Laravel Zip Validator Laravel Package

Product Decisions This Supports

• Bulk-upload and import features (build vs. buy): This package covers a narrow, well-defined need — server-side validation of uploaded ZIP archives before your application touches their contents. It replaces hand-rolled ZipArchive inspection code and the edge cases that come with it (corrupt archives, zip bombs, unexpected file types).
• Content-level validation rules, not just file-level: You can express requirements like "the archive must contain manifest.json and at least one .csv in /data" as validation rules attached to a form request, keeping archive policy declarative and testable alongside the rest of your validation layer.
• Wildcard file name matching (new in 1.11.0): This is the decision-relevant change. Previously, content rules needed exact file names, which meant either forcing a naming convention on customers or writing custom validation. Wildcard patterns (*.csv, data/*.json) let you accept archives with variable or timestamped file names — a real requirement for customer-supplied exports from third-party systems (ERP, e-commerce, accounting tools) that control the naming. This can unblock a "accept uploads from external systems" roadmap item that would otherwise have required custom code.
• Roadmap dependency: Laravel 8 support dropped. Treat this as a platform-floor decision, not a feature decision. Adoption now requires Laravel 9+. If your product or a customer deployment is still on Laravel 8, you are pinned to 1.10.x and will stop receiving fixes — that is the trigger to schedule the framework upgrade rather than a reason to delay it indefinitely.
• Risk surface for user-supplied archives: ZIP handling is a common attack vector. Delegating extraction and inspection to a maintained, tested package reduces the chance that an upload path becomes a security incident, and gives you a documented rule vocabulary to cite in a security review.

When to Consider This Package

Adopt when:

• You accept ZIP uploads from users or partners and need to reject bad archives before extraction, not after a worker fails mid-job.
• Your validation requirements are expressible as: required files, allowed file types, file counts, uncompressed size limits, and (now) wildcard name patterns.
• You are on Laravel 9 or later — a hard gate for 1.11.x.
• You want archive rules to live in the same place as the rest of your request validation, so product and QA can read the policy without reading PHP internals.
• Your team has no appetite to own ZIP edge-case handling and security patching in-house.

Look elsewhere or stay in-house when:

• You need to validate inside archive contents — schema-checking CSVs, parsing nested archives, virus scanning. This package tells you the archive is well-formed and matches a shape; downstream processing is yours.
• You are still on Laravel 8 and cannot upgrade on your roadmap timeline. Pin to 1.10.x, accept the maintenance gap, and revisit.
• You need streaming or very large archives. Validation implies opening the archive; check size limits against your upload ceilings before committing.
• You require first-class non-ZIP formats (tar, 7z, rar) — outside the package's stated scope.
• Your volume is trivial (a single admin-only upload) — native ZipArchive calls may be simpler than adding a dependency.

How to Pitch It (Stakeholders)

For executives: We needed to accept ZIP archives from customers and partners and reject bad ones reliably and safely — historically a place where custom code and security bugs accumulate. This package lets us express archive requirements as standard validation rules, and release 1.11.0 adds wildcard file matching, which removes a blocker on accepting uploads from third-party systems whose file naming we do not control. It is a small, focused, low-cost dependency with a clear security benefit.

For engineering: Adopt orkhanahmadov/laravel-zip-validator 1.11.x for archive validation at the request layer. Rules are declarative and testable; wildcard patterns let us stop constraining partners to exact file names. Constraint: 1.11.0 drops Laravel 8 — minimum is Laravel 9. Any service still on Laravel 8 must stay on 1.10.x and be flagged for upgrade; do not attempt to install 1.11.x there. Scope is validation only — extraction, parsing, and scanning remain our responsibility. Confirm upload size ceilings against the package's archive inspection cost before rolling out to high-volume endpoints.