — parse, build, normalize and validate purls per the spec, plus registry/repository/download URL resolution, ecosystem mapping, and CPE-friendly helpers. v1.0.0(yesterday)01↑2900%MITPHP ^8.2 Since Jul 19Compare [ Source](https://github.com/gumslone/laravel-package-url)[ Packagist](https://packagist.org/packages/gumslone/laravel-package-url)[ Docs](https://github.com/gumslone/laravel-package-url)[ RSS](/packages/gumslone-laravel-package-url/feed)WikiDiscussions Synced today READMEChangelog (1)Dependencies (3)Versions (2)Used By (0) laravel-package-url =================== [](#laravel-package-url) [![tests](https://github.com/gumslone/laravel-package-url/actions/workflows/tests.yml/badge.svg)](https://github.com/gumslone/laravel-package-url/actions/workflows/tests.yml)[![License: MIT](https://camo.githubusercontent.com/fdf2982b9f5d7489dcf44570e714e3a15fce6253e0cc6b5aa61a075aac2ff71b/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d79656c6c6f772e737667)](LICENSE)[![Donate](https://camo.githubusercontent.com/604e3db9c8751116b3f765aad0353ec7ded655bbe8aaacbc38d8c4a6b784b3ed/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f446f6e6174652d50617950616c2d677265656e2e737667)](https://www.paypal.com/donate/?hosted_button_id=VCWHQPACTXV5N) [Package URL (purl)](https://github.com/package-url/purl-spec) for Laravel — parse, build, normalize and validate purls, **plus** registry / repository / download URL resolution, vulnerability-database ecosystem mapping, and reverse-parsing from VCS URLs. The core is a faithful, dependency-light implementation of the purl spec that passes the **entire official `package-url/purl-spec` conformance suite** (base spec + all 40+ type definitions) — the same suite [packageurl-php](https://github.com/package-url/packageurl-php) and [packageurl-python](https://github.com/package-url/packageurl-python) test against — and then goes further with the helpers you actually need in an app. Installation ------------ [](#installation) ``` composer require gumslone/laravel-package-url ``` The service provider and `Purl` facade are auto-discovered. Core: parse, build, normalize, validate --------------------------------------- [](#core-parse-build-normalize-validate) ``` use Gumslone\PackageUrl\PackageUrl; $purl = PackageUrl::fromString('pkg:composer/laravel/framework@11.55.0'); $purl->type; // "composer" $purl->namespace; // "laravel" $purl->name; // "framework" $purl->version; // "11.55.0" $purl->qualifiers; // [] $purl->subpath; // null (string) $purl; // "pkg:composer/laravel/framework@11.55.0" $purl->toArray(); // ['type' => 'composer', 'namespace' => 'laravel', ...] // Build from components (with normalization + validation) PackageUrl::fromArray([ 'type' => 'PYPI', 'name' => 'Django_package', 'version' => '1.11.1', ])->toString(); // "pkg:pypi/django-package@1.11.1" (type + name normalized) // Immutable withers (each returns a new normalized PackageUrl) $purl->withVersion('12.0.0'); $purl->withNamespace('symfony')->withName('console'); $purl->withType('composer'); $purl->withSubpath('src/Console'); $purl->withQualifier('repository_url', 'https://example.org'); // '' removes it $purl->withoutQualifier('repository_url'); $purl->withoutVersion(); // Read $purl->qualifier('repository_url'); // ?string $purl->equals('pkg:composer/laravel/framework@11.55.0'); // true // Type checks $purl->isType('composer'); // true (case-insensitive) $purl->isGeneric(); // false ``` Normalization follows the spec: the type is lowercased, qualifier keys are lowercased/sorted with empty values dropped, subpaths are cleaned, and type-specific rules apply (e.g. `pypi` lowercases the name and turns `_` into `-`; `github`/`bitbucket`/`golang` lowercase namespace and name). Invalid purls throw `PackageUrlException` — including per-type rules such as `swift`requiring a namespace, `vcpkg`/`otp` forbidding one, and `chrome-extension`id/version formats. Extended: the `Purl` facade --------------------------- [](#extended-the-purl-facade) ``` use Purl; Purl::isValid('pkg:npm/left-pad@1.3.0'); // true Purl::parse('pkg:npm/left-pad@1.3.0'); // PackageUrl Purl::parseMany([...]); // Collection, invalid skipped // Find every purl embedded in a block of text (SBOM, manifest, log, changelog) Purl::extractAll($text); // Collection, de-duplicated ``` ### Checks [](#checks) Non-throwing booleans to guard a conversion before you attempt it: ``` // Type Purl::isType('pkg:cargo/serde@1.0', 'cargo'); // true Purl::isGeneric('pkg:generic/tool@1.0'); // true // Can this purl produce a URL? Purl::hasRepositoryUrl('pkg:composer/laravel/framework@11.0'); // true Purl::hasDownloadUrl('pkg:npm/left-pad@1.3.0'); // true Purl::hasDownloadUrl('pkg:npm/left-pad'); // false (no version) Purl::hasRegistryApiUrl('pkg:cargo/serde@1.0'); // true Purl::isConvertibleToUrl('pkg:npm/left-pad'); // true (any of the above) // Can this URL be turned into a purl? Purl::isConvertibleDownloadUrl('https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz'); // true Purl::isConvertibleUrl('git@github.com:laravel/framework.git'); // true (also accepts repo/SSH URLs) ``` ### Registry, repository & download URLs [](#registry-repository--download-urls) ``` Purl::repositoryUrl('pkg:composer/laravel/framework@11.55.0'); // https://packagist.org/packages/laravel/framework Purl::repositoryUrl('pkg:pypi/django@5.0'); // https://pypi.org/project/django/5.0/ Purl::registryApiUrl('pkg:npm/left-pad@1.3.0'); // https://registry.npmjs.org/left-pad Purl::downloadUrl('pkg:npm/@babel/core@7.0.0'); // https://registry.npmjs.org/@babel/core/-/core-7.0.0.tgz Purl::downloadUrl('pkg:maven/org.apache.commons/commons-lang3@3.14.0'); // https://repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar ``` Coverage matches (and extends) packageurl-python's `purl2url`: - **repositoryUrl** — cargo, bitbucket, github, gitlab, gem, cran, npm, pypi, composer, nuget, hackage, golang, cocoapods, maven (+ hex, pub, conda). - **downloadUrl** — cargo, gem, npm, maven, hackage, nuget, github, gitlab, bitbucket, hex, golang, pub, swift, luarocks, conda, alpm, deb, apk. A `download_url` qualifier always takes precedence. Distro artifact URLs (deb/apk/alpm/conda) read the relevant qualifiers (arch, repo, channel, …). ### Vulnerability-database ecosystem mapping [](#vulnerability-database-ecosystem-mapping) ``` Purl::osvEcosystem('pkg:pypi/django@5.0'); // "PyPI" (OSV.dev) Purl::osvEcosystem('pkg:composer/laravel/framework@11.0'); // "Packagist" Purl::githubEcosystem('pkg:npm/left-pad@1.3.0'); // "NPM" (GitHub Advisories) ``` ### Reverse-parse from a URL [](#reverse-parse-from-a-url) From a VCS repository URL: ``` Purl::fromRepositoryUrl('https://github.com/laravel/framework'); // pkg:github/laravel/framework Purl::fromRepositoryUrl('git@github.com:laravel/framework.git'); // pkg:github/laravel/framework Purl::fromRepositoryUrl('https://github.com/laravel/framework/tree/v11.0.0'); // pkg:github/laravel/framework@v11.0.0 ``` From a **download / registry URL** — the inverse of `downloadUrl()`: ``` Purl::fromDownloadUrl('https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz'); // pkg:npm/left-pad@1.3.0 Purl::fromDownloadUrl('https://files.pythonhosted.org/packages/ab/cd/Django-5.0-py3-none-any.whl'); // pkg:pypi/django@5.0 Purl::fromDownloadUrl('https://repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar'); // pkg:maven/org.apache.commons/commons-lang3@3.14.0 Purl::fromDownloadUrl('https://github.com/laravel/framework/archive/refs/tags/v11.0.0.tar.gz'); // pkg:github/laravel/framework@v11.0.0 // Try both, whichever matches Purl::fromUrl($anyPackageOrRepoUrl); ``` Recognition covers (and extends) packageurl-python's `url2purl`: npm (incl. yarnpkg mirrors), PyPI (CDN files, `/packages/source`, project/JSON API), RubyGems, crates.io, NuGet, Maven, Go (proxy + pkg.go.dev), Hex, Composer/Packagist, pub.dev, CocoaPods, Hackage, LuaRocks, CRAN, SourceForge and Google Code archives (→ `pkg:generic`), and the full GitHub / GitLab / Bitbucket surface — web, REST API (`api.github.com/repos`), `codeload.github.com`, archive/release/download, and `raw`/`blob`/`tree`/ `commit` refs. Returns `null` for anything unrecognised. Pairs well with --------------- [](#pairs-well-with) - [`gumslone/laravel-purl2cpe`](https://github.com/gumslone/laravel-purl2cpe) — resolve a purl to its NVD CPE (vendor/product) from the curated scanoss/purl2cpe database. Testing ------- [](#testing) ``` composer install composer test ``` The suite runs the bundled official conformance data under `tests/data`. Credits ------- [](#credits) - The purl specification and conformance suite: [package-url/purl-spec](https://github.com/package-url/purl-spec) (MIT). Support ------- [](#support) If this package saves you time, consider supporting its development: [![Buy Me A Coffee](https://camo.githubusercontent.com/9a769e616ce78645bf51d12e4179cfbfd72fb413722b284e0be3ec3c75a86010/68747470733a2f2f63646e2e6275796d6561636f666665652e636f6d2f627574746f6e732f64656661756c742d6f72616e67652e706e67)](https://www.buymeacoffee.com/gumslone) [![Donate](https://camo.githubusercontent.com/604e3db9c8751116b3f765aad0353ec7ded655bbe8aaacbc38d8c4a6b784b3ed/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f446f6e6174652d50617950616c2d677265656e2e737667)](https://www.paypal.com/donate/?hosted_button_id=VCWHQPACTXV5N) License ------- [](#license) MIT. See [LICENSE](LICENSE). Bundled test fixtures are from package-url/purl-spec, also MIT. ### Health Score 39 — LowBetter than 84% of packages Maintenance100 Actively maintained with recent releases Popularity2 Limited adoption so far Community2 Small or concentrated contributor base Maturity45 Maturing project, gaining track record How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Unknown Total 1 Last Release 1d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/cbf66e5a37b00c7f888416f653500c1fb0bce16ed74d451405128fa5ad244c89?d=identicon)[gumslone](/maintainers/gumslone) --- Tags laravelsecurityregistryecosystempackage-urlpurlSBOMpackageurlcpe ### Code Quality TestsPest ### Embed Badge ![Health badge](/badges/gumslone-laravel-package-url/health.svg) ``` [![Health](https://phpackages.com/badges/gumslone-laravel-package-url/health.svg)](https://phpackages.com/packages/gumslone-laravel-package-url) ``` ### Alternatives [spatie/laravel-csp Add CSP headers to the responses of a Laravel app 86611.1M25](/packages/spatie-laravel-csp)[dgtlss/warden A Laravel package that proactively monitors your dependencies for security vulnerabilities by running automated composer audits and sending notifications via webhooks and email 9062.1k](/packages/dgtlss-warden)[laravel-chronicle/core Tamper-evident audit ledger for Laravel applications. 1213.7k6](/packages/laravel-chronicle-core)[mazedlx/laravel-feature-policy Add Feature-Policy headers to the responses of a Laravel app 17200.7k](/packages/mazedlx-laravel-feature-policy) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)