- Is jorisdugue/h5p-bundle a Laravel package?
- No. Despite being described in some listings as a Laravel bundle, jorisdugue/h5p-bundle is a Symfony bundle. It binds into Symfony's dependency injection container, configuration tree, event dispatcher, routing loader, and Twig namespace, and it has no Laravel service provider, facade, or config publishing. Laravel applications cannot install and use it as a normal Laravel package.
- Can I use jorisdugue/h5p-bundle in a Laravel application?
- Not directly as a native Laravel package. The practical options are to run the bundle as a standalone Symfony sidecar service and embed its player and editor via iframe with signed authentication, or to port the framework-agnostic H5PFrameworkInterface and H5PEditorAjaxInterface implementations to Laravel using Eloquent, the Storage facade, and route groups. Both paths are integration work because the package itself provides no Laravel bindings.
- What does jorisdugue/h5p-bundle actually provide?
- It is an adapter layer that connects a PHP application to the H5P core libraries, h5p/h5p-core and h5p/h5p-editor-php-library. It handles rendering H5P content packages as interactive embeds and serving the core styles and scripts required in the browser. It also demonstrates a working implementation of H5P's framework and editor AJAX interfaces in a Symfony context.
- How do I install jorisdugue/h5p-bundle?
- You install it with Composer, but because it is a Symfony bundle you register it in a Symfony application's bundle configuration and kernel rather than in Laravel's provider array. There is no Laravel service provider, facade, or publishable configuration file. If you are targeting Laravel, plan for a sidecar service or a native port instead of a drop-in install.
- Which Laravel versions does jorisdugue/h5p-bundle support?
- None natively, because the package is built for Symfony and does not ship Laravel service providers or Laravel version constraints. Laravel version support would only exist in a port or adapter you write yourself. Treat any listing that calls it a Laravel bundle as inaccurate for dependency planning.
- Which H5P core and editor versions does jorisdugue/h5p-bundle pin?
- The bundle pins specific versions of the H5P core and editor libraries, but the provided overview does not document the exact pins or how far behind upstream they are. That matters because H5P upstream and content type libraries update independently. Confirm the pinned versions and upgrade policy with the maintainer before committing.
- What database and storage does H5P require in Laravel?
- H5P needs three storage tables for libraries, content, and content types, plus a writable file area for .h5p packages and extracted assets. It also needs editor AJAX endpoints and player or embed rendering. If you port it to Laravel, you will implement these with Eloquent, the Storage facade, and a route group because the bundle provides no Eloquent persistence.
- How should I handle .h5p uploads and extraction in production?
- Treat .h5p uploads as untrusted ZIP archives. The technical assessment recommends extracting outside the document root or disabling PHP execution in the served directory, plus validating MIME types and guarding against zip-slip paths. Do not assume the bundle provides those protections; verify and harden the deployment yourself.
- Is jorisdugue/h5p-bundle actively maintained and safe for production?
- Treat it as high supply-chain risk. The assessment notes a single maintainer, roughly 11 stars, zero dependents, and no documented security response process, so there is little downstream production usage to inherit fixes from. For production, vendor or fork the code, review it, and budget for ongoing H5P upgrade maintenance rather than assuming community support.
- Does jorisdugue/h5p-bundle support xAPI and offline content type installation?
- xAPI emission is an open question, not a confirmed feature; the bundle is documented for content CRUD, editor AJAX, and rendering, so verify xAPI support in the code. Content type installation typically calls the external H5P Hub, and no supported offline or mirrored path is documented. For air-gapped or regulated deployments, plan a manual library import process or ask the maintainer.