Forms Laravel Package

Technical Evaluation

Architecture fit — conditional, not native. nette/forms is a standalone-capable component from the Nette ecosystem, not a Laravel package. Its object model (Nette\Forms\Form, Container, BaseControl, Rules, Validator) is a self-contained form tree with its own renderer, its own CSRF mechanism (CsrfProtection, backed by Nette\Http\Session + Request::isSameSite()), and its own client-side runtime (netteForms.js, rewritten to TypeScript in v3.2.4). Laravel's equivalents are Illuminate\Validation, Blade components, VerifyCsrfToken, and @error. Adopting this package means two parallel request-validation and CSRF stacks in one application unless the integration is deliberately scoped.

The fit is strong in three scenarios and weak in one:

• Strong: a Nette/Latte microservice or admin surface embedded alongside a Laravel API backend.
• Strong: a port of an existing Nette application where form definitions are an asset to preserve.
• Moderate: heavily regulated forms (intake, KYC, GDPR consent) where the built-in server+client rule export, addProtection(), and per-control error messaging reduce bespoke validation code.
• Weak: a greenfield Laravel product where the team expects Blade, FormRequest, and $request->validate(). You would be fighting the framework's grain for rendering, error bags, and CSRF.

Integration feasibility — medium effort, real seams. Standalone instantiation exists (Form::initialize(), added v3.1.2), so a Laravel controller can drive it. The concrete seams to bridge:

1. Request binding. Nette forms expect Nette\Http\IRequest and populate via loadHttpData(). In Laravel you either construct a Nette\Http\Request from Request::createFromGlobals() (works only for genuine globals, not for Laravel's normalized/overridden request) or feed values with setValues() and accept the loss of loadHttpData() semantics — including the newer SubmitButton/submitter handling in v3.2.5–v3.2.6.
2. CSRF. isSameSite() and CsrfProtection are token/session-based on Nette's own session abstraction. Laravel's XSRF-TOKEN/session token must be reconciled, or you disable one and risk a silent double-protection gap. allowCrossOrigin() (used in tests since v3.2.9) is the escape hatch, and it is a security-relevant one.
3. Rendering. Two paths: DefaultFormRenderer (framework-neutral HTML, customizable via setOptionAttribute, ControlGroup, nextTo), or Latte templates via {form}, {input}, {label}, {inputError}. Latte 3.1 is supported (v3.2.7–3.2.8), but that means adding Latte alongside Blade. Budget for a Blade-shim adapter or commit to Latte for the form-rendering surface only.
4. Client-side runtime. netteForms.js expects data-nette-rules attributes on elements with data-nette-rules processing (v3.2.3 narrowed this). It must be loaded outside Vite's default pipeline or wrapped as an entry point; it will not participate in Laravel's @vite HMR flow without configuration.

Technical risk — moderate, mostly ecosystem and lifecycle risk rather than defect risk.

• Version floor: v3.2.x requires PHP 8.1; v3.2.8 claims PHP 8.5 support. If the Laravel app targets 8.2–8.4, no conflict. If it lags on 8.0, you are pinned to v3.1.x.
• BC history is real: getValues(true) deprecated (v3.2.0), Form::getValues() returning only scoped controls (v3.1.0), addImage() → addImageButton(), getUnsafeValues() → getUntrustedValues(), {inputError} requiring an argument (v3.2.0). Minor versions have carried behavioral breaks. Pin tightly; do not float ^3.2 without a CI gate.
• License is NOASSERTION. This is a gating item, not a footnote. Legal must confirm the actual terms before it enters a commercial codebase — treat as a hard blocker for the spike exit criteria.
• Dependents: 0 in the supplied metadata is almost certainly a measurement artifact (the package is widely used in the Nette world), but it must be verified via Packagist reverse dependencies before anyone cites it as an ecosystem-health signal in a decision doc.
• Transitive surface: nette/utils, nette/http, nette/component-model. These are small and stable but add an unversioned-by-Laravel dependency graph to the SBOM.

Key questions to resolve before committing engineering time

1. What percentage of the target form surface is served by Blade FormRequest today, and what specifically is missing — conditional/toggle rules, client-server rule parity, file/mime validation, enum hydration?
2. Which Laravel version and PHP minor is the deployment baseline, and does the 8.1 floor or 8.5 ceiling bind?
3. Is Latte acceptable as a second templating engine for a bounded rendering surface, or is Blade non-negotiable?
4. Who owns the CSRF decision — one stack, or two with an explicit boundary?
5. Is the license cleared by legal? (Blocking.)
6. Is there a Nette-experienced engineer available for review, or is this a cold-start team?

Integration Approach

Stack fit. Treat nette/forms as a bounded component, not a framework. The viable shape is:

Migration path.

