Weave Code
Nova Html Card Laravel Package
interaction-design-foundation/nova-html-card
A Laravel Nova card that renders custom HTML or Blade content directly on your dashboards and resource pages. Drop in markup, embed views, and build flexible info panels without writing a full custom card component.
A Laravel Nova card to display arbitrary HTML content
Frequently asked questions about Nova Html Card
- How do I install and register the nova-html-card package in Laravel Nova?
- Install it with composer require interaction-design-foundation/nova-html-card, then register the card in your NovaServiceProvider, usually inside mainDashboardCards() for dashboard placement or in a resource's cards() method. Pass your markup string to the card as documented in the README. Run php artisan nova:assets as part of your deploy so Nova publishes the card's compiled assets, and verify it renders on staging before shipping.
- Does this card support Laravel Nova 4 and Nova 5?
- Support depends on the version constraint declared in the package's composer.json, because Nova's card and asset APIs changed materially across majors 3, 4, and 5. Check that file and the release tags for the Nova, PHP, and Laravel versions it was validated against, then pin an exact version in your composer.json. Since this is a single-maintainer package, assume it may lag a Nova upgrade and keep a fork ready so an admin panel upgrade is never blocked.
- Is it safe to render user-editable or database-driven content with this card?
- The package's entire premise is rendering unsanitized HTML, so anything user-editable such as a database field, CMS entry, or admin-editable setting becomes a stored-XSS vector inside your highest-privilege admin surface. Hardcode content in PHP or config and treat changes as code review, or sanitize with a library like HTML Purifier before passing it in. Never wire it directly to a field that non-developers can author.
- Can I render a Blade view or template instead of a raw HTML string?
- Yes. Because the card accepts an arbitrary HTML string, you can pass view('nova.cards.docs', $data)->render() and get full Blade templating, translations, and component reuse instead of string concatenation. This keeps the markup maintainable, lets you localize content with Laravel's translation helpers, and makes the content easy to review in version control.
- Can I restrict which users or roles see the card?
- Nova cards support visibility callbacks such as canSee(), but whether this package honors them out of the box depends on how it registers the card, so verify on your Nova version. The recommended pattern is a small wrapper class in your app, for example App\Nova\Cards\DocsCard, that extends the package card and adds your own canSee() logic. That wrapper also gives you a one-file swap point if the package is abandoned or breaks on a Nova upgrade.
- Will inline HTML break my Content-Security-Policy headers?
- It can. Inline HTML often collides with strict Content-Security-Policy headers, especially embedded iframes, inline styles, and inline scripts that need explicit allowances. Run a short check against your production headers before committing and confirm which style-src or frame-src exceptions you would need. If your CSP is tight, prefer markup that uses already-permitted classes and avoid iframes.
- Do I need to run npm or compile assets to use this card?
- There is no custom JavaScript beyond Vue's v-html rendering, so you do not need to run npm or build anything yourself. You do need to run php artisan nova:assets as part of your deploy so Nova publishes the card's compiled assets. Confirm the card appears after a fresh deploy, since locally cached assets can mask a missing publish step.
- What happens if the card content fails or is empty?
- Because the card is a thin presentation wrapper with no models or routes, the most likely failure is a blank card when the HTML string is empty. A thrown exception inside view()->render() can degrade the whole dashboard, so wrap dynamic content generation in a try/catch or precompute the HTML before passing it in. Test both an empty string and a deliberately failing view to see the actual behavior on your Nova version.
- Is this package actively maintained, and what is the bus factor?
- It has modest adoption, roughly 68 GitHub stars and no dependents, and is maintained by a single organization, the Interaction Design Foundation, so the bus factor is effectively one or two people. The surface area is small enough to reimplement in an afternoon, which makes the practical mitigation straightforward: pin the version and keep a fork ready. Nova major-version upgrades are the most likely breaking event you will encounter.
- How does this compare to writing my own custom Nova card?
- A hand-rolled Nova card means scaffolding a Vue component, registering it, and maintaining the build toolchain, which is heavy overhead for what is usually a static info panel or documentation link. This package replaces all of that with a composer install and one registration line, and if you already maintain a bespoke card it likely deletes code. Both approaches require Laravel Nova itself, which is a paid license, so this only makes sense if Nova is already your admin layer.
Weaver
How can I help you explore Laravel packages today?