Bootstrap Form Laravel Package

Product Decisions This Supports

• Shipping data-driven forms safely without a fork. The new opt-in escape setting gives a real switch for the raw-HTML content sinks (field label, help, success, prepend / append addons, Bootstrap 4 custom-file text), cascading config → form → field. Teams that previously had to patch or wrap the renderer can now harden labels and addons with configuration instead of maintenance.
• A concrete security-hardening workstream. Retiring the addon heuristic — where escaping silently depended on whether the value happened to contain a tag — makes rendering deterministic and closes a class of injection through translation files, CMS copy, or addon values. That is a trackable risk-reduction item, not a vague "we should look at XSS" note.
• Build vs buy tipping point. Escaping defaults to false, so nothing changes for an existing application, and Htmlable values (HtmlString, Blade slots) are never escaped. Teams can adopt the package as the design-system form layer and still flip a global escape => true without breaking intentional markup in x-component slots.
• Design-system and i18n enablement. Help text, success messages, and addon labels sourced from translation files or a CMS can now be escaped consistently at the sink, which unblocks localisation and content-editor-driven form copy.
• Support and QA budget. The boolean-attribute fix removes a documented footgun: escape="false" passed the string 'false' (truthy) and enabled what the author disabled — same for switch, inline, custom, show-all-errors, show-valid-feedback, disable-errors. String settings like help="false" are untouched.
• Low-risk roadmap slot. Opt-in, default-off, Bootstrap 4 baseline not regenerated. This can ride a routine dependency bump rather than consuming a sprint, and the BF::label() TypeError and addon double-encoding fixes reduce incidental bug traffic.

When to Consider This Package

Consider it (or upgrade) when:

• You are building Laravel form UI with Bootstrap-style controls and need labels, help text, validation feedback, input-group addons, and Blade components from one API.
• A security review has flagged raw-HTML sinks fed by translation files, database content, or CMS content, and you want a first-class escape switch at config, form, or field level instead of hand-rolled sanitising in every view.
• You want a "safe by default, markup by exception" posture: set escape => true globally and keep intentional HTML working by passing HtmlString or Blade slots, which are never escaped by design.
• You are already a consumer and want the boolean-attribute, double-encoding, and TypeError fixes without a migration project — the release is additive and preserves current rendering.

Look elsewhere or defer when:

• You need the package to be the sanitisation boundary. It explicitly is not: user input, database content, and translation files must still be escaped before reaching a sink, with or without the setting.
• You depend on required_mark, validation messages, or standalone BF::label() being covered by this setting — none are, by design; BF::label() keeps its own per-call argument.
• You are on Bootstrap 4 and expect visual or markup changes; that baseline is frozen and was not regenerated.
• You need per-sink granularity finer than config → form → field, or want escaping applied to value attributes rather than content sinks.

How to Pitch It (Stakeholders)

Executives: This is a low-risk, opt-in security hardening release. Nothing changes for existing screens by default; teams can now turn on HTML escaping for labels, help text, success messages, and input-group addons globally, per form, or per field, while deliberately keeping markup where the design requires it. It closes a class of injection risk that arose because addon escaping was decided by the value rather than the call site, and it fixes a truthiness bug where escape="false" actually turned escaping on. No migration, no redesign, no Bootstrap 4 rework — a routine upgrade with a meaningful risk reduction attached.

Engineering: escape cascades config → form → field and defaults to false, so existing applications are byte-identical. Setting it retires the addon "escape unless it looks like a tag" heuristic, making rendering deterministic at the call site. Values implementing Htmlable (HtmlString, Blade slots) are never escaped, so x-component slots survive a global escape => true. Boolean settings now parse only "true" / "false", fixing escape, switch, inline, custom, show-all-errors, show-valid-feedback, and disable-errors; settings that legitimately accept strings are untouched (help="false" is still the text false). Addon escaping now follows the package-wide no-double-encoding policy, and BF::label() no longer throws a TypeError on HtmlString. Docs live at docs/llm/options-and-attributes.md (§ Content escaping) and docs/llm/input-groups.md (addon truth table).

PM asks: adopt escape => true as the default for new forms and any form whose label, help, or addon content is data-driven; keep it off only where markup injection is a deliberate product feature; treat this as risk reduction rather than a headline feature, and avoid advertising it as an XSS guarantee — application-boundary escaping remains required. Flag the boolean-attribute change in release notes for support, since a small number of existing components written as ="false" will start behaving as originally intended.