- Can I install ethsam/symfony-dropzone in a Laravel application?
- No. Despite being distributed on Packagist, this is a Symfony bundle that depends on symfony/form, the Symfony Doctrine bridge, and Doctrine ORM, and it registers through Symfony Flex. It uses EntityType and a data transformer that Laravel's Eloquent stack does not provide, so composer requiring it into a Laravel app will not give you a working upload widget. At best it is a reference implementation to read before building an equivalent with Livewire or Inertia and a Laravel upload controller.
- How do I install and register ethsam/symfony-dropzone?
- Run composer require ethsam/symfony-dropzone and, if you use Symfony Flex, the bundle registers automatically. Without Flex you add Ethsam\SymfonyDropzone\SymfonyDropzoneBundle::class to config/bundles.php under the all key. Then include the Dropzone.js 6.x CSS and JS assets in your base template via CDN, and you can use DropzoneType in your forms.
- Which PHP, Symfony, and Doctrine ORM versions does symfony-dropzone support?
- The README states PHP 8.1 or higher, Symfony 5.4, 6.x, and 7.x, and Doctrine ORM 2.12 or higher, with the Symfony Doctrine bridge pulled in by Composer. Dropzone.js 6.0 or newer is loaded from a CDN rather than bundled. Confirm these constraints against your composer.json before installing, especially if you are on an older Symfony LTS.
- Does symfony-dropzone work with Doctrine ORM 3?
- That is unverified. The package only declares Doctrine ORM 2.12+, and ORM 3 removed APIs that entity-ID data transformers commonly rely on. Treat ORM 3 support as unproven until you see it exercised in the package's CI or test suite yourself. If your application is already on ORM 3, budget time for a spike before committing.
- Is symfony-dropzone safe for mapping user-submitted IDs to Doctrine entities?
- Use it with caution. A form type that writes Doctrine associations from client-posted IDs is a classic IDOR surface, because any ID the client sends is a candidate association unless your own query filters it. Wrap the field with authorization checks and constrained queries rather than trusting the transformer, and never expose it on endpoints where users should not be able to reference arbitrary records.
- Who handles upload validation, MIME checks, and authorization in symfony-dropzone?
- You do. The bundle documents route-based upload and remove endpoints returning JSON, but it does not ship a hardened upload controller with MIME validation, size limits, filename sanitization, path traversal protection, or auth and CSRF enforcement. All of those checks, plus storage handling, are the integrator's responsibility. Treat the package as a form and Dropzone.js glue layer, not a file upload security layer.
- Does symfony-dropzone delete files from storage when an association is removed?
- There is no evidence in the documentation that it removes the underlying file. It manages the Doctrine relationship, which typically means detaching the entity reference while leaving the stored file orphaned. If storage cost or retention matters, add your own deletion logic on remove and on entity delete, and verify the behaviour in a staging environment before relying on it.
- How do I configure single versus multiple file uploads and pre-populated edit forms?
- You control the mode per form field on DropzoneType, so one field can accept a single file while another accepts many. Single-file mode builds on Doctrine's EntityType, while multiple mode maps submitted IDs to entities through the bundle's data transformer. Edit forms are pre-populated by reading getId, getFilename, and getSrc on your file entity, with __toString used for rendering, so your entity needs those methods.
- What are the alternatives to symfony-dropzone for drag-and-drop file uploads?
- On Symfony, VichUploaderBundle, OneUpUploaderBundle, and Symfony UX Dropzone cover file handling and upload UX with larger communities behind them. On Laravel, the equivalent work is usually Livewire or Inertia file uploads, Spatie Media Library, or a FilePond front end with a Laravel controller. If you are on Laravel, pick one of those rather than adapting a Symfony bundle.
- Is ethsam/symfony-dropzone actively maintained and production ready?
- Adoption signals are weak: a handful of stars, zero dependents, a single maintainer, and a description reading symfony-dropzone custom suggest a personal or internal fork published to Packagist. The stated last release date of 2026-08-17 looks like a registry anomaly, so verify the real release history and issue activity on Packagist and GitHub. For production, fork it into your own vendor namespace or accept the bus factor risk explicitly.