- Is BookStack a Laravel package I can install with Composer require?
- No. BookStack is a complete self-hosted Laravel application, not a reusable library, so the correct model is deploy and operate rather than composer require into an existing app. Composer is used inside its own codebase during a build-from-source deployment via composer install --no-dev. The recommended paths are the official Docker image or a standalone release deployment.
- What are the server requirements for installing BookStack?
- BookStack expects a LAMP-style stack: PHP 8.2 or 8.3, Composer, MySQL 8+ or MariaDB 10.6+, and Nginx or Apache with local or S3-backed file storage. Optional binaries are needed for image thumbnails and PDF export. Front it with a reverse proxy that terminates TLS and passes correct trusted-proxy headers, otherwise generated URLs and SSO callbacks break.
- Which Laravel and PHP versions does BookStack support?
- BookStack ships as a monolith with its Laravel framework version pinned to each release, so you do not choose the Laravel version independently. PHP 8.2 or 8.3 is the supported runtime, and PHP 8.4 should be validated in staging before rollout. Check the bundled dependency bump against your PHP pin, since updated transitive packages are the main upgrade hazard.
- Can I embed BookStack inside an existing Laravel application?
- Not realistically. BookStack is designed to run as a separate service with its own database, storage tree and admin UI, and its theming and view overrides are deliberately limited. The practical pattern for an existing Laravel product is to run BookStack alongside it and integrate over the REST API and an identity provider. Forking views or embedding the code creates significant upgrade friction.
- How do I safely upgrade BookStack to a new release like v26.09.1?
- Back up the database, the storage and uploads tree and your .env file, put the app into maintenance mode, pull the new tag, run composer install and php artisan migrate, clear caches, then bring it back up. Container deployments are a tag bump plus the same migrate step in the entrypoint. Migrations are forward-only, so a database snapshot is mandatory for rollback rather than optional.
- Does BookStack have a REST API and how do I authenticate to it?
- Yes, BookStack exposes a REST API with token-based authentication: generate an API token in the admin UI and send it as a Bearer token. It is commonly used for content automation such as creating pages and syncing documentation. Note that v26.09.1 fixed attachment listings leaking pages that sit in the recycle bin, so audit API consumers for assumptions about attachment payloads.
- Does BookStack support SSO with SAML2, OIDC or LDAP?
- Yes, BookStack supports SAML2, OIDC and LDAP identity providers, configured through its admin settings and environment file. SSO callbacks depend on correct trusted-proxy headers from your reverse proxy, so misconfigured proxies are the usual cause of login failures. Verify the callback URLs after any hostname or TLS termination change.
- What security issues were fixed in BookStack v26.09.1?
- The patch hardens ZIP imports by verifying uncompressed size before extraction, closing a decompression-bomb and disk-exhaustion path reported through coordinated disclosure, though no CVE was assigned. It also regenerates permissions when a chapter is promoted, which is a data-correctness fix that may leave stale permissions on content moved before the patch. A third fix stops attachments for recycle-bin pages from leaking into the API. Priority on the ZIP fix depends on whether non-admin roles can trigger imports.
- Can I customize the BookStack theme or override its Blade views?
- BookStack allows only deliberately limited theming and view overrides, because it is an application rather than a package built for extension. Overriding views works but creates upgrade friction and must be rechecked on every release. If deep custom branding or an embedded UI is a hard requirement, treat that as a reason to evaluate alternatives rather than fork the views.
- Is BookStack actively maintained and what support is available?
- BookStack is actively maintained and now managed on Codeberg, with official Docker images, a documented upgrade path and regular patch releases. Support is community-only, so there is no vendor SLA if that is a procurement requirement. Teams that need guaranteed support should weigh that against the low operational cost of running it as a standalone service.