adamcmoore/nova-gmap
A Laravel Nova field that embeds Google Maps for selecting and storing location coordinates. Add it to Nova resources to capture latitude and longitude with a configurable map, marker, and Google Maps API key.
Evidence gap (read first). The v3.0 release notes payload is empty and no repository artifacts were supplied — no composer.json, changelog, upgrade guide, or prior assessment exists. This evaluation is therefore provisional: it describes how a TPM should reason about a Laravel/PHP package at a major-version boundary, and it flags every claim that must be re-validated once the actual artifacts are attached. The empty release note is itself a signal worth recording about upstream release discipline.
Architecture fit. Laravel packages sit on a spectrum. At the low end, a library-only package (helpers, DTOs, an API client) couples us to almost nothing. At the high end, a package that registers service providers, publishes migrations, binds container singletons, ships middleware, or schedules jobs becomes entangled with the framework lifecycle — and therefore with our Laravel upgrade cadence and our ability to test in isolation. The single most important architectural question is which end of that spectrum this package occupies. If it owns schema, assume it is a long-lived commitment, not a dependency.
Integration feasibility. Installation is typically trivial — composer require, provider auto-discovery, optional vendor:publish. Feasibility risk is rarely "can we install it" and almost always "does its default behaviour match our assumptions." That risk concentrates in config defaults, migration side effects, and global middleware/listeners.
Technical risk. A 3.0 designation is a declared breaking change regardless of what the notes say. Until an upgrade guide is produced, the TPM should assume every public surface changed: config keys, published assets, method signatures, minimum PHP/Laravel versions, and dropped deprecations. Secondary risks: single-maintainer concentration, unclear security disclosure process, and whether v2 continues to receive security backports while we plan the move.
Key questions to answer before approval.
UPGRADING.md, and how many entries does it have?Stack fit. Assume a conventional Laravel application with Composer-managed dependencies and CI. The gating check is whether the package's composer.json constraints intersect cleanly with our pinned PHP and Laravel versions. A constraint conflict on illuminate/support is the most common early failure and is cheap to discover.
Migration path. Do not upgrade in place on a shared branch. Pin the current major, cut an isolated upgrade branch, run composer update <package> --with-dependencies, and read the lockfile diff — transitive churn often dwarfs the package change. Then run the full test suite plus any contract tests that exercise the package's integration points. If the blast radius is non-trivial, gate the new version behind a feature flag or a canary deploy rather than a big-bang release.
Compatibility. Verify against each database engine we actually run (including SQLite for the test suite), the queue driver, and any PHP extensions the package requires. Confirm behaviour under both APP_DEBUG settings and with config caching enabled — Laravel packages that read env() outside config files break under config:cache, and this is a classic v3 surprise.
Sequencing.
composer.lock restore).Deliberately do not schedule this alongside another major framework or PHP upgrade — compounding breaking changes makes attribution impossible when something breaks.
Maintenance. A major-version-boundary release implies an ongoing upgrade tax. Name an internal owner for this dependency, and record the expected cadence (how often has upstream shipped majors historically?). Unowned third-party packages are the ones that silently rot.
Support. Establish upstream responsiveness — median time to first response on issues, whether security advisories are published, and whether v2 gets security-only backports with a stated EOL date. If the answer is "no stated policy," budget for a fork-or-replace contingency.
Scaling. Runtime impact appears only if the package adds middleware, event listeners, or per-request queries. Watch for N+1s introduced by eager-loading helpers and for queue throughput if it dispatches jobs. Ask for a rough request-path cost before it ships to high-traffic services.
Failure modes to plan for. Silent config-default changes after upgrade; published-migration drift between environments; container binding collisions with in-house providers; auto-discovery registering a provider we did not expect (and cannot easily disable); deprecation warnings flooding logs and masking real errors. Each of these is cheap to detect in staging and expensive in production.
Ramp-up. Engineers need a working example, not just an API reference. With empty release notes, onboarding cost is currently unbounded — a new team member has no way to know what changed or why. Until documentation exists, treat knowledge as concentrated in one or two people, which is a bus-factor risk independent of the code's quality.
Recommendation pending evidence: hold at the current major, request the v3.0 upgrade guide and changelog from the maintainer, and re-run this assessment once artifacts are available. Do not adopt v3.0 on the strength of a version number alone.
How can I help you explore Laravel packages today?