c975l / core-bundle

v1.51.0 2026-10-02 17:02 UTC

Requires

• php: >=8.4
• doctrine/orm: ^3.7
• dompdf/dompdf: ^3.1
• dragonmantank/cron-expression: ^3.6
• easycorp/easyadmin-bundle: ^5.1
• egulias/email-validator: ^4.0
• endroid/qr-code: ^6.1
• imagine/imagine: ^1.5
• nelmio/security-bundle: ^3.9
• psr/log: ^3.0
• sensiolabs/minify-bundle: ^1.2
• symfony/asset-mapper: ^8.0
• symfony/clock: ^8.0
• symfony/console: ^8.0
• symfony/expression-language: ^8.0
• symfony/filesystem: ^8.0
• symfony/finder: ^8.0
• symfony/form: ^8.0
• symfony/http-client: ^8.0
• symfony/intl: ^8.0
• symfony/mailer: ^8.0
• symfony/messenger: ^8.0
• symfony/password-hasher: ^8.0
• symfony/process: ^8.0
• symfony/rate-limiter: ^8.1
• symfony/scheduler: ^8.0
• symfony/security-bundle: ^8.0
• symfony/serializer: ^8.0
• symfony/twig-bundle: ^8.0
• symfony/ux-chartjs: ^3.3
• symfony/ux-twig-component: ^3.4
• symfony/validator: ^8.0
• symfony/yaml: ^8.0
• symfonycasts/reset-password-bundle: ^1.25
• symfonycasts/verify-email-bundle: ^1.18
• twig/cache-extra: ^3.28
• twig/extra-bundle: ^3.29
• twig/intl-extra: ^3.26
• twig/twig: ^3.21
• vich/uploader-bundle: ^3.0

Requires (Dev)

• chrome-php/chrome: ^1.16
• doctrine/doctrine-fixtures-bundle: ^4.3
• phpstan/phpstan: ^2.2
• phpstan/phpstan-deprecation-rules: ^2.0
• phpunit/phpunit: ^13.2
• symfony/browser-kit: ^8.0
• symfony/css-selector: ^8.0
• symfony/maker-bundle: ^1.67
• symfony/phpunit-bridge: ^8.0
• symfony/var-dumper: ^8.0

Suggests

• ext-exif: To straighten an uploaded photo on its own EXIF orientation tag: without it GD stores the pixels as they were shot, so a photo taken upright is served on its side (see VichImageResizeListener).
• ext-imagick: To upload an SVG as favicon or apple-touch-icon: GD has no SVG decoder, so without it those two roles only accept raster images (see SvgRasterizer).
• c975l/social-bundle: Adds the share buttons band to layout.html.twig, which includes @c975LSocial/shareButtons/default.html.twig with ignore_missing, plus the social links blocks.
• chrome-php/chrome: To run "c975l:ui:layout-audit", which measures a rendered page against the layout invariants the sass tests cannot check. Install it in the consuming site, not here: the command runs from that site's console.

Replaces

• c975l/config-bundle: 6.0.0
• c975l/ui-bundle: 1.18.0

MIT

• Laurent Marquet
• 975L Community

• symfony
• ui
• bundle
• config

Published on Packagist.org on 2026-10-02 17:02 UTC

README

The base of the c975L ecosystem in a single package: ConfigBundle (database-backed configuration, EasyAdmin dashboard, user accounts, health check, sitemaps) and UiBundle (page blocks, media library, theme, legal models, forms, emails). Two bundles, one package, one release.

Bundle page · Tutorials · Block kinds · Live demo · Demo back-office

One package, two bundles

This is not a merged bundle. A Composer package is not a Symfony bundle: this package ships the two bundles unchanged, each with its own namespace, its own services.yaml, its own configs.json, its own translation domain and its own dashboard section.

CoreBundle/
├── composer.json      ← the only one
├── ConfigBundle/      → c975L\ConfigBundle\
└── UiBundle/          → c975L\UiBundle\

There is no c975L\CoreBundle\ namespace. The name core-bundle exists on Packagist only.

Why they ship together

ConfigBundle and UiBundle referenced each other in their composer.json, in both directions:

• Ui → Config is deep and deliberate: ConfigServiceInterface is read everywhere, and every *ProviderInterface of the generic registry mechanism is declared in ConfigBundle.
• Config → Ui comes from the dashboard itself (FontRegistry, FormThemeRegistry, StylesheetManagementRegistry, ScriptAdminRegistry, WhatsNewRegistry) and from user accounts (Form/FormField + EmailService).

Two packages that require each other cannot be released independently, and neither can see the other's work-in-progress — only its last published version. They were never two layers; they were one layer billed as two. This package says so out loud.

Installation

composer require c975l/core-bundle

Then register both bundles — they remain two entries:

// config/bundles.php
return [
    // ...
    c975L\ConfigBundle\c975LConfigBundle::class => ['all' => true],
    c975L\UiBundle\c975LUiBundle::class => ['all' => true],
];

What the blocks look like

One tile per kind of the 32 UiBundle ships, captured on the showcase at bundles.975l.com, where every one of them is rendered live. A page is composed out of them in the back-office, with no template written for it - see Built-in block kinds for what each one takes.

Documentation

Each bundle keeps its own README, unchanged:

• ConfigBundle
• UiBundle

Each also ships skills under its own skills/ directory, written for the coding agent of the site installing the package rather than for someone modifying it — four in ConfigBundle, five in UiBundle, linked into an application's .claude/skills/ by c975l:skills:install. See ConfigBundle and UiBundle.

Its history, on the other hand, is the package's: ChangeLog.md and UPGRADE.md carry both bundles from here on. Each bundle's own files stop at its last published release — v5.17.1 for ConfigBundle, v1.17.0 for UiBundle — and are kept as archives.

Quality checks

The nine checks the CI runs live in composer.json alone, as one list:

composer qa

composer run -l names what each one covers, and each is callable on its own (composer audit-deps, cs, fixer, stan, stan-scaffold, rector, lizard, test). The workflow calls those same scripts, so a check is never declared twice.

audit-deps is composer audit: it matches the resolved dependencies against the Packagist security advisories, which is where a known CVE in a dependency gets caught — before the push, not once a site has deployed it. Abandoned packages are reported without failing the run.

rector runs --dry-run, so it reports rather than rewrites, over the same sets SymfonyMigrate.sh gives a site. It covers scaffold/ next to each bundle's own code: what is left unmodernised here gets rewritten in the application, where the rewritten file no longer matches the hash ScaffoldInstaller recorded, and the site is then told forever it customized a file it never touched.

A development machine's vendor/ symlinks the sibling repositories, which expose code no tag has published yet — code the CI never sees. bin/ci.sh replays composer qa on a copy of the repository whose dependencies are resolved from Packagist, uncommitted changes included:

bin/ci.sh

The quality tools themselves are not dependencies of the bundle — PHPStan aside, which require-dev carries for its deprecation rules: the CI installs them with setup-php, which always takes the latest release, where a development machine keeps whatever it installed the day it installed it. bin/ci.sh installs them fresh too, and prints the six versions it ran with — Lizard excepted, pinned in both because its counting changed between releases and one release alone matches the thresholds Codacy reads — a rule removed upstream since is otherwise still enforced here, and a rule added since is missed.

Migrating from c975l/config-bundle / c975l/ui-bundle

See UPGRADE.md. In short: replace the two requirements with c975l/core-bundle. No PHP use, no @c975LUi/… template reference, no translation key and no bundles.php entry changes — the namespaces are the same ones.

License

MIT — see LICENSE.