What it is

UnsplashToolkit keeps a curated registry: a record of the photos your application has approved, grouped into named pools. It stores each photo's metadata and the hotlink URLs Unsplash returned — never the image bytes. Selecting a photo reads your own database, so rendering a page costs no Unsplash API requests at all.

Curation and storage are two different problems

Most applications that download Unsplash photos are not trying to own files. They are trying to control which photos appear. Those are separable, and only the second one is yours.

That last row is the whole trade, and it is why unsplash:verify exists.

Do you need this?

If you need one photo on one page, you do not. Copy the URL out of Unsplash and put it in your template:

<img src="https://images.unsplash.com/photo-1506905925346?w=1920&q=80">

Add the credit by hand and you are done. No dependency, no table, no API key.

If you want raw API access and nothing else, the official unsplash/unsplash PHP client is thinner than this package and has no opinions.

You want this package when a person has to choose the photos, and the application has to keep choosing between them: a rotating login background, approved article headers, seasonal heroes someone in marketing curates.

Requirements

• PHP 8.2, 8.3 or 8.4
• Laravel 11 or 12
• An Unsplash API access key — register an application

Unsplash grants 50 requests per hour in demo mode, and 5000 once your application is approved for production. Because pools are read from your database, that budget is spent when someone curates a photo, never when a page renders one.

Install the package

composer require gabrielesbaiz/unsplash-toolkit

Publish and run the migrations

php artisan vendor:publish --tag="unsplash-toolkit-migrations"
php artisan migrate

Three migrations ship: create_unsplash_assets_table, create_unsplashables_table, and upgrade_unsplash_tables_to_v2, which is additive and only does anything on a 1.x installation.

Publish the config

php artisan vendor:publish --tag="unsplash-toolkit-config"

This writes config/unsplash-toolkit.php. Every setting is documented on the Configuration page.

Set the environment

UNSPLASH_ACCESS_KEY=your-access-key
UNSPLASH_APP_NAME="Your Application"

Verify the install

php artisan unsplash:doctor

  Rule                Status   Detail
  C7 credentials      OK       Access key abcd********op is set server side.
  C5 attribution      OK       utm_source is "Your Application".
  C1 hotlinking       OK       Local storage is disabled.
  C6 rate limit       OK       Capped at 50 requests per hour.

It exits non-zero on a violation, so it can gate a deploy. Then curate your first photo:

php artisan unsplash:search "mountain road"
php artisan unsplash:curate <id> --pool=login-backgrounds

Schedule the health checks

Because images are hotlinked, a photo removed by its photographer has to be taken out of rotation:

Schedule::command('unsplash:verify')->daily();
Schedule::command('unsplash:refresh')->weekly();

Publishing

php artisan vendor:publish --tag="unsplash-toolkit-config"

Config is read through a typed Support\Config class with a single KEY constant, so the published file name and the key the package reads from can never drift apart — which is exactly the bug that made 1.x unable to run at all.

Credentials

Compliance

HTTP

Rate limiting

Cache

Pools

Images

Database

Picker

Storage and queue

Browsing Unsplash

Every browse method returns a PendingRequest you refine with chained calls, then execute with ->get(), ->first() or ->toArray().

use Gabrielesbaiz\UnsplashToolkit\Facades\Unsplash;
use Gabrielesbaiz\UnsplashToolkit\Enums\{Color, Orientation, OrderBy};

$results = Unsplash::search('buildings')
    ->color(Color::BlackAndWhite)
    ->orientation(Orientation::Squarish)
    ->orderBy(OrderBy::Relevant)
    ->perPage(30)
    ->get();

$results->total;          // 1337
$results->totalPages;
$results->hasMorePages();
$results->photos->ids();  // ['Dwu85P9SOIk', …]

foreach ($results as $photo) { $photo->id; }

Enums are optional — plain strings work too, which matters when the value comes from a request: ->color($request->string('color')).

Other entry points

Unsplash::photo('Dwu85P9SOIk');                  // Photo
Unsplash::photosByIds([$a, $b, $c]);             // pooled, concurrent
Unsplash::random()->term('car')->count(5)->get();
Unsplash::collection($id);
Unsplash::collectionPhotos($id)->get();
Unsplash::userPhotos('ashim')->get();
Unsplash::stats();

The builder is immutable

Every modifier returns a new instance, so one base request can safely branch:

$base = Unsplash::search('cars')->perPage(30);

$wide = $base->orientation(Orientation::Landscape)->get();
$tall = $base->orientation(Orientation::Portrait)->get();
// $base is untouched, and $wide's orientation never reaches $tall.

In 1.x the facade cached one mutable instance, so search()->term('cats') followed by photos() sent photos?query=cats. That class of bug cannot happen now.

Working with a photo

$photo->url(Size::Regular);                   // exactly what Unsplash returned
$photo->url(width: 1920, quality: 70);       // resized on Unsplash's CDN
$photo->srcset([640, 1280, 1920]);
$photo->aspectRatio();
$photo->alt();
$photo->attribution()->toHtml();
$photo->color; $photo->blurHash; $photo->author->name; $photo->tags;

The five sizes are Raw, Full, Regular, Small and Thumb. Resizing happens on Unsplash's servers by adding query parameters; the package never downloads and re-encodes an image, and every URL keeps its ixid.

Curating

Approving a photo is the moment a person chooses it, which is exactly the event Unsplash asks to be told about. Curating reports it for you.

$asset = Unsplash::curate($photo, pool: 'login-backgrounds');

Unsplash::curateMany($photos, pool: 'hero');
Unsplash::curateCollection('1234567', pool: 'hero');
Unsplash::curate($photo, pool: 'hero', curatedBy: auth()->user());

Curating the same photo twice updates the existing row rather than duplicating it — unsplash_id is unique.

Pools and selection

UnsplashAsset::random('login-backgrounds');        // two queries, no HTTP
UnsplashAsset::cachedRandom('login-backgrounds');  // one query on a cache hit
UnsplashAsset::randomOrFail('login-backgrounds');  // throws when empty
UnsplashAsset::pool('hero')->active()->get();

All of them skip photos whose status is not active, so a photo retired by unsplash:verify stops appearing with no change at the call site. cachedRandom() re-checks the cached photo is still selectable and drops the entry if it is not.

Rendering

<x-unsplash::image :photo="$photo" :sizes="[640, 1280, 1920]" />
<x-unsplash::attribution :asset="$photo" />

Both components render nothing when given null, so a page whose pool is empty loses its image rather than failing.

Attaching photos to your models

use Gabrielesbaiz\UnsplashToolkit\Concerns\HasUnsplashables;

class Article extends Model
{
    use HasUnsplashables;
}

$article->unsplash()->attach($asset);
$article->unsplashPhoto();
Article::with('unsplash')->get();   // no N+1

The trait boots through bootHasUnsplashables(), so a model with its own boot() keeps it. The 1.x trait declared boot() and silently replaced yours.

Building a picker

Two routes back an admin picker, so a client-side field never needs your access key. They live under picker.route_prefix, guarded by picker.middleware.

GET {prefix}/search — query, plus optional page, per_page (max 30), orientation, color:

{
  "total": 132, "total_pages": 6, "page": 1,
  "results": [{
    "id": "Dwu85P9SOIk",
    "thumb": "https://images.unsplash.com/…?ixid=…&w=400",
    "width": 4000, "height": 2500, "aspect_ratio": 1.6,
    "color": "#26260c", "blur_hash": "LFC$yHwc8^$yIAS$%M",
    "author": "…", "author_url": "…utm_source=…&utm_medium=referral",
    "attribution_html": "Photo by …"
  }]
}

POST {prefix}/curate — ids (1–30), optional pool — returns assets[] carrying both the unsplash_id and the primary id a form field attaches to a record.

Testing

$fake = Unsplash::fake();

Unsplash::curate(Unsplash::photo('Dwu85P9SOIk'), 'hero');

expect($fake->sentRequestTo('/download'))->toBeTrue();
expect($fake->requestCount())->toBe(2);

Http::fake() also works throughout, because the driver uses Laravel's HTTP client rather than Guzzle directly. The factory builds registry rows without touching the API: UnsplashAsset::factory()->count(10)->pool('hero')->create().

Eight recipes

// Once, when an editor approves photos:
Unsplash::curate($photo, pool: "login-{$tenant->slug}");

// In a shared helper, so every controller resolves it the same way:
function currentWallpaper(): ?UnsplashAsset
{
    return UnsplashAsset::cachedRandom('login-'.tenant()->slug);
}

<div class="login" style="background-image: url('{{ $wallpaper?->url(width: 1920, quality: 80) }}')">
    <x-unsplash::attribution :asset="$wallpaper" />
</div>

Route::get('wallpaper', function () {
    $wallpaper = UnsplashAsset::cachedRandom('login-backgrounds');

    abort_if($wallpaper === null, 404);

    return redirect()->away($wallpaper->url(width: 1920, quality: 80));
});

const res = await fetch(`/unsplash-toolkit/search?query=${term}&per_page=24`)
const { results } = await res.json()

// Render each tile with its aspect_ratio and color,
// and results[i].attribution_html underneath it.

await fetch('/unsplash-toolkit/curate', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'X-CSRF-TOKEN': token },
  body: JSON.stringify({ ids: selected, pool: 'hero' }),
})

class Article extends Model
{
    use HasUnsplashables;
}

$article->unsplash()->sync([$request->integer('unsplash_asset_id')]);

@if ($photo = $article->unsplashPhoto())
    <x-unsplash::image :photo="$photo" :sizes="[640, 1280, 1920]" />
@endif

Unsplash::curateCollection('1234567', pool: 'hero');

// Or keep it in step, if the collection is maintained continuously:
Schedule::call(fn () => Unsplash::curateCollection('1234567', 'hero'))->daily();

use Gabrielesbaiz\UnsplashToolkit\Jobs\ImportUnsplashPhotoJob;

Bus::batch(
    collect($ids)->map(fn (string $id) => new ImportUnsplashPhotoJob($id, pool: 'hero'))
)->dispatch();

use Gabrielesbaiz\UnsplashToolkit\Events\PoolDepleted;

Event::listen(function (PoolDepleted $event) {
    Notification::route('slack', config('services.slack.editors'))
        ->notify(new PoolRunningLow($event->pool, $event->remaining, $event->minimum));
});

- name: Unsplash guidelines
  run: php artisan unsplash:doctor --strict

All commands

In the scheduler

Because images are hotlinked, a photo removed by its photographer has to be taken out of rotation, and a photographer who renames has to be re-credited correctly.

Schedule::command('unsplash:verify')->daily();
Schedule::command('unsplash:refresh')->weekly();

In CI

- name: Unsplash guidelines
  run: php artisan unsplash:doctor --strict

It fails on a missing app name, an access key that is not set, storage enabled without a recorded permission, photos producing URLs with no ixid, and — under --strict — pools running low.

The backfill

A 1.x installation already holds unsplash_id on every row, which is all that is needed to rebuild it as a registry entry. Nothing you curated is lost.

php artisan unsplash:refresh --backfill --assign-pool=login-backgrounds

Response caching

Every GET is cached by endpoint and parameters. Only JSON metadata is cached — image bytes are never cached or stored, because they are never fetched in the first place.

'cache' => [
    'enabled' => true,
    'store' => null,      // null uses your default store
    'ttl' => 3600,
    'prefix' => 'unsplash',
],

A repeated search costs nothing:

Unsplash::search('cars')->perPage(10)->get();   // one HTTP request
Unsplash::search('cars')->perPage(10)->get();   // served from cache

php artisan unsplash:cache-clear

Concurrent fetches

photosByIds() pools its requests rather than issuing them one after another, in batches of http.concurrency. Ids already in the cache are not re-fetched at all.

$photos = Unsplash::photosByIds($ids);   // one pooled batch, not N round trips

It is built on Laravel's Http::pool(), so a slow photo does not hold up the rest of the batch.

Retries and timeouts

'http' => [
    'timeout' => 10,
    'connect_timeout' => 5,
    'concurrency' => 5,
    'retry' => ['times' => 3, 'sleep' => 250, 'backoff' => true],
],

v1 had no timeout at all, so a hung connection blocked the worker indefinitely.

Rate limiting

A local limiter keeps you inside the budget Unsplash granted, and refuses the request before it is sent rather than discovering the limit remotely.

'rate_limit' => [
    'enabled' => true,
    'key' => 'unsplash-toolkit',
    'max_per_hour' => 50,   // 5000 once approved for production
],

Unsplash::throttle()->used();        // requests spent this window
Unsplash::throttle()->remaining();
Unsplash::throttle()->availableIn();  // seconds until the window resets

$reported = Unsplash::rateLimit();   // what Unsplash said on the last response
$reported?->limit;
$reported?->remaining;
$reported?->isDemo();
$reported?->isExhausted();

php artisan unsplash:status

Exceeding it raises RateLimitExceededException, which carries retryAfter when Unsplash sent the header.

Why rendering is free

The hourly budget is spent when someone curates a photo. Selecting one from a pool reads your own database, so no page view ever touches the API:

$photo = UnsplashAsset::cachedRandom('login-backgrounds');
// one query on a cache hit, zero HTTP requests

If you are hitting the rate limit during normal page rendering, something is calling the API on render — look for Unsplash::random() or Unsplash::photo() in a controller or Blade view.

Common problems

php artisan unsplash:pools

Schedule::command('unsplash:verify')->daily();

The Unsplash facade

PendingRequest

Every modifier returns a new instance, so a base request can be branched safely.

UnsplashAsset

Data objects

All readonly, all implementing Arrayable, ArrayAccess, Jsonable, JsonSerializable and Stringable where it makes sense.

Enums

Events and exceptions

Every exception extends UnsplashException: MissingAccessKeyException, MissingAttributionNameException, HotlinkingRequiredException, RateLimitExceededException, PhotoNotFoundException, PoolDepletedException, DownloadFailedException.

The nine rules

Three more are yours to honour, because no package can check them: do not put "Unsplash" in your application's name or use their logo as your icon; do not sell unaltered Unsplash photos; and do not make users register separately to use the integration.

The doctor command

php artisan unsplash:doctor
php artisan unsplash:doctor --strict   # warnings fail too

  Rule                Status   Detail
  C7 credentials      OK       Access key abcd********op is set server side.
  C5 attribution      OK       utm_source is "Your Application".
  C1 hotlinking       OK       Local storage is disabled, so images are served by Unsplash.
  C4 tracking         OK       All 24 sampled photos keep their ixid when resized.
  C3 download events  OK       All 24 curated photos carry a download location.
  C6 rate limit       OK       Capped at 50 requests per hour.
  Pool health         OK       2 pools checked.

It exits non-zero on a violation, so it can gate a deploy.

The compliance suite

tests/Compliance holds one file per rule. It asserts that hotlink URLs come back unmodified, that ixid survives every resize and srcset entry, that curation pings links.download_location before writing a row, that attribution escapes a malicious author name and carries both UTM parameters, that a rate-limited response is not retried, and that no bulk-harvesting entry point exists.

it('refuses to download image bytes by default', function () {
    Unsplash::fake();

    Unsplash::import(Photo::fromResponse(FakeUnsplash::photoPayload()));
})->throws(HotlinkingRequiredException::class, 'hotlinked image URLs');

Storing image files

Keeping copies is only permissible with written permission from Unsplash. If you have it, both keys are required — enabling the flag alone still throws, so the exception stays auditable.

'compliance' => [
    'allow_local_storage' => true,
    'storage_permission_reference' => 'UNSPLASH-1234',
],

The transfer is then streamed to a temporary file and written with Storage::writeStream(), so a full-resolution photo does not have to fit in memory_limit. File names are derived from the photo id and size, so importing twice overwrites rather than probing the disk for a free name.

The threat model

What the package does about it

• The access key never reaches a browser. It is sent as an Authorization header, never a query parameter, and the picker exists precisely so a client-side field can search without it. An arch test asserts no shipped view references the config key.
• Credentials are redacted from exceptions and logs. An upstream error body that happens to contain your key is scrubbed before it is thrown.
• Author names and links are escaped. Attribution escapes both and adds rel="noopener noreferrer". The 1.x getFullCopyrightLink() interpolated them raw, which was an XSS vector.
• Picker input is validated. Search terms are length-bounded, per_page is capped at 30, and a curate request may name at most 30 ids, so the proxy cannot be used to fan out requests against your API budget.
• The picker routes are authenticated by default. They proxy your API quota; leaving them open would let anyone spend it.
• The registry stores no binary content, so on the hotlinking default there is no upload path and nothing user-supplied is written to a disk.

The trade, stated plainly

Reporting a vulnerability

Please review the project's security policy. Do not open a public issue.

Why the API changed

Three defects in 1.x could not be fixed without breaking the surface:

• Every config read used config('unsplash.*') while the published file was unsplash-toolkit.php, so the access key was always null and the package threw on construction.
• The facade cached one instance whose $query was never reset, so parameters leaked between calls: search()->term('cats') followed by photos() sent photos?query=cats.
• toJson(): array returned a stdClass, and store(): string returned a model. Both raised a TypeError on the documented happy path.

Why storage changed

The guidelines state that all API uses must hotlink the URLs returned under photo.urls. store() copied the bytes to your disk and served them from there, which is the opposite. v2 hotlinks by default and keeps a curated registry instead: you still decide exactly which photos appear, but Unsplash serves them.

Step by step

1 · Update the config

Delete any hand-made config/unsplash.php you created to work around the key mismatch, then publish the real file:

php artisan vendor:publish --tag=unsplash-toolkit-config --force

2 · Run the migrations

php artisan vendor:publish --tag=unsplash-toolkit-migrations
php artisan migrate

upgrade_unsplash_tables_to_v2 is additive. It adds the registry columns, gives unsplashables the primary key and indexes it shipped without, and renames the non-idiomatic unsplashables_id / unsplashables_type columns to unsplashable_id / unsplashable_type.

3 · Backfill the registry

php artisan unsplash:refresh --backfill --assign-pool=default

4 · Update your calls

5 · Serve hotlinked images

- return redirect()->away(Storage::disk('wallpapers')->url($wallpaper->name));
+ return redirect()->away($wallpaper->url(width: 1920, quality: 80));

6 · Schedule the health checks

Schedule::command('unsplash:verify')->daily();
Schedule::command('unsplash:refresh')->weekly();

7 · Check your work

php artisan unsplash:doctor

2.0.4 — 2026-09-28

Fixed

• Throttle::used() and Throttle::availableIn() are typed int, but RateLimiter hands back whatever the cache store holds and Redis holds strings. An application on the redis driver hit a TypeError where one on the array driver saw an int. The same value also reached RateLimitExceededException, whose retryAfter is typed int, so the throttle raised a TypeError instead of the rate limit exception exactly when the budget ran out.

2.0.3 — 2026-09-28

Fixed

Four defects in the 1.x upgrade migration, all found by running it against a real 1.x installation. The path is now covered by tests/Feature/UpgradeMigrationTest.php.

• v1 stored the photographer in author; v2 reads author_name. The column was never mapped, so upgraded rows credited nobody and attribution() fataled.
• v1's name and author columns are NOT NULL and v2 writes neither, so every insert after the upgrade failed. They are now made nullable.
• The pivot's primary key was detected by looking for a column called id. An installation that had added its own corrective key under another name got a second auto-increment, which the database rejects. Any primary key now counts.
• SQLite cannot add a primary key to an existing table, so the pivot is rebuilt and its rows copied there instead.
• attribution() no longer fatals on a row that has not been backfilled yet.

2.0.2 — 2026-09-28

Fixed

• Declared the HTTP dependencies the package actually uses. It builds on Illuminate\Http\Client but required only illuminate/contracts, so on a lowest-version resolution guzzlehttp/promises 1.x was installed, whose untyped wait() is incompatible with Laravel 12's LazyPromise and fataled on any Http::pool() call. guzzlehttp/guzzle, illuminate/http and illuminate/support are now required explicitly.

2.0.1 — 2026-09-28

Fixed

• Declared Laravel 11 as the minimum. UnsplashAsset defines its casts through the casts() method, which Laravel 10 does not call, so on Laravel 10 the enum, array and date casts were silently ignored. Laravel 10 reached end of life in February 2026.
• Annotated the Blade components' view names as view-string, so PHPStan passes on a clean dependency resolution.
• Removed the Laravel 10 jobs from the test matrix: pestphp/pest-plugin-laravel ^3 requires Laravel 11, so those jobs could never resolve.

2.0.0 — 2026-09-28

A rewrite. See Upgrading from 1.x for the migration path.

Fixed

• The package could not run at all: every config read used config('unsplash.*') while the published file was unsplash-toolkit.php, so the access key was always null and the constructor threw on every instantiation.
• toJson(): array returned a stdClass because json_decode was called without true, raising a TypeError on the documented happy path.
• store(): string returned an UnsplashAsset when store_in_database was on.
• Query parameters leaked between calls, because the facade cached one instance whose $query was never reset.
• HasUnsplashables::boot() overrode the host model's own boot(); it is now bootHasUnsplashables().
• getFullCopyrightLink() interpolated third-party author names and links into HTML unescaped.
• UnsplashAsset::assets(Model $model) was a relation method taking an argument, so it could not be eager-loaded.
• The unsplashables table shipped with no primary key and no indexes.
• unsplash_id was typed uuid, which fails outright on PostgreSQL; Unsplash ids are short base62 strings.
• The php constraint ^7.3,^8.0|^8.1|… was an empty set.

Added

• Curated pools: approve photos into named sets and select from your own database, with no API calls at render time.
• Readonly DTOs (Photo, Author, SearchResult, Attribution, RateLimit) and enums (Size, Orientation, Color, OrderBy, AssetStatus).
• Response caching, retries with exponential backoff, timeouts, rate-limit handling and concurrent batch fetches.
• <x-unsplash::image> and <x-unsplash::attribution> Blade components.
• A picker proxy route that keeps the access key server side, returning layout metadata (aspect ratio, dominant colour, blurhash) and pre-tagged attribution so a client-side field can credit photographers correctly, plus the primary keys a form field attaches to a record.
• Commands: search, curate, pools, verify, refresh, status, doctor, cache-clear, prune.
• Unsplash::fake() and a compliance test suite covering each guideline.

Changed

• Images are hotlinked by default, as the Unsplash API Guidelines require. Downloading bytes to a local disk is now gated behind explicit permission.
• Download events use photo.links.download_location rather than a hand-built URL, so the ixid is no longer dropped.
• Attribution requires an application name; a missing or placeholder value throws rather than emitting a credit that does not qualify.
• The facade is now Facades\Unsplash, and the trait moved to Concerns\HasUnsplashables.
• Laravel's HTTP client replaces raw Guzzle, so Http::fake() works in tests.

1.0.0 — 2025-03-04

Initial release. Forked from marksitko/laravel-unsplash.

Contributing

Pull requests are welcome. A change is ready when three commands pass — they are the contract, and CI runs all three on every push.

composer test      # pest
composer analyse   # phpstan level 6
composer format    # pint

If a change touches behaviour the Unsplash API Guidelines govern, it needs a test in tests/Compliance named after the rule. That directory is what keeps the rules from rotting, so a change that weakens it will be asked for a test rather than merged.

Running the suite

git clone https://github.com/gabrielesbaiz/unsplash-toolkit
cd unsplash-toolkit
composer install
composer test

The suite runs against SQLite in memory and never touches the network: every test drives either Unsplash::fake() or Http::fake(). No API key is required to run it.

GitHub Actions runs the tests across PHP 8.2–8.4 and Laravel 11–12, plus PHPStan and Pint, on every push.

Credits

Written and maintained by Gabriele Sbaiz, with thanks to everyone who has contributed.

The 1.x line was forked from marksitko/laravel-unsplash by Mark Sitko. 2.0 is a rewrite, but the idea of a fluent Unsplash client for Laravel started there.

It stands on work this package does not contain: Laravel, and spatie/laravel-package-tools. Photos come from the photographers on Unsplash, who make them available for free.

Disclaimer

Licence

MIT, in full:

The MIT License (MIT)

Copyright (c) Gabriele Sbaiz <gabriele@sbaiz.com>

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

The MIT licence's warranty disclaimer and limitation of liability apply in full, alongside the disclaimer above.