- How do I install laravel-zip-validator in a Laravel app?
- Install it with Composer using composer require orkhanahmadov/laravel-zip-validator, then reference the package's validation rule in your form request or inline validator rules array. No custom extraction or service code is required because it plugs directly into Laravel's validation layer. After installing, add a feature test that posts a real ZIP fixture to your upload endpoint.
- Which Laravel and PHP versions does laravel-zip-validator support?
- Release 1.11.0 targets Laravel 9 and newer; support for Laravel 8 was dropped in that release. Applications still on Laravel 8 must stay on the last pre-1.11 version or upgrade the framework first. Always confirm the exact Laravel and PHP constraints in the package's composer.json before rolling it out.
- How do I validate that an uploaded file is a real ZIP archive?
- Apply the package's ZIP validation rule to the uploaded file field in a FormRequest rules method or a Validator::make call. The rule inspects the archive itself, so a renamed file with a .zip extension will fail validation rather than slipping through. Combine it with Laravel's built-in file and mimes rules for defense in depth.
- How do I restrict or deny file extensions inside an uploaded ZIP?
- The rule supports both allow-list and deny-list style extension constraints, so you can permit only expected types such as csv and pdf or block anything that looks executable. Deny rules are useful for hardening uploads from untrusted users, while allow lists work better for structured import bundles. Test both paths with fixtures that include unexpected extra files.
- How does wildcard file name matching work for ZIP contents?
- Version 1.11.0 added wildcard patterns so you can express expected archive structures like *.csv or reports/*.pdf instead of writing a custom validator. Wildcard rules introduce new semantics, so verify case sensitivity, path separators, nested directories, and accidental broad matches in your own test suite. Only adopt patterns where they replace existing custom logic you already understand.
- Can I limit the number of files or the uncompressed size of a ZIP upload?
- Yes, the rules can cap both the entry count and the total uncompressed size of an archive, which helps guard against oversized or padded bundles. These checks run alongside Laravel's normal upload validation, so keep request-level size limits at the web server or PHP configuration layer too. For very large imports, consider queueing the work so validation latency does not block the request.
- Does laravel-zip-validator extract the archive to inspect its contents?
- You do not need to write any extraction code yourself; the validator reads the archive entries and reports failures through standard Laravel validation messages. Validation is still CPU and I/O sensitive for large archives, so enforce upload size and entry-count limits. Avoid extracting uploads to disk unless a later processing step genuinely needs the files.
- Can I use laravel-zip-validator on Laravel 8?
- Not with 1.11.0, because that release dropped Laravel 8 support even though it is a minor version bump. Laravel 8 projects should pin the last compatible pre-1.11 release unless a framework upgrade is already planned. Treat the support drop as an upgrade gate rather than a routine patch.
- How should I test ZIP validation rules in my Laravel application?
- Write feature tests that post real ZIP fixtures to your upload endpoint and assert the expected validation errors. Cover nested directories, multiple file types, empty archives, malformed archives, archives with unexpected extra files, and the exact wildcard patterns you rely on. When upgrading the package, re-run these tests in CI before merging.
- Is laravel-zip-validator safe for production uploads and actively maintained?
- It has a low code footprint and integrates with Laravel's validation layer, but its Laravel support policy creates periodic upgrade obligations, so pin the version and watch releases. ZIP validation carries inherent resource risks such as large archives, compressed bombs, and malformed files. Mitigate them with upload size limits, entry-count caps, request timeouts, and asynchronous processing for heavy imports, and monitor validation failures after rollout.