- What does pmochine/laravel-nova-hashids actually do?
- It is a Laravel Nova 5 card plus a small card-scoped HTTP API that encodes and decodes IDs using Hashids, backed by vinkla/hashids. It lets you obfuscate resource IDs in Nova URLs and API responses so sequential primary keys are not exposed. You keep your existing schema and simply hide the raw IDs, which reduces ID enumeration. There is no separate service, queue, or migration involved.
- What Laravel, Nova, and PHP versions does laravel-nova-hashids require?
- Version 3.x requires Laravel Nova 5, Laravel 12 or 13, PHP 8.2 or newer, and vinkla/hashids 13 or 14. There is no graceful coexistence with Nova 3 or 4, and Composer will simply refuse to install v3 in those environments. Audit any other packages that pin vinkla/hashids below version 13 before upgrading.
- How do I install and configure the Hashids card in Laravel Nova?
- Install it as a normal Composer dependency, for example composer require pmochine/laravel-nova-hashids:^3.0, then register the card in your Nova service provider the way you would any Nova card. No migrations are required. Configuration covers custom salts and minimum hash length, and version 3.0.0 also adds a Converter contract if you need a custom algorithm. After installing or upgrading, rebuild cached routes.
- Is version 2 of this package safe to run on Nova 4 or Nova 5?
- No. With v2 on Nova 4 or 5 the card routes were not authenticated because Nova's nova middleware group no longer authenticates requests, so a guest could list connections and encode or decode IDs. Treat this as an active security finding in any environment still running that combination. Mitigate immediately by upgrading to v3, restricting the routes, or disabling the card until it is remediated.
- How do I make sure only authorized Nova users can access the card API?
- After upgrading, verify that only users passing Nova's viewNova gate can reach the card, and explicitly test both guest and non-authorized access. The card is admin-facing and low-traffic, so it should not be reachable from customer-facing request paths at all. If you cannot upgrade immediately, restrict the routes at the web server or route middleware level.
- Can I customize the Hashids salt, minimum length, or algorithm?
- Yes. The package supports custom salts and minimum hash lengths through configuration. Version 3.0.0 also introduces a Converter contract, so you can bind your own hash implementation without forking the package, which is useful if your organization already has established salt or hashid conventions. If the default Hashids behavior is enough, no custom binding is needed.
- Do I need migrations or database schema changes to use it?
- No. The package does not mention any migrations and does not require schema changes, because it only transforms IDs at the presentation and API layer. Your primary keys stay sequential in the database and are simply obfuscated when exposed in Nova URLs or responses. That makes it easy to adopt and to remove without data cleanup.
- Will upgrading to 3.0.0 break internal tools that call the card endpoints directly?
- The card API changed: the selected parameter became connection and some response fields were renamed. Release notes state that only the shipped card consumes these endpoints, so the blast radius is low unless your team built custom callers. Audit any internal scripts or dashboards that hit the card API before rolling out. Vue 2 components and Sass were also removed in favor of a Vue 3 build, so local front-end customizations must be rebuilt.
- What edge cases were fixed in 3.0.0 and what should I regression test?
- The 3.0.0 fix list covers invalid hashids returning HTTP 500, multi-number hashids, connection-name validation, large model IDs, leading zeros and GMP octal parsing, and bad connection configuration. These are meaningful fixes, so smoke-test them against real data rather than only sample records. Also test encode and decode, default connection display, resource-detail auto-conversion, Enter-to-convert, and the Copy hashid button.
- Does the package work with route caching, and do I need to rebuild routes after upgrading?
- Yes, it works with cached routes, but you must run php artisan route:cache after installing or upgrading because the card routes changed. Forgetting this step is an easy operational miss that can leave stale endpoints live in production. Include the route cache rebuild in your deployment checklist and keep a rollback plan for the Nova 5 upgrade.