Filament Dependency Manager Laravel Package

Product Decisions This Supports

• Roadmap & tech-debt prioritization: Surfaces outdated Composer and NPM dependencies inside the Filament v3 admin panel, turning dependency drift into a visible, recurring signal rather than a periodic audit. Useful input when deciding whether the next cycle is feature work or platform hygiene.
• Build vs. buy: Replaces a custom "dependency health" admin page. With v3.1.0 the buy case gets stronger — Bun support removes the main reason a JS-modern team would have to fork or extend it.
• Toolchain coverage decisions: DEPENDENCY_MANAGER_NPM_CLIENT=bun means teams standardizing on Bun (or migrating npm→Bun) don't need a parallel solution. The bunx npm outdated --json bridge with a native-table fallback shows the maintainer is absorbing ecosystem churn rather than pushing it onto adopters.
• Release-gating and risk triage: The devDependencies vs. dependencies fix (now resolved from package.json) lets you separate production drift from dev-only noise — the difference between "block the release" and "note for later." The stdout-noise tolerance in JSON parsing reduces false-positive pages, which matters if anyone ever wires this into alerting.
• Vendor/supply-chain review: Pinned GitHub Actions SHAs plus Dependabot cooldown (7d default, 14d major) and the added composer ecosystem are concrete answers to internal security questionnaires. This is the kind of hardening that shortens procurement review for an internal tool.
• Use cases: agencies operating many Laravel+Filament apps (one dashboard per client), platform teams wanting a non-engineer-readable dependency view, and internal-tool squads without dedicated CI dependency automation.

When to Consider This Package

Adopt when most of these hold:

• The app runs Laravel with Filament v3 (3.x branch — this release does not cover Filament v4).
• You manage dependencies with Composer and/or npm/Bun, and want visibility without standing up new infrastructure.
• The runtime host can execute composer, npm, bun, or bunx — the plugin shells out to package managers, so container/host permissions and network egress to registries are prerequisites.
• Your audience is trusted admins. Dependency versions and package names are mild but real reconnaissance surface; keep the page behind authorization.
• You accept this as read-only visibility, not enforcement. It complements, and does not replace, Dependabot/Renovate for actual upgrade PRs.

Look elsewhere when:

• You're on Filament v4 or not on Filament at all.
• Hosting is restricted (shared hosting, hardened containers) where package manager binaries aren't available — the plugin's core value collapses.
• You rely on private registries or proxied package managers requiring custom auth; verify the shelled-out client inherits credentials before committing.
• You need automated remediation (upgrade PRs, merge policies) rather than a dashboard.
• You need runtime vulnerability/CVE scanning — outdated ≠ vulnerable, and this isn't a security scanner.

How to Pitch It (Stakeholders)

Executives: A small, low-maintenance addition that makes technical