- How do I install te7a-houdini/laravel-trix in a Laravel application?
- Install it with Composer using composer require te7a-houdini/laravel-trix. On modern Laravel the service provider and Blade component are auto-discovered, so no manual registration is normally required. Publish the package config with php artisan vendor:publish to control the storage disk, upload directory, and validation rules. After that you can drop the tray-input component into any Blade form.
- Which Laravel and PHP versions does laravel-trix support?
- The 3.x line tracks current Laravel releases, and version 3.1.0 was specifically a Laravel 12 compatibility bump. Because maintenance is reactive to framework majors, older Laravel versions may be dropped as new majors ship. Always check the composer.json constraints on the tagged release you plan to use before upgrading. If you are on an older Laravel version, pin to the matching major of the package.
- How do I add a Trix rich text field to an Eloquent model and form?
- Store the rich text in a text or longText column on your model and render the tray-input Blade component inside your form. The component emits the Trix custom element plus the JavaScript needed to drive it, so no manual asset wiring is required. Trix submits its serialized HTML as a normal form field, so no special cast is needed on the model. On edit screens, pass the existing HTML back into the component so the editor hydrates with saved content.
- Where are uploaded Trix attachments stored and can I change the disk?
- Storage is configurable through the published config file, where you set the filesystem disk and the directory uploads land in. That means you can point attachments at the local public disk during development and at S3 or another driver in production. The package stores the file, generates an attachment URL, and returns it to Trix in the JSON response the editor expects. Pick your disk deliberately, since switching later means migrating existing attachment paths.
- How does laravel-trix validate uploaded file attachments?
- The package exposes configurable validation rules that are applied to incoming uploads before they are persisted. Those rules are only as strong as the defaults you ship, so review them before exposing the editor to untrusted users. Pay explicit attention to MIME sniffing versus extension trust, maximum file size, image re-encoding, and whether SVG uploads are blocked. Testing the endpoint with deliberately malformed and polyglot files is worth doing before launch.
- Does laravel-trix sanitize stored HTML to prevent stored XSS?
- Trix sanitizes content on the client side as it serializes, and the package adds a server-side sanitization and storage layer, but you must confirm the exact behavior yourself. Verify whether the sanitizer is allowlist-based, whether the allowlist is configurable, and whether it runs on every write path rather than only through the package. Write-only sanitization leaves legacy or externally edited content as a blind spot if your policy later tightens. Since stored HTML is rendered back to users, a sanitizer bypass is a stored XSS issue with a long blast radius.
- What happens to orphaned attachments when an edit is abandoned or content is deleted?
- Uploads happen as soon as a file is attached, so abandoned edits, failed validations, and deletions can leave unreferenced files behind. Nothing in the package description guarantees that cleanup is transactional or triggered on parent delete. Plan for this by adding an explicit delete cascade in your model observers and a scheduled job that removes unreferenced attachments. Without that, storage growth is effectively unbounded.
- Can I use a private disk with signed or expiring attachment URLs?
- Because the disk is configurable, you can point attachments at a private disk instead of the public one. What you must verify is how the package generates attachment URLs and whether it supports temporary signed URLs. If you rely on expiring URLs, old content will break once those signatures lapse, so regenerate URLs at render time rather than storing them permanently. For multi-tenant apps, also partition the upload directory per tenant so attachments cannot be guessed across accounts.
- How do I test the Trix upload endpoint and attachment flow in Laravel?
- The upload endpoint implements Trix's attachment protocol, so it accepts a POST and returns JSON containing the attachment URL. Test it with Laravel's HTTP testing helpers while faking the storage disk so you can assert that files land where expected. Cover the negative cases too: oversized files, disallowed MIME types, and failed validation returning the right status codes. Also assert that the sanitizer output matches your policy on a round-trip through the editor's figure and figcaption markup.
- Is laravel-trix actively maintained and what are the alternatives?
- It is a single-maintainer, low-velocity package with a few hundred stars, and its release pattern is mostly reactive compatibility bumps such as the Laravel 12 update in 3.1.0. Trix itself is a slow-moving Basecamp project, which makes it stable for basic rich text but not a bet for collaborative editing, mentions, or block-based content. If your roadmap needs those features, evaluate TipTap, CKEditor, or TinyMCE instead and treat this package as a stopgap. Because it is a commodity dependency, forking or vendoring it is a realistic fallback if maintenance stalls.