- How do I install Clippy for Laravel?
- Install it with Composer by requiring jord-jd/clippy-for-laravel. Laravel's package auto-discovery registers the service provider, so there is no manual provider entry to add. After that you can optionally publish the config and static assets before placing the Clippy directive in a layout.
- Which Laravel and PHP versions does this package support?
- The package advertises support from Laravel 5.1 through 13 and PHP 7.0 through 8.5, which covers modern apps as well as legacy ones you cannot easily upgrade. The trade-off is that the PHP 7.0 syntax floor is long past end of life, so the code cannot use modern language features. Support across the middle of that range is inferred rather than exhaustively tested, so verify on your exact Laravel and PHP combination before shipping.
- How do I publish the Clippy config and assets?
- Run php artisan vendor:publish and select the Clippy for Laravel provider, or use the package's publish tag, to copy the config file and static Clippy assets into your app. Use the --force flag when you need to overwrite previously published files after a package update. If you skip publishing, the package uses its own defaults and bundled assets.
- Where do I put the Clippy Blade directive in my app?
- Add the directive to your main layout, typically just before the closing body tag, so the assistant is available on every page. Because the package is a thin view-layer add-on, it does not touch routing, the database, queues, or authentication. Removing Clippy later is just deleting that one line.
- Can I customize the tips and messages Clippy shows?
- Clippy's speech text lives in the publishable config file, so you can change the tips and messages without editing package code. Keep in mind that dynamic or user-influenced strings are exactly the case that made older versions vulnerable. On v5.1.0 and later the payload is JSON-encoded, which mitigates quote and closing script tag breakout.
- Is there an XSS vulnerability in clippy-for-laravel?
- Versions before 5.1.0 embedded Clippy's speech directly in a script block, so any config value or user-influenced string containing quotes or a closing script tag could break out of the script context, creating a stored XSS vector. v5.1.0 JSON-encodes the payload, which is the correct mitigation. Treat earlier versions as vulnerable and move to the ^5.1 constraint rather than staying on an older tag.
- Does clippy-for-laravel conflict with my app's jQuery?
- Version 5.1.0 moved the bundled jQuery from 1.7 to 3.7.1, a major-version jump shipped inside a minor release. If the package injects a global jQuery, it can clobber or be clobbered by your app's copy, and jQuery 3.x removed APIs like .load() as an event shortcut, $.browser, and jQuery.fn.error that older plugins still call. Audit your front-end plugins for 1.x assumptions and check whether the package only loads jQuery when window.jQuery is absent.
- Does Clippy for Laravel work with a strict Content Security Policy?
- The package emits a small inline script to mount the assistant, so a script-src policy without unsafe-inline will block it. JSON encoding fixes escaping, not inline-script policy. You will need a nonce or hash for the inline script, or to move the mount call into an external file, before enabling a strict CSP.
- Can I disable Clippy in production or limit it to admin panels?
- If you only want the assistant in admin panels or onboarding flows, include the directive in those layouts instead of the global layout. The package does no database, queue, or request-lifecycle work, so its runtime cost is limited to the assets and mount script. Do check whether the bundled jQuery is being downloaded twice and suppress the package copy if your app already ships jQuery 3.x.
- How do I safely upgrade to the patched Clippy version?
- Update the constraint to ^5.1, run composer update in a branch, then republish the assets with vendor:publish --force, because stale published files will silently keep the old behavior. Clear compiled views and any config or view cache afterward. Finally, inspect the rendered page source to confirm jQuery loads exactly once and the speech payload is JSON-quoted.