daljo25/filament-dependency-manager
A Filament plugin for managing dependencies between records. It helps you define, attach, and organize dependency relationships directly in your admin panel, making dependency-aware workflows and linked data easier to handle without custom code. Built for Laravel and Filament. Simple to add to exist...
This is a Filament v3 plugin (branch 3.x) that surfaces outdated Composer and NPM dependencies inside your admin panel and gives you a copy-ready update command. Minimum path to value:
composer require the package, then register the plugin in your panel provider (->plugin(...)).php artisan vendor:publish --tag="...-config" — this is the single most important file to read first. It defines which managers are enabled, the Composer/NPM client binaries, and timeouts.DEPENDENCY_MANAGER_NPM_CLIENT if you are not on npm. As of v3.1.0 the accepted value now includes bun, alongside the existing npm/yarn/pnpm options.First concrete use case: run it after a composer update / lockfile bump to confirm nothing drifted, and use the copy action to paste exact composer require pkg:^x / npm install pkg@x strings into a terminal rather than hand-editing manifests.
If you are on Bun, verify the setup before trusting the output: the plugin runs bunx npm outdated --json under the hood because bun outdated has no JSON mode. bunx and an npm binary must both be resolvable on the PHP process's PATH, which is often not your interactive shell's PATH under FPM/Octane/queue workers.
Environment-scoped NPM client. Set the client in .env per environment (DEPENDENCY_MANAGER_NPM_CLIENT=bun in dev, npm in CI or on a build box) rather than hardcoding in config. This keeps local dev aligned with whatever lockfile you actually commit, and lets staging/CI use a binary that is guaranteed present.
Read dependency type from package.json. v3.1.0 fixes dependencies-vs-devDependencies resolution by reading package.json. In practice: group/label by type in your UI expectations, and when you copy an update command, double-check the flag. A dev-only package updated with a plain npm install pkg@x will silently promote it into dependencies. For Bun the copy action emits bun add <pkg>@<version>, which has the same hazard — bun add -d is what you want for a devDependency.
Treat the copy action as a review step, not an execution step. Nothing here writes your manifest or runs installs. Use it as a reviewable diff: copy, paste, inspect the resulting composer.json/package.json change, then commit. This is the safe pattern and it also means the plugin never needs shell execution privileges for mutating commands.
Composer and NPM managers in parallel. Both managers are queried independently. If your CI or a custom health page consumes this, check that one manager failing (missing binary, network timeout) degrades to an empty/errored section rather than blowing up the whole page.
Bun's dual-path resolution. Since the JSON path shells out to bunx npm outdated --json, the parser first tries structured JSON, then falls back to scraping the native bun outdated table. If you see partial or oddly-formatted results under Bun, that is a signal the JSON path failed and you are on the table parser — check bunx/npm availability first, not the parser.
Security/dependency hygiene as a pattern. The release pins all GitHub Actions to full commit SHAs and configures Dependabot cooldown (7d default, 14d major, 7d minor, 3d patch) plus the composer ecosystem. If you fork or vendor this, keep the SHA pinning and cooldown — a 3-day patch cooldown is a cheap buffer against a compromised publish, and the composer ecosystem entry is what keeps the PHP side from going stale.
Version pinning discipline. Because this is the 3.x branch for Filament v3, constrain the constraint (^3.1) and check the major before ever jumping to a Filament v4-compatible line. Don't let a composer update drag you across major boundaries silently.
bun outdated has no --json. This is the core reason the plugin shells out through bunx npm outdated. It is not a bug; it is the only structured path. Consequence: your Bun box needs a working npm too, which surprises people who deliberately removed Node/npm.bun outdated table is parsed textually. Column widths, ANSI colour codes, or a Bun release changing headers can break it. If output goes empty after a Bun upgrade, suspect the parser before your manifest.bunx is a download vector. bunx npm ... can fetch npm if it isn't installed. In air-gapped or hardened environments that will fail or hang. Pin an explicit npm on the box or avoid Bun mode there.config:cache will freeze your client setting. DEPENDENCY_MANAGER_NPM_CLIENT read through config() won't reflect an .env edit until you re-run php artisan config:clear. Classic cause of "I switched to bun and nothing changed."PATH differs by SAPI. PHP-FPM, Octane workers, and queue consumers frequently have a minimal PATH lacking ~/.bun/bin, nvm shims, or Volta. Prefer absolute binary paths in config if the panel works in php artisan serve but not behind nginx.dependencies vs devDependencies), not command generation. Always append -d/--dev manually for dev packages when copying; Bun's bun add and npm's npm install both default to production deps.3.x means no upgrade path guarantees for v4. Pin the constraint and re-assess on your Filament major bump.How can I help you explore Laravel packages today?