- How do I install fsi/files in a Laravel project?
- Install it with Composer using composer require fsi/files. The package is described as lightweight to integrate, but the technical assessment warns that its persistence core appears Doctrine-based, so verify compatibility with your Laravel and PHP versions before adding it to an Eloquent application. Check the repository for service provider or config publishing steps.
- Is fsi/files compatible with Eloquent, or does it require Doctrine?
- The package is presented as a Laravel package, but the assessment of release 3.0.3 indicates its persistence core is Doctrine, not Eloquent. No supported Eloquent path is confirmed, and at most a Laravel integration bridge may exist. Treat it as Doctrine-first and Laravel-optional until source verification proves otherwise.
- Which Laravel and PHP versions does fsi/files support?
- There is no published Laravel version support matrix in the provided context. The dependency widening to doctrine/dbal ^4.0 also raises PHP, symfony/console, cache, and migration-tooling constraints that can affect coexistence. Test your exact Laravel and PHP pairing in CI before adoption.
- Does fsi/files validate uploads and secure filenames?
- Its overview advertises built-in validation and secure filename handling, plus configurable paths, disks, and naming. That is a starting point, not a security guarantee: validate MIME type, extension, and size yourself, and store files outside the public root where possible. Review the source because file-handling packages carry path traversal and MIME spoofing risk.
- Can fsi/files upload to S3 or other cloud disks?
- The package describes disk-agnostic storage for local and cloud filesystems, which suggests it can target Laravel Storage or Flysystem disks such as S3. Confirm the exact disk configuration and credential handling in the source, because the assessment flags SSRF and unbounded disk consumption as file-handling concerns. Test with a non-production bucket first.
- What security issues should I check before using fsi/files in production?
- The assessment lists path traversal, MIME spoofing, SSRF on remote fetch, unbounded disk consumption, and tenant-boundary leaks as the dominant concerns. Provenance is also weak: zero stars, zero dependents, unknown license, and unknown CI status are still open. Do a source review and threat-model your upload flow before production use.
- Does fsi/files support multi-tenant file storage?
- Multi-tenant key prefixes and tenant-boundary isolation are listed as open questions, not documented guarantees. Test whether paths, disks, and naming configuration can enforce per-tenant prefixes without leaking files across tenants. If isolation is critical, add application-level checks rather than relying on the package alone.
- How can I verify fsi/files test coverage and DBAL compatibility?
- The release claims doctrine/dbal ^3 || ^4 support, but that claim is only credible if CI exercises both DBAL 3 and DBAL 4. The provided assessment found no visible CI status or coverage proof, so ask the maintainers directly. Run your own integration tests against the exact DBAL and ORM versions you plan to deploy.
- Is fsi/files a replacement for spatie/laravel-medialibrary?
- For an Eloquent-first Laravel shop, spatie/laravel-medialibrary is the safer comparison because fsi/files appears Doctrine-oriented and has little visible production usage. The assessment explicitly asks whether fsi/files does anything Spatie does not, and that remains unanswered. Compare features, maintenance, and security posture before switching.
- Who maintains fsi/files and what license is it under?
- The project comes from the FSi Open lineage, and release 3.0.3 includes a named external contributor, which is small positive evidence of a contributor base beyond one author. The license, CI status, coverage, static-analysis level, and open security advisories are still unknown in the provided assessment. Check the GitHub repository and Packagist metadata before adopting it.