Symfony Djot Laravel Package

Product Decisions This Supports

• Security posture and default behavior: The 0.2.0 change making safe_mode: true the default is a product-level security decision. It means user-generated Djot content is XSS-protected out of the box, reducing the need for custom sanitization in comments, forums, support tickets, and other UGC surfaces. PMs should treat this as the new baseline and audit any existing content flows that previously depended on raw HTML rendering.
• Trusted vs. untrusted content workflows: The new |djot_raw filter and djot_raw() function give product teams an explicit escape hatch for trusted content such as CMS pages, internal documentation, or admin-authored announcements. This supports clearer content governance: safe by default, raw rendering only where the source is trusted.
• Roadmap for richer content authoring: Six new extensions—admonition, code_group, heading_level_shift, heading_reference, inline_footnotes, and tabs—expand what product teams can support without custom frontend work. These map directly to documentation sites, knowledge bases, release notes, tutorials, and long-form content experiences.
• Build vs. buy for markup rendering: Adopting this package avoids building and maintaining a Djot parser, sanitizer, and Blade integration in-house. The release cadence and security-default change suggest active stewardship, which is a factor in build-vs-buy decisions for content rendering infrastructure.
• Migration and upgrade planning: The breaking change is small in surface area but meaningful in behavior. PMs should plan a migration note, test trusted-content paths, and decide where safe_mode: false or djot_raw is explicitly warranted.
• Converter configurability for product fit: New options like significant_newlines, soft_break_mode, and xhtml let teams tune rendering to match editorial expectations, accessibility requirements, and downstream HTML constraints without forking the package.

When to Consider This Package

• You need Djot rendering inside a Laravel/PHP application, especially via Blade filters or helper functions.
• Your product includes user-generated content and you want secure-by-default rendering with an explicit path for trusted raw content.
• You are building documentation, knowledge bases, CMS pages, forums, comments, or release-note experiences that benefit from Djot’s structure and the newly added extensions.
• You want to avoid maintaining a custom parser, sanitizer, and framework integration.
• You need configurable rendering behavior for line breaks, soft breaks, or XHTML output.
• Look elsewhere if your product only needs standard Markdown with a mature ecosystem and no Djot-specific requirements.
• Look elsewhere if you require a long-term support commitment, formal enterprise SLA, or a large plugin ecosystem that this package does not yet demonstrate.
• Be cautious if you have many existing trusted-content paths that rely on raw HTML; the safe-mode default change requires an explicit migration plan.

How to Pitch It (Stakeholders)

For executives: This package gives us a secure-by-default way to render Djot content in our Laravel application, reducing custom security work for user-generated content while unlocking richer documentation and content features. The 0.2.0 release strengthens the security baseline and adds extensions that support roadmap items like knowledge bases, tutorials, tabs, callouts, and footnotes.

For engineering: The upgrade introduces a breaking default change: safe_mode is now true, so existing trusted-content rendering may need |djot_raw, djot_raw(), or explicit safe_mode: false. In exchange, we get safer defaults, six new extensions, and converter options for line-break and XHTML behavior. The migration is manageable but should include tests around any content that previously rendered raw HTML.