Browser Sessions Laravel Package

Product Decisions This Supports

• "Active devices / sessions" account security feature — lets users see where they're signed in and revoke other sessions; typically shipped as a trust-and-safety or account-settings capability rather than a core differentiator.
• Build vs. buy for session management — the alternative is hand-rolling session enumeration and invalidation on top of Laravel's session driver and sessions table. This package is a thin, opinionated wrapper, so the buy decision is cheap in effort and low in lock-in.
• Roadmap sequencing for security/compliance work — useful when a SOC 2 / ISO 27001 questionnaire, enterprise security review, or penetration test flags "no visibility into concurrent sessions" as a gap. It converts a finding into a small, bounded ticket instead of a quarter-long project.
• Upgrade budgeting for Laravel 13 — v2.0.0 is a hard major bump tied to a framework major. If your roadmap includes a Laravel 13 migration in the next 2–3 quarters, this package must be on the upgrade checklist; if you're staying on Laravel 10/11, this release is a frozen dependency, not an upgrade.
• Not a substitute for SSO enforcement, MFA, or a full IAM/IdP product — do not let this package's presence satisfy an enterprise auth requirement on its own.

When to Consider This Package

Adopt when most of the following hold:

• The application is on Laravel 12 or 13 — v2.0.0 explicitly drops Laravel 10 and 11, which are EOL. On 10/11 you must stay pinned to the 1.x line (and accept it is unmaintained going forward).
• You need a user-facing "sessions/devices" screen for a consumer or B2B SaaS account settings page, and you want it in days, not a sprint.
• Sessions are stored in a database or cache driver the package can enumerate — not a stateless-only setup where session listing is meaningless.
• You want Laravel-native ergonomics (Eloquent models, Blade/Livewire-friendly, migrations included) rather than integrating a third-party device-management API.
• Your team is small and would otherwise defer the feature indefinitely.

Look elsewhere when:

• You need device fingerprinting, geo-IP, anomaly detection, or step-up auth on new devices — that is a different product category (IdP or fraud/risk vendor).
• You require vendor-backed SLAs or long-term support. This is a single-maintainer open-source package; the release history is dominated by Dependabot bumps plus occasional framework-support commits. That is fine for a nice-to-have, risky for a compliance-critical control.
• You're on Laravel 10/11 with no near-term upgrade path — you'd be adopting a dead-end version.
• Your auth is fully delegated to an external IdP (Auth0, Okta, Cognito), where the IdP already owns session revocation UX.

How to Pitch It (Stakeholders)

To executives: This is a small, low-cost open-source add-on that gives customers a "your active sessions" screen — the familiar "log out of other devices" control. It closes a recurring item on security questionnaires and pentest reports at roughly the cost of a single feature ticket, with no licensing fees. The v2.0.0 release adds Laravel 13 support and drops Laravel 10/11; it is a breaking major version, so it is only actionable in tandem with a framework upgrade.

To engineering: v2.0.0 is a breaking release gated on Laravel 13. It adds Laravel 13 support and removes Laravel 10 and 11 (both EOL). Practically:

• Pin to ^1.3 until the Laravel 13 upgrade lands; sequence the bump with the framework migration, not before.
• Budget a short compatibility check rather than a rewrite — the public surface is a session model plus revocation helpers.
• The changelog for this major contains no new features or API redesigns, only CI/tooling bumps and the framework-support matrix change. Treat it as a maintenance release with a hard floor, not a source of new capability.
• Risk flag for the record: the project is effectively single-maintainer and its activity is mostly automated dependency updates. Acceptable for an account-settings nicety; not acceptable to represent as sole evidence of session-security controls in an enterprise security review. Pair it with explicit session lifetime, secure cookie, and re-authentication policy work.