- Can I install kwattro/markdown-bundle in a Laravel application?
- Not in any meaningful way. It is a Symfony 2.x bundle that relies on symfony/http-kernel bundle registration and DI extension conventions, which Laravel does not implement. The only realistic path is to reach past the bundle and call the underlying Sundown PHP class directly from a service provider, at which point the bundle contributes almost nothing. You would effectively be evaluating the C extension, not the package.
- Does kwattro/markdown-bundle support Laravel 10 or Laravel 11?
- No. The package is Symfony 2-era code with no PHP 8 compatibility evidence, and it has no Laravel service provider, facade, or config publishing. Laravel version support is not applicable because the package was never designed for Laravel's kernel or container conventions. Treat any attempt to run it on a modern Laravel stack as unsupported custom integration work.
- What is the sundown PECL extension and do I need it for this package?
- The bundle is a thin wrapper around the Sundown PECL extension, so yes, the C extension is required. Building it needs a compiler toolchain such as phpize, gcc, and libtool, and it must be compiled against the exact PHP ABI you are running. That is a hard blocker for read-only container images, serverless runtimes, and most managed PHP platforms.
- What should Laravel developers use instead of kwattro/markdown-bundle?
- Use league/commonmark. It is pure PHP, CommonMark-spec compliant, actively maintained, supports GitHub-Flavored Markdown extensions, and is safe by default for HTML handling. Binding it in a Laravel service provider is trivial. If raw throughput matters more than spec fidelity, erusev/parsedown is a faster but less strict alternative.
- Is the sundown Markdown parser still maintained?
- No. Sundown was abandoned around 2013 and was superseded by Hoedown and then by cmark and the CommonMark specification. There are no upstream security patches, which is a serious problem when the vulnerable code is a compiled C extension. If you genuinely need Sundown parity, use Hoedown or cmark behind a narrow interface so it can be swapped later.
- How do I render Markdown in Laravel with league/commonmark?
- Install league/commonmark via Composer and register a CommonMarkConverter instance in a service provider, either as a singleton or a bound factory. Inject it into controllers, jobs, or a small renderer class, and expose it to Blade through a helper or facade if needed. Keep the converter behind your own MarkdownRenderer interface so the parser can be replaced without touching call sites.
- Is kwattro/markdown-bundle safe for rendering user-supplied Markdown?
- Treat it as a security finding rather than a feature decision. Sundown predates CommonMark's safe-by-default posture, so raw HTML handling must be audited and locked down manually. Combined with an unpatched C extension and no maintainer security response process, the risk is medium-high. Modern Laravel applications should not route untrusted user content through this stack.
- What are the CI and deployment risks of depending on a PECL extension?
- The extension must be compiled in every environment, including local development, staging, and production images. Each PHP minor version bump can break the build, and there is no maintainer to fix it upstream. You need to know who owns the PECL build in CI today and what your mean time to repair is when it fails. For most teams this becomes a recurring source of pipeline breakage.
- Can I migrate existing Sundown-rendered content without changing the output?
- Capture a golden-file corpus now, before the extension stops building on your target PHP version. Sundown diverges from CommonMark, so content rendered today may not round-trip byte-for-byte on a future parser. Introduce a MarkdownRenderer interface in the application first, then swap implementations behind it. That gives you a controlled comparison point instead of a risky rip-and-replace.
- Is kwattro/markdown-bundle actively maintained, and should the high opportunity score influence my decision?
- No. Health signals are effectively terminal: about 5 stars, zero dependents, a single author, no issue triage, and no security response process. The high opportunity sub-score reflects the absence of competition because there is no market, not unmet demand. If your actual requirement is simply to render Markdown in Laravel, league/commonmark ends the evaluation.