1. Spike (1–2 weeks, timeboxed). Build one representative form — ideally the one with the most conditional logic and file upload — end to end through Laravel routing, Laravel session/CSRF, DefaultFormRenderer, and Vite-bundled netteForms.js. Exit criteria: CSRF decision documented, license cleared, one form shipped behind a flag.
2. Adapter layer. Write a thin NetteFormFactory contract + implementation that builds a Form, binds setValues() from the Laravel request, runs validate(), and returns errors in a shape Blade can render (map Nette errors → Laravel MessageBag). This is the only place the two worlds meet; keep it under ~200 lines and test it hard.
3. Pilot surface. Convert a self-contained form cluster (e.g., admin settings, internal intake) — not the customer-facing checkout.
4. Generalize or stop. If the adapter holds, convert form-by-form. If it does not, you have spent three weeks and one form, which is a cheap negative result.

Compatibility.

• Pin an exact version (3.2.9 or later patch) in composer.json; add a Renovate/Dependabot rule requiring a human review on minor bumps given the BC history.
• PHP: target the app's existing 8.2/8.3/8.4 baseline; verify against 8.5 only if the platform is moving there.
• Laravel and Symfony components coexist fine; the risk is duplicate psr/ and symfony/ majors — run composer why nette/utils and check for version skew with symfony/http-foundation.
• Test the allowCrossOrigin() path is not enabled in production config (it is used in nette's own tests since 3.2.9 and is a quiet CSRF bypass).

Sequencing (dependency-ordered).

1. License clearance (blocking, parallel, day 0–3).
2. Spike form + adapter contract (week 1–2).
3. Go/no-go review against the adapter, not against the library's feature list.
4. Vite/asset pipeline integration for netteForms.js (week 2).
5. Pilot cluster migration + regression suite (week 3–5).
6. Broad rollout decision, with per-form cost measured from the pilot.

Operational Impact

Maintenance. This is a maintenance-oriented upstream — v3.2.9 is explicitly "no API changes, type safety + static analysis" and the release cadence is steady (3.2.0 → 3.2.9 across roughly a year). The cost is not upstream churn; it is owning the adapter. Every Laravel upgrade touches the request/session bridge, and every nette/forms minor touches the value/error mapping. Budget roughly 0.5–1 day per quarter for version maintenance plus one adapter review per Laravel major.

Support. No vendor support. Recourse is GitHub issues, Nette's documentation, and the Nette community forum/Discord. Internal bus factor is the dominant risk: if one engineer understands the Container/Rules model and leaves, the adapter becomes a black box. Mitigate with an ADR, a written adapter contract, and a test suite that exercises validation, toggles, file upload, and CSRF explicitly.

Scaling. Negligible runtime footprint — forms are per-request object trees validated in-process; no I/O beyond session for CSRF. The netteForms.js bundle adds a small client payload; v3.2.3's formdata-based compact transmission and v3.2.4's TypeScript rewrite keep it modern but also mean older browser support assumptions changed. Validate against the support matrix. Under high concurrency the validation itself is not a bottleneck; file uploads via UploadControl follow PHP's upload_max_filesize/MAX_FILE_SIZE handling (auto-set since v3.0.3) and need the same ingress limits as any Laravel upload.

Failure modes and mitigations.

• Silent CSRF bypass from allowCrossOrigin() or from disabling CsrfProtection while assuming Laravel covers it on a route that bypasses VerifyCsrfToken. Mitigation: one CSRF owner, an explicit test asserting a missing-token POST is rejected.
• Errors invisible to users because Nette errors never reach $errors/MessageBag. Mitigation: adapter contract test that fails if a control error is not surfaced in the Blade bag.
• Client/server rule divergence — netteForms.js accepts a value the server rejects, or vice versa. The rule export is the package's main value and its main hazard. Mitigation: golden-file test asserting the exported data-nette-rules JSON for each form.
• Request binding drift after a Laravel request-object change (setValues() sees normalized, not raw, input). Mitigation: explicit adapter tests against Request::create() fixtures.
• Minor-version breakage — precedent exists across 3.1.x and 3.2.0. Mitigation: exact pin + upgrade checklist.
• License ambiguity discovered post-integration. Mitigation: clear it before code is merged, not before ship.

Ramp-up. Expect ~3–5 days for a mid-level PHP engineer to become productive in the Container/Rules/Validator model, assuming documentation and one worked example. The steeper curve is the rendering model (DefaultFormRenderer parts, ControlGroup, nextTo, setOptionAttribute) if you are not using Latte — budget another 2–3 days for the Blade partial, and expect the first form to be 2–3× the effort of subsequent ones. If the team has no Nette background, assume the adapter is written by your strongest engineer and reviewed by a second; that is the only part a single person can quietly get wrong in a security-relevant way.

Bottom line for the roadmap. This is a conditional adoption. The validation and CSRF primitives are mature and well-maintained, but the value only materializes if form-heavy work is a genuine roadmap theme (intake, onboarding, compliance capture) and the team can absorb a permanently owned Laravel↔Nette adapter. If forms are incidental, Illuminate\Validation plus a small amount of custom rule code delivers most of the benefit with none of the dual-stack cost. Gate the decision on license clearance, one shipped spike form, and a measured per-form conversion cost from the pilot — not on the feature list.