Laravel Autolink Laravel Package

Product Decisions This Supports

• Feature decisions around user-generated content. Any surface that renders plain text written by users — comments, forum posts, support ticket bodies, bios, chat/notification copy — needs a decision on how links, www. hosts, and email addresses become clickable. This package answers that without pulling in a full Markdown/WYSIWYG pipeline.
• Build vs. buy. The naive version is "one regex." The release notes are a good illustration of why that's a trap: case-insensitive matching against full ignored tag names, rejecting email local-parts with leading/trailing/repeated dots, and correctly resolving www. after Unicode punctuation are all edge cases found in production, not in a first draft. Buying is cheap; maintaining this parsing logic is not.
• Trust-and-safety / spoofing surface. Auto-linking is an attack surface. Rendering [email protected] or a URL with a trailing dot as a live link is exactly the kind of thing that gets flagged in a phishing review. The 10.0.0 fixes tighten false-positive linking.
• Roadmap: Laravel 13 readiness. This release removes a framework-upgrade blocker. Treat the dependency as "green" for the Laravel 13 migration plan — but note it arrives as a major version, which almost always signals dropped support for older Laravel/PHP versions.
• Use cases to scope: activity feeds, in-app inboxes, CRM note rendering, ticket/comment views, digest emails built from plaintext, AI/chat transcripts where the model emits bare URLs.

When to Consider This Package

Adopt when:

• You render untrusted plain text and need predictable autolinking of URLs, www. hosts, and emails.
• Your content is multilingual or mixes Unicode punctuation — the boundary handling fix matters here.
• You need to not linkify inside <a>, <pre>, <code> (ignored-tag detection), i.e., you're post-processing HTML fragments, not raw text.
• You're on (or moving to) Laravel 13.

Look elsewhere when:

• You already run a Markdown/CommonMark pipeline — the autolink extension covers this with no new dependency.
• You need sanitization. This package adds anchors; it does not make untrusted HTML safe. Pair it with a sanitizer or keep escaping in place.
• You need link previews/unfurling, domain allow/deny lists, or per-locale link rules — that's a different (heavier) product.
• You're pinned to an older Laravel/PHP. Stay on 9.x and schedule the bump with the framework upgrade; don't take a major mid-cycle.

Before adopting 10.0.0: confirm which Laravel/PHP versions were dropped and whether the www./Unicode boundary fix changes output for your corpus. Both are output-changing for some inputs, so regenerate snapshots rather than assuming a no-op.

How to Pitch It (Stakeholders)

Executives: A small, narrow dependency that makes user-written content clickable without a rich-text editor. The 10.0.0 release keeps us current with Laravel 13 and closes a handful of parsing edge cases that could otherwise render spoofed or broken links — a low-cost risk reduction, not a re-platforming.

Engineering: Major version bump. Pair the lockfile update with the Laravel 13 upgrade, verify dropped framework/PHP constraints in the upgrade guide, and run existing linkification tests — the ignored-tag, email local-part, and www./Unicode fixes are behavior changes, not pure refactors. It remains a linkifier only: sanitization and escaping stay our responsibility.