- How do I install alfonsobries/nova-trumbowyg?
- Install it with Composer using composer require alfonsobries/nova-trumbowyg inside an existing Laravel application that already has Laravel Nova installed. It is MIT licensed, published on Packagist, and has no native extension requirements. After installing, you register or publish the field assets as described in the package readme so Nova loads the Vue component and Trumbowyg files.
- Which Laravel Nova versions does nova-trumbowyg support?
- It targets Nova 1.x from around 2018, which is the era of its last release on 2018-08-25. There is no support for Nova 2, 3, 4, or 5, because the Nova field component contract, asset registration surface, and Vue major version have all changed since then. On anything newer than Nova 1.x you should treat this as a fork-and-port project rather than a drop-in package.
- How do I add the Trumbowyg field to a Nova resource?
- You add it to your resource's fields() method like any other Nova field, using the package's field class and pointing it at a string or text column. The editor output is persisted as raw HTML in that column, so no model casts, migrations, or API changes are required. On a matching Nova 1.x install the whole integration is a Composer require, an asset publish, and a one-line field declaration.
- Do I need to publish assets after installing nova-trumbowyg?
- Yes. The package ships a compiled Vue component plus Trumbowyg and jQuery assets that are registered through the service provider's Nova::script() and Nova::style() calls, and the vendor:publish step exposes those assets to your application. Because Nova's asset pipeline changes between minor releases, re-validate asset publishing after every Nova upgrade. For reproducible builds, many teams vendor the published assets into the repository and pin the package commit.
- Is nova-trumbowyg still maintained?
- No. The repository is archived, the last release was in August 2018, and it has a single maintainer and roughly 13 stars. There is no upstream security response, no Nova compatibility fixes, and no test suite to validate a fork. If you depend on it, you effectively own the code and should plan to maintain it yourself.
- Does nova-trumbowyg sanitize the HTML it saves?
- No. The package is a thin wrapper around the editor and stores the Trumbowyg output as raw HTML without any sanitization step. Any user with write access to the field can inject markup and potentially script into the admin UI, and depending on where you render that HTML it can reach the public site. Sanitize on output with something like HTML Purifier or a strict allowlist if authors are not fully trusted.
- Is it safe to use nova-trumbowyg in production?
- Only with caveats. The 2018-era Trumbowyg and jQuery dependency chain carries known CVEs from that period, including prototype pollution and XSS issues in jQuery, with no patch path short of forking or replacing the editor. The field also renders unsanitized HTML, so it is only reasonable when the authors are trusted admins and the stored content is sanitized before display. For untrusted, multi-tenant, or customer-facing content the technical risk is high.
- Can I use nova-trumbowyg with PHP 8 and newer Laravel versions?
- Not without work. It is a PHP 7.x-era package, and PHP 8 strictness around dynamic properties and null handling is a common break point, so the Composer constraints will usually need loosening in a fork. Nova 4 and 5 also require Vue 3 and Inertia, which the existing compiled component does not target. Expect to rewrite the field component rather than just bump version constraints.
- How do I customize the Trumbowyg toolbar or editor options?
- The field is a thin wrapper, so customization happens by passing options through to the underlying Trumbowyg instance from the field definition. The exact option surface depends on the compiled Vue component in the package, so check its source before assuming a given Trumbowyg option is exposed. If you need options that are not wired up, fork the component and add them yourself.
- What are the alternatives to nova-trumbowyg for a rich-text field in Laravel Nova?
- For modern Nova versions, a maintained editor integration such as TipTap or TinyMCE, or Nova's built-in Markdown field, is usually a cheaper path than porting this package. If you want Trumbowyg specifically, forking the repo and replacing the jQuery editor with a maintained one while upgrading the Vue component to the current Nova field contract is the recommended route. Either way, scope it as building a field, not adopting a package.