Weave Code
Code Weaver
Helps Laravel developers discover, compare, and choose open-source packages. See popularity, security, maintainers, and scores at a glance to make better decisions.
Feedback
Share your thoughts, report bugs, or suggest improvements.
Subject
Message
Log in Register
Home
Packages
Laravel Mediable
Release Notes

Laravel Mediable Laravel Package

plank/laravel-mediable

View on GitHub
Deep Wiki
Context7
7.0.0

What's Changed

This is a security release, upgrading is strongly recommended

  • Added mediable.allowed_remote_hosts configuration which allows restricting remote URL source adapters to a whitelist. Wildcard subdomains may be specified with *.example.com syntax. By default, all hosts are allowed.
  • If no mediable.allowed_remote_hosts allow list is provided, the RemoteUrlAdapter will reject private IP addresses and localhost by default, to prevent Server-Side Request Forgery (SSRF) attacks. [CVE-2026-49969]
  • Added mediable.allowed_remote_schemes configuration which allows restricting remote URL source adapters to a whitelist of allowed URL schemes (e.g. http, https, ftp, etc.). By default, only https is allowed. When modifying this configuration, it may also be necessary to modify the source_adapters pattern matching.
  • Directory validation will now strip . characters from path segments. This prevents attackers from using directory traversal patterns like ../ as well as preventing potential issues with certain filesystems where . characters in directory names may cause unexpected behaviour. [CVE-2026-49970]
  • Added mediable.file_sanitizers configuration which allows specifying custom sanitizers for rewriting file contents to strip out security risks before they are uploaded. A sanitizer must implements the Plank\Mediable\Sanitizers\SanitizerInterface interface.
  • Added SvgSanitizer which will strip executable javascript and other untrusted content from image/svg+xml files, which can result in stored XSS if rendered directly to a webpage. By default, this sanitizer is applied to all uploaded SVG files. It can be disabled by removing it from the mediable.sanitizers config array. [CVE-2026-49971]
  • Added mediable.forbidden_file_extensions configuration and MediaUploader::setForbiddenExtensions() which allows specifying a blacklist of file extensions that are forbidden to be uploaded. Any file extension which is considered executable by your Apache or Nginx configuration should be included in this list. A number of common executable file extensions are included in this list by default to prevent remote code execution exploits.
  • In addition, forbidden file extensions are now sanitized if they are nested within destination filenames (e.g. script.php.jpg becomes script-php.jpg). This prevents remote code execution from double extension bypass due to common Apache and Nginx misconfigurations
  • Added mediable.forbidden_mime_types configuration and MediaUploader::setForbiddenMimeTypes() which allows specifying a blacklist of MIME types that are forbidden to be uploaded.
  • MediaUploader::ON_DUPLICATE_* constants have been moved to an Plank\Mediable\Enum\OnDuplicateBehaviour enum.
  • Added MediaUploaderConfiguration class. Most MediaUploader instance properties are moved to this class. The MediaUploader class now accepts this as a constructor argument instead of an array of configs.
  • MediaUploader::beforeSave() now accepts a \Closure instead of a callable for better static analysis and type safety.

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.5.0...7.0.0

6.5.0

What's Changed

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.4.0...6.5.0

6.4.0

What's Changed

  • Added Laravel 13 support
  • Removed Laravel 11 support
  • Minimum supported PHP version is now 8.3

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.3.1...6.4.0

6.3.1

What's Changed

New Contributors

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.3.0...6.3.1

6.3.0

What's Changed

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.2.1...6.3.0

6.2.1

What's Changed

New Contributors

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.2.0...6.2.1

6.2.0

What's Changed

New Contributors

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.1.3...6.2.0

6.1.3

What's Changed

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.1.2...6.1.3

6.1.2

What's Changed

New Contributors

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.1.1...6.1.2

6.1.1
  • Fix typo in driver class FQCN

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.1.0...6.1.1

6.1.0

What's Changed

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.0.5...6.1.0

6.0.5

What's Changed

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.0.4...6.0.5

6.0.4
  • Fix alt migration default value for the mysql dialect

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.0.3...6.0.4

6.0.3

What's Changed

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.0.2...6.0.3

6.0.2

What's Changed

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.0.1...6.0.2

6.0.1
  • Fix readthedocs documentation build configuration

Full Changelog: https://github.com/plank/laravel-mediable/compare/6.0.0...6.0.1

6.0.0

What's Changed

Version 6.0 contains numerous long-requested feature additions, quality of life improvements and optimizations under the hood.

Compatibility

  • Dropped support for PHP 7.4 and 8.0
  • Dropped Support for Laravel 8 and 9
  • Added Support for PHP 8.3
  • Added Support for Laravel 11
  • Added support for intervention/image 3.0
  • Modernized the database migration files to use more recent Laravel conventions.

Mediable

  • Added MediableInterface which lists all methods added by the trait

MediaUploader

  • Added support for recording alt attributes on Media (database migration required). MediaUploader now exposes a withAltAttribute() method to set the alt attribute on the generated media record.
  • Added MediaUploader::applyImageManipulation() to make changes to the original uploaded image during the upload process.
  • Added MediaUploader::validateHash() to ensure that the hash of the uploaded file matches a particular value during upload. Supports any hashing algorithm supported by PHP's hash() function.
  • By default, the MediaUploader will always use the MIME type inferred from the file contents, regardless of the source. Added the MediaUploader::preferClientMimeType() to indicate that the MIME type provided by the source should be used instead, if provided. The default behaviour can be configured with the 'prefer_client_mime_type' key in the config/mediable.php file.
  • The MediaUploader::useHashForFilename() method now accepts an optional parameter to specify which hashing algorithm to use to generate the filename. Supports any hashing algorithm supported by PHP's hash() function.
  • MediaUploader will now use the visibility defined on the filesystem disk config if the makePublic()/makePrivate() methods are not called, instead of assuming public visibility.
  • MediaUploader now supports data URL strings as an input source, e.g. data:image/jpeg;base64,....
  • If a filename is not provided to the MediaUploader, and none can be inferred from the source, the uploader will throw an exception.
  • If the file extension is not available from the source, the uploader will now consistently infer it from the MIME type. Previously this behaviour was inconsistent across different source adapters.

SourceAdapters

All SourceAdapter classes have been significantly refactored.

  • All sourceAdapters will now never load the entire file contents into memory (unless it is already in memory) to determine metadata about the file, in order to avoid memory exhaustion when dealing with large files. If reading the file is necessary, most adapters will attempt use a single streamed scan of the file to load all metadata at once, to speed up to the precess. Remote files will be cached to temp:// to avoid repeated HTTP requests.
  • Removed getStreamResource() method. The method has been replaced with the getStream(): StreamInterface, which returns a PSR-7 stream implementation instead.
  • Added hash(string $algo): string method which is expected to return the hash of the file contents using the specified algorithm.
  • The return type of the filename() and extension() method is now nullable. If the adapter cannot determine the value from the information available, it should return null.
  • Removed the getContents() method. The getStream()->getContents() method may be used instead.
  • Removed the getSource() method. No replacement.
  • Removed the path() method. No replacement.
  • Removed the valid() method. SourceAdapters should now throw an exception with a more helpful message from the constructor if the source is not valid.

ImageManipulation

  • Added support for optimizing manipulated images, using the spatie/image-optimizer package, which supports a variety of image optimization tools for different image formats (jpegoptim, pngquant, optipng, gifsicle, etc.)
  • Default image optimization behaviour can configured in the config/mediable.php file to specify the optimization tools to use and their arguments.
  • Added ImageManipulation::noOptimization() and ImageManipulation::optimize(?array $optimizers = null) methods to allow overriding the defaults set in the config file.
  • The ImageManipulation::useHashForFilename() method now accepts an optional parameter to specify which hashing algorithm to use to generate the filename. Supports any hashing algorithm supported by PHP's hash() function.
  • The ImageManipulation::usingHashForFilename() method has been renamed to ImageManipulation::isUsingHashForFilename() to avoid confusion with the useHashForFilename() method.

Media

  • Added alt attribute to the Media model.
  • The Media class now exposes a dynamic url attribute which will generate a URL for the file (equivalent to the getUrl() method).

Other

  • Improved MediableCollection annotions to support generic types.
  • Added missing type declarations to most property and method signatures.
  • Removed the \Plank\Mediable\Stream class in favor of the guzzlehttp/psr7 implementation. This removes the direct dependency on the psr/http-message library.
  • \Plank\Mediable\HandlesMediaUploadExceptions::transformMediaUploadException() parameter and return type changed from \Exception to \Throwable.
  • Added PHPStan static analysis to the test suite.

New Contributors

Full Changelog: https://github.com/plank/laravel-mediable/compare/5.9.1...6.0.0

5.9.1

What's Changed

Full Changelog: https://github.com/plank/laravel-mediable/compare/5.9.0...5.9.1

5.9.0

What's Changed

Full Changelog: https://github.com/plank/laravel-mediable/compare/5.8.0...5.9.0

5.8.0

What's Changed

Full Changelog: https://github.com/plank/laravel-mediable/compare/5.7.0...5.8.0

5.7.0

What's Changed

New Contributors

Full Changelog: https://github.com/plank/laravel-mediable/compare/5.6.0...5.7.0

5.6.0
  • When defining image variants, it is now possible to pass one or more tags as a third argument
  • Added ImageManipulator::getVariantDefinitionsByTag() and ImageManipulator::getVariantNamesByTag() to more easily retrieve a group of variants intended for a specific purpose
  • Added ImageManipulator::getAllVariantDefinitions() and ImageManipulator::getAllVariantNames()
  • Fixed MediaUploader::import() not working if the extension of the existing file is uppercase.
5.5.0
  • Filename and pathname sanitization will use the app locale when transliterating UTF-8 characters to ascii.
  • Restored original behaviour of treating unrecognized mime types as application/octet-stream (changed in recent version of Flysystem)
5.4.1
  • Fixed S3 temporary URL generation for Laravel 9+ / Flysystem 3+
5.4.0
  • Added support for Laravel 9
  • Dropped support for PHP 7.3
  • Dropped support for Laravel 6.x and 7.x
  • Fixed S3 temporary URL generation not respecting disk root configuration.
5.3.1
  • Support specifying file visibility on variant creation
5.2.1
  • Fix aggregate type matching not properly handling case mismatches of mime types and/or extensions
  • Handle Guzzle stream_for() deprecation
5.2.0
  • Allow passing filesystem options via uploader and mover
5.1.1
  • Fixed Facade PHPDOC typehints
5.1.0
  • Added MediaUploader::onDuplicateReplaceWithVariants() which behaves similar to onDuplicateReplace() but will also delete any variants of the replaced Media record.
  • Fixed onDuplicateUpdate() failing if file exists but without a matching model.
5.0.7
  • Fixed MediaUploader Facade returning the same instance
Weaver

How can I help you explore Laravel packages today?

Conversation history is not saved when not logged in.
Prompt
Add packages to context
No packages found.
terminal42/code-quality-tools
codifyo/ts-generator-bundle
andydefer/laravel-cluster
testo/fiber
mintobit/jobqueue
a4sex/maintenance-bundle
a4sex/entity-date-update
a4sex/client-identifier
a4sex/base-utilites
a4sex/key-value-storage
a4sex/micro-status
chilldev/dependency-injection-extra
datinglibre/datinglibre-app-api
biberltd/corebundle
bricre/symfony-bundle-test
biberltd/logbundle
dominium/http-adapter-bundle
dominium/google-analytics
a4sex/auto-clean-entity
christhompsontldr/laravel-inky