Weave Code
Cms Laravel Package
craftcms/cms
Craft CMS is a flexible, self-hosted PHP content management system for building custom digital experiences. It offers an intuitive control panel, Twig templating, an auto-generated GraphQL API, built-in ecommerce, and a robust plugin ecosystem.
Build bespoke content experiences with Craft.
Frequently asked questions about Cms
- Can I install craftcms/cms with composer require inside an existing Laravel application?
- No. craftcms/cms is a self-hosted application built on Yii2, not a Laravel package, so it is installed as its own project with composer create-project craftcms/cms. That gives Craft its own composer.json, vendor tree, database and deploy pipeline. Requiring it into an existing Laravel app would put two framework bootstraps in one process, which is not a supported configuration.
- How do I connect Craft CMS to Laravel as a headless GraphQL API?
- Craft auto-generates a GraphQL API from your content model, and that is the preferred integration path. Run Craft as a standalone content service, issue a token scoped to a public schema, and query entries from Laravel with any GraphQL client. The Element API plugin is the fallback when you need REST-shaped responses instead. Keep the flow read-only unless you have a specific write-back requirement.
- Does Craft CMS require Laravel, and which PHP and database versions does it support?
- Craft does not depend on Laravel at all; it boots Yii2 and owns its own request lifecycle. It requires PHP 8.2+, Composer 2, MySQL 8 or PostgreSQL 13+, and in practice Redis for cache and sessions plus a supervised queue worker. Laravel has roughly the same PHP floor, so a single base image family is practical even though the vendor trees stay separate.
- Is Craft CMS free, and how does licensing work for a commercial project?
- Craft is source-available under the Craft License rather than a conventional OSS license, which is why Composer metadata reports NOASSERTION. Solo is free, Pro is paid per project, and a domain that does not match the license visibly blocks the control panel. Confirm the tier with procurement before the architecture is locked, and track who owns the domains tied to the license.
- Why is Craft CMS built on Yii2, and what does that mean for a Laravel-only team?
- Craft's runtime, migrations, queue and ORM idioms are all Yii2, so your team inherits a second framework's mental model, upgrade cadence and hiring profile. Plan for Craft majors, the 4 to 5 class of upgrade, as real projects rather than patch releases, because content-model migrations across majors are the dominant long-term cost. It is a manageable cost, but it is neither zero nor covered by Laravel experience.
- How should I deploy Craft CMS alongside a Laravel app, including Redis and queue workers?
- Treat them as two deployables: separate vendor trees, separate build pipelines, separate databases, and a reverse proxy routing content routes to Craft and authenticated product routes to Laravel. Share Redis for cache and sessions and use a common asset or CDN origin so editors and users see consistent state. Craft needs a supervised queue worker, otherwise image transforms, resaves and other jobs fail silently.
- How do I share authentication between Laravel and Craft CMS using SSO?
- Craft insists on owning its own users, so shared identity means SSO rather than a shared session table. The two common patterns are a small Craft plugin that authenticates against Laravel as the identity provider, or an OIDC or SAML provider that both applications trust. Control panel sessions and Laravel application sessions remain separate, which is usually fine but should be an explicit decision.
- Can Laravel write content back into Craft CMS, such as entries, drafts and users?
- Yes, but it is constrained. Craft's GraphQL mutations and the Element API cover common cases, and a purpose-built Craft plugin gives you full control over the rest. Writing entries, drafts or users from Laravel adds permission, validation and auth complexity on both sides. Decide early whether the integration is strictly read-only, because that choice drives most of the architecture.
- How serious are the security advisories in Craft CMS and what patch process do I need?
- Treat Craft as an application you must patch on a schedule rather than a set-and-forget dependency. The 5.9.0 changelog includes a moderate SSTI via the Twig create() function and a high-severity IDOR in the GraphQL @parseRefs and @transform directives. Agree a patch SLA and a staged upgrade process before launch, and watch how many commercial plugins sit in your critical path.
- What are the alternatives to Craft CMS for a Laravel team, such as Statamic?
- If your team wants content modeling inside Laravel itself, Statamic is the closest Laravel-native comparison, with flat-file or database content and its own templating layer. Craft wins when you need a mature editorial control panel, flexible Matrix-style field modeling and a first-party GraphQL API for decoupled delivery. Weigh the cost of running a second framework against the editorial features you would otherwise have to build.
Weaver
How can I help you explore Laravel packages today?