Weave Code
Files Laravel Package
makinacorpus/files
A Laravel package for attaching and managing files on Eloquent models, with polymorphic file associations, configurable storage disks, image handling, and helpers for uploading, retrieving, and cleaning up stored files.
Simple file handling API
Frequently asked questions about Files
- Does makinacorpus/files actually integrate with Laravel Eloquent models?
- The package description advertises polymorphic file attachments, Eloquent traits, and relationships, but inspection of the source describes a framework-agnostic File object built on PHP stream wrappers with methods such as exists, isFile, getSize, open, unlink, and rename. No service provider, facade, config file, or Eloquent relationship has been confirmed. Treat the Eloquent integration claims as unverified until an engineer reviews src/ directly. If your application depends on model relationships for files, plan a spike before committing.
- How do I install makinacorpus/files with Composer?
- It is Composer-installable, presumably PSR-4, and ships without Laravel package auto-discovery, so there is no service provider or facade registration step to run. Installation takes minutes; the real cost is the wiring and verification work afterwards. Check composer.json for PHP version constraints and any Illuminate or Flysystem requirements before running composer require in a production application.
- What does makinacorpus/files give me that Laravel Storage and Flysystem do not?
- That question has not been answered concretely. Laravel already ships the Storage facade, Flysystem adapters, UploadedFile validation rules, queue-friendly temporary URLs, and streaming responses. A thin File value object over native PHP stream functions occupies the same conceptual space with less coverage. Any adoption has to justify itself on a demonstrated capability delta.
- Which Laravel and PHP versions are supported, and is there a CI matrix?
- No Laravel version constraint or support matrix has been confirmed from the published material. The evaluation found no documented CI matrix and no phpunit.xml, so version support has to be read from composer.json and tested manually. With zero dependents, there is no downstream project proving a working configuration on any Laravel release. Pin the package and smoke-test on your exact PHP and Laravel versions.
- Does makinacorpus/files work with S3 or other Laravel filesystem disks?
- The package blurb claims disk-agnostic storage across local, S3, and custom disks, but the source description shows no Flysystem adapter or Storage facade bridge. The File object appears to wrap native PHP stream functions, which is a different abstraction from Laravel's filesystem layer. Confirm which Flysystem major version, if any, is expected before assuming S3 uploads will work unchanged.
- Does makinacorpus/files handle image resizing or thumbnails?
- The blurb mentions image handling, but no image processing, thumbnail generation, or intervention/image dependency has been verified in the source. The described File object exposes size, modification time, and stream operations rather than image manipulation. Treat any image-handling claim as unverified, and use a dedicated package such as Intervention Image or Glide if you need resizing.
- Is makinacorpus/files production-ready and secure?
- The package has zero stars and zero dependents, meaning no independent code review, no downstream bug discovery, and no observable security disclosure process. File handling is an adversarial surface covering path traversal, MIME and extension mismatch, zip bombs, TOCTOU races on rename, world-readable upload directories, and symlink escape. A library with no published security policy should be assumed unsafe until audited. Benchmark it against a known-good alternative and wrap any trial behind an internal FileStore interface.
- Is makinacorpus/files actively maintained?
- The evaluation reports zero stars, zero dependents, and effectively a single maintainer, with no established security disclosure channel. Before spending engineering time, check the last commit date and the issue and pull request history relative to the current PHP release. A vendor whose description overstates scope this far also raises questions about the roadmap and issue tracker.
- What license does makinacorpus/files use, and can I use it in a commercial or SaaS product?
- The reported license is GPL-2.0, a copyleft license that most commercial and SaaS products cannot accept without legal sign-off because the library links into application code. The Laravel ecosystem convention is MIT or Apache-2.0 for exactly this reason. This is the cheapest and fastest reason to stop an evaluation, and it is decided by legal rather than engineering. Ask Makina Corpus whether a relicensing or commercial-license exception is available.
- Is makinacorpus/files framework-agnostic PHP or a Symfony component?
- Makina Corpus is historically Symfony-oriented, so lineage matters when weighing Laravel fit. The source appears to be framework-agnostic PHP rather than a Laravel package, but confirm whether it requires Symfony contracts. If it does, fit with a Laravel application degrades further. Check composer.json for symfony/* requires before adopting it.
Weaver
How can I help you explore Laravel packages today?