Weave Code
Attacher Laravel Package
artesaos/attacher
Attacher is a Laravel package for attaching files to Eloquent models. It provides polymorphic attachments, simple upload handling, storage management, and a clean API for managing model-related files and images.
Annex and do what you want with your pictures!
Frequently asked questions about Attacher
- Does artesaos/attacher work with Laravel 10 or Laravel 11?
- No. The last release was tagged on 2015-03-31, which places it in the Laravel 4.2 and 5.0-5.2 era, and its Composer constraints pin old illuminate/* and PHP versions that will not resolve on modern Laravel. The repository is archived, so no compatibility work is coming. On Laravel 8 and above you should treat Attacher as a design reference and reimplement the pattern instead of installing the package.
- How do I install artesaos/attacher in a Laravel application?
- Installation is conceptually a single composer require artesaos/attacher, followed by publishing the package config file and migration and running php artisan migrate. Registration follows the older service provider idioms of its era rather than package auto-discovery. In practice the install only succeeds on a legacy Laravel 4.2 or 5.x codebase, because dependency resolution fails against modern illuminate/* constraints.
- How does Attacher link uploaded files to Eloquent models?
- It uses a single polymorphic attachments table with attachable_id and attachable_type columns, plus a reusable trait you add to any model. That gives every model one-or-many files without per-model schema changes, so a Post or User can own attachments the same way. The fluent surface is a thin wrapper over Eloquent relationships, for example $post->attachment()->create([...]) and $post->attachments.
- Is artesaos/attacher still maintained?
- No. The GitHub repository is archived, it has roughly 46 stars, and the last release was in March 2015. That means no security patching for upload handling, which is a classic attack surface where MIME validation, extension handling, filename sanitization, and path traversal defenses matter. The MIT license and small codebase do make forking or reimplementing cheap, but the real risk is organizational ownership of that fork.
- What are the best alternatives to artesaos/attacher for Laravel file uploads?
- For modern Laravel the two sensible options are Spatie laravel-medialibrary or rebuilding the same schema yourself with a polymorphic attachments table, a HasAttachments trait, and a small service wrapping Storage::disk()->putFileAs(). Spatie is the better fit when you need image conversions, responsive images, queued processing, and multi-disk support with an actively maintained security posture. Reimplementing the core pattern takes roughly one to two days and avoids the dependency.
- Can Attacher store attachments on S3 or another cloud disk?
- Not reliably. The package predates Laravel's Storage disk abstraction and typically works through Illuminate\Filesystem\Filesystem and raw paths rather than named disks. That makes S3, CDN delivery, and signed URLs awkward without modifying the source. If cloud storage is a requirement, choose a maintained alternative or port the file handling to the Storage facade in your own fork.
- How do I configure storage disks and file paths in Attacher?
- Configuration lives in the published config file, where you set the storage location and path structure used when files are attached. You publish the config with the package's publish command during installation and then adjust it per environment. Because the package predates named disks, the settings are path based, so be prepared to adapt them if you need disk-based abstraction.
- How do I delete attachments and clean up orphan files when a model is deleted?
- Cascading deletes and orphan file cleanup are almost certainly not handled by the package, so correctness depends on your application code. Database-level cascade rules do not apply to polymorphic relations, so you need model event listeners or an observer to delete attachment rows and the underlying files. Plan an explicit retention and orphan-cleanup policy, especially for GDPR or tenant-isolation requirements.
- Does Attacher support image thumbnails and conversions?
- It offers optional thumbnail generation built on Intervention Image v1 and v2 APIs, which no longer match Intervention v3. On a modern stack those calls will break, and on-request image processing is a poor fit for large uploads anyway. If you need conversions, use a maintained library that supports queued, async processing instead.
- Is artesaos/attacher safe to use in production, and should I fork it?
- It is high risk on a modern stack: the code is archived, so upload validation and path handling are frozen in 2015 with no CVE watch. The mitigating factors are the MIT license and the small, simple codebase, which makes a fork practical. A fork means relaxing Composer constraints, replacing raw filesystem calls with Storage, porting or dropping thumbnails, adding PHP 8 syntax and return types, and writing tests, so only do it for a legacy app that must keep the package.
Weaver
How can I help you explore Laravel packages today?