- Is goetas/multipart-upload-bundle a Laravel package?
- No. It is a Symfony bundle that registers a Bundle class, DI compiler passes, and service definitions consumed by Symfony's container. Laravel's service-provider model never loads any of that scaffolding, so installing it gives a Laravel app no working integration. Treat it as a reference implementation to port, not a dependency to require.
- What does goetas/multipart-upload-bundle actually do?
- It parses and handles multipart MIME content types (multipart/related, multipart/mixed, and multipart/alternative) as defined in RFC 1341. In practice that means decoding chunked or composite request bodies server-side and assembling the parts into complete files. The reusable value for a Laravel developer is the chunk-staging and assembly domain logic, not the framework wiring around it.
- Can I install it with Composer in a Laravel 11 or 12 application?
- Composer may resolve the package, but nothing in Laravel will register or use the bundle. It is coupled to Symfony's HTTP foundation request/response layer, which Illuminate\Http\Request does not implement, and Laravel's Storage facade has no interop with its file handling. You would end up with dead code in vendor/ and no functional upload handling.
- How do I add resumable chunked uploads to Laravel then?
- Either port the assembly service into an app-local Uploads service or first-party package, or skip it entirely and use a Laravel-native approach. If you are on a cloud provider, S3 or GCS native multipart upload with presigned URLs removes server-side assembly almost completely and is usually the lowest-risk option. For browser clients, evaluate pion/laravel-chunk-upload, Tus, or Resumable.js rather than reimplementing the wire protocol.
- Which Laravel and PHP versions does this package support?
- There is no Laravel version support to speak of, because the package targets Symfony, not Laravel. Its declared constraints are PHP and Symfony component versions in composer.json, which you must read before attempting a port. Target Laravel 11 or 12 on PHP 8.2+ and verify which Symfony-only helpers (OptionsResolver, EventDispatcher, Filesystem) the assembly classes actually touch.
- How do I port the chunk assembly logic into a Laravel package?
- Extract the receive-chunk, validate, stage-to-temp, concatenate-on-final-chunk, emit-event flow and drop the bundle, DI, and controller layers. Rebind staging to a dedicated Storage disk such as uploads/tmp so temp data can swap between local and S3, replace Symfony events with Laravel events, and expose two authenticated, rate-limited routes: POST /uploads/{id}/chunks and POST /uploads/{id}/complete. Push assembly onto a queued job above a size threshold so the request cycle stays short.
- Is goetas/multipart-upload-bundle production-ready and how risky is depending on it?
- It carries moderate-to-high technical risk: roughly 21 stars, zero dependents, a single maintainer, and no commercial backing. Recent release activity is a positive signal but does not establish a security or compatibility track record, and upload code sits directly on your user-input and file-write path. The MIT license is permissive and fork-friendly, which is useful because forking or porting should be the assumed end state rather than tracking upstream.
- Does it stream the final file assembly or buffer it in memory?
- You must read the source to confirm, and the answer determines whether the pattern survives 2 GB+ uploads. If final assembly is buffered in memory, a ported version will need rewriting around streams before you ship it. Also check whether staging writes go through Symfony Filesystem helpers, since those need replacing with Laravel Storage calls.
- How should I secure chunk upload endpoints in Laravel?
- Put both the chunk and complete routes behind authentication and rate limiting, and never trust client-supplied filenames or content types. Sanitize names against path traversal, cap total temp storage, and delete orphaned chunks on a scheduled command since abandoned uploads otherwise accumulate indefinitely. These hardening concerns are exactly the ones a low-adoption package is unlikely to have solved for your threat model, so budget for them in the port.
- What are the alternatives to this bundle for large file uploads in Laravel?
- For cloud storage, S3 or GCS multipart upload with presigned URLs is the strongest option because the server never assembles the file. For a fully server-side flow, pion/laravel-chunk-upload or a Tus server gives you a maintained protocol with client libraries on both sides. If you need RFC 1341 multipart MIME parsing specifically, port the bundle's small assembly core into your own package and keep only the framework-agnostic Symfony components you actually use.