Weave Code
Decoy Laravel Package
bkwld/decoy
Decoy is a Laravel package for building custom admin interfaces and CMSs. It provides model-driven admin controllers, form and listing builders, localization, and a clean Vue-powered UI, so you can manage content without a separate CMS.
A Laravel model-based CMS
Frequently asked questions about Decoy
- Which Laravel and PHP versions does bkwld/decoy support?
- Decoy's last release was July 2018, so its practical target is Laravel 5.4 through 5.8 on PHP 7.1 to 7.3 with MySQL, Twig 1.x or 2.x, and GD or Imagick for image processing. Anything on Laravel 9+ or PHP 8.1+ should be treated as out of scope unless a fork is funded. Confirm the exact matrix against the package's composer.json and a proof-of-concept spike rather than inferring it from the README.
- How do I install bkwld/decoy with Composer?
- On a compatible legacy application you run composer require bkwld/decoy and follow the package's publish and configuration steps. On anything newer than Laravel 5.x you will almost certainly need to fork the package, vendor it under an internal namespace, and point Composer at that path repository. Expect dependency resolution failures from TwigBridge, Croppa, and other 2018-era dependencies before you even reach Decoy's own code.
- Is bkwld/decoy still maintained?
- No. There have been no releases in roughly seven years, it comes from a single originating agency, sits at around 300 GitHub stars, and has no security advisory channel. That means any CVE in Twig or the image stack is yours to patch yourself. If you adopt Decoy, budget explicitly for a fork and for someone to own it.
- What kind of projects is Decoy a good fit for?
- Decoy fits best as an internal, editor-facing CRUD back office over Eloquent models, where the team accepts its conventions end to end. It is an opinionated CMS framework rather than a composable library: it owns admin routing, views, and the schema assumptions it derives from your models. It is a poor fit inside an existing application that already has its own admin shell, design system, or API-first front end.
- How do you define content types and admin controllers in Decoy?
- Content types are defined as Eloquent models, and admin controllers extend Decoy\BaseController with Decoy's own routing conventions. The package's form and listing builders generate the admin UI, while slug, position, and nesting behaviors are handled for you. Admin views are rendered with Twig through TwigBridge rather than Blade, which is the biggest departure from typical Laravel codebases.
- Does Decoy work with Laravel 10, Laravel 11, or PHP 8.1+?
- Not without a fork. Decoy's final release predates Laravel 6's semantic-versioning shift and PHP 8, and its dependency tree of TwigBridge, Croppa, and sluggable/nestable-era helpers is the real constraint. Forcing the install typically produces dependency resolution failures during composer update, and runtime breaks even if you get past them. Treat Laravel 9+ and PHP 8.1+ as unsupported unless you fund and maintain the upgrade.
- Can I upgrade or fork Decoy to run on a modern Laravel stack?
- Yes, but do it in steps. Start with PHP 7.4 to 8.x while wrapping characterization tests around the existing admin CRUD, then move Laravel 6, 7, 8, and 9 incrementally. Replace TwigBridge and Croppa with maintained equivalents such as Blade or Twig 3 and Glide or Intervention rather than patching them. Where the surrounding app is already modern, a strangle pattern works well: leave Decoy serving the existing editorial workflow against the shared database and build new admin surfaces beside it, migrating content types one at a time.
- Does Decoy support localization, nested content, and image derivatives?
- Yes. Decoy ships localization hooks, ordered and nested collection behaviors, and a Croppa-based image pipeline that works with GD or Imagick and local or S3-backed filesystems. Those features are a large part of what justifies the framework, so only adopt Decoy if you actually need them. Be aware that nested-set ordering and image processing are exactly where hidden failure modes surface once production traffic or content volume arrives.
- What are the security and compliance risks of adopting Decoy?
- Two independent risks stack up. First, Decoy itself is abandoned with no advisory channel, so Twig or image-stack CVEs are yours to track and fix. Second, the Laravel and PHP versions it targets are out of security support, which is a compliance finding in most regulated environments regardless of Decoy's own code. Run composer audit and an SCA scan on the full dependency tree before any exposure, and get explicit sign-off on EOL platforms.
- What are the alternatives to Decoy for a Laravel admin or CMS?
- Teams evaluating Decoy today usually compare it against maintained packages such as Laravel Nova, Filament, or Backpack, or they build a smaller Blade or Livewire back office tailored to their models. The important difference is exit cost: Decoy owns admin routing and views, so removing it means rewriting the admin layer rather than swapping a component. If you adopt it on a legacy estate, plan the replacement path up front, because upstream is not coming back.
Weaver
How can I help you explore Laravel packages today?