Weave Code
Markdown Widget Laravel Package
friendsofvictoire/markdown-widget
A Laravel package that renders Markdown content inside dashboard widgets, letting you format widget text with headings, lists, links, and other Markdown syntax instead of raw HTML.
friendsofvictoire/markdown-widget is a small Laravel package that adds a Markdown widget for rendering Markdown content inside your application's dashboards and admin panels. Drop it into a panel provider or layout and point it at a Markdown string or file to display formatted documentation, release notes, or contextual help without writing Blade templates.
The widget keeps rendering predictable and safe, so authors can write in plain Markdown while the package handles conversion and output.
- Renders GitHub-flavored Markdown to HTML out of the box
- Works as a standard widget class you can register anywhere
- Configurable heading, column span, and content source
- Sanitized output for safe display of user-supplied text
- Zero-config defaults with publishable views for custom styling
Frequently asked questions about Markdown Widget
- Is friendsofvictoire/markdown-widget a Laravel package?
- No. Despite the PHP package tag, it is a Symfony bundle (WidgetMarkdownBundle) built for Victoire DCMS, a Symfony-based content management system. It ships no Laravel service provider, no facade, no config file, and no publishable assets. Instead it registers a widget type through Victoire's widget registry and Symfony's tagged-service dependency injection, a mechanism Laravel's container does not implement. It also assumes Twig for rendering and Doctrine for persistence.
- Can I install friendsofvictoire/markdown-widget in a Laravel application with Composer?
- Composer may resolve the package on very old PHP versions, but nothing will auto-register and nothing will render. There is no service provider to discover, no Blade view, and no facade to call, so you would have to pull in Victoire, Twig, Doctrine, and the bundle's extension classes just to reach the widget. That means running two frameworks side by side. For a Laravel app the realistic work is reimplementing the widget, not wiring up the dependency.
- What does friendsofvictoire/markdown-widget actually do?
- It provides a small Victoire widget type that stores a Markdown text field and renders it to HTML through a Twig template. Functionally it is a thin content block for notes, documentation snippets, and editor-authored text inside a Victoire-managed page. The entire feature is a few dozen lines of application code wrapped in CMS registration boilerplate. It is not a general-purpose Markdown rendering library.
- Which Laravel and PHP versions does friendsofvictoire/markdown-widget support?
- None, in the Laravel sense. The last release was 2016-08-22, roughly the Symfony 2.8/3.0 era, and its Composer constraints almost certainly cap PHP below 8.x while pinning older Twig and Symfony majors. Those constraints will conflict with Laravel 10, 11, or 12 installs. There is no declared support matrix for any modern Laravel version.
- Is friendsofvictoire/markdown-widget still maintained?
- No. The repository shows 0 stars, 0 dependents, and no release since August 2016, so there is no community pressure to patch it and no evidence of recent production use. There is no security response path and no maintainer actively triaging issues. An abandoned Markdown parser is a meaningful risk because rendering is a classic XSS vector. Treat it as unmaintained and plan accordingly.
- Is it safe to render Markdown with friendsofvictoire/markdown-widget, or is there an XSS risk?
- Markdown rendering is a well-known XSS surface: raw HTML passthrough, unsafe link protocols, and unescaped attributes all become injection points if not filtered. With no maintainer, any CVE in this rendering path stays unpatched indefinitely. You should own sanitization explicitly, using an HTML allowlist and protocol filtering at render time. Do not rely on an abandoned bundle for output escaping decisions.
- What is the best alternative for rendering Markdown in a Laravel application?
- Use league/commonmark, the maintained CommonMark engine most of the PHP ecosystem standardizes on. Wrap it in Laravel ergonomics: a Blade directive or component for rendering, a cast or accessor for model attributes, and a validation rule for incoming Markdown input. Add league/commonmark's HtmlFilterExtension or an explicit allowlist sanitizer at render time. This gives you the same feature with PHP 8 compatibility and an actively maintained upstream.
- How do I build a Markdown content widget or block in Laravel without this package?
- Store the Markdown source in a text column on your own content model and convert it to HTML at render time with league/commonmark. Add a form component or Livewire field for editing, plus a validation rule that constrains length and input type. Register a Blade component so editors can drop the block into widget-based pages. The whole implementation is a few dozen lines and stays under your security review.
- How should I test rendered Markdown output for XSS before going to production?
- Write feature tests that feed hostile Markdown through your renderer and assert on the resulting HTML. Cover raw HTML passthrough, javascript: and data: link protocols, unquoted attributes, and image onerror payloads. Assert that your sanitizer strips or neutralizes each case rather than asserting on exact markup. Run these tests in CI so a dependency upgrade cannot silently reopen the hole.
- Is there any scenario where friendsofvictoire/markdown-widget is the right choice?
- Only if you already run a Victoire or Symfony CMS and need the widget inside that existing content model. Even then, the 2016 release and lack of maintainers make it a liability for new work. For a Laravel application the answer is to build the capability, not adopt the package. If the real requirement is parity with a Victoire content model, treat it as a cross-framework data problem rather than a dependency decision.
Weaver
How can I help you explore Laravel packages today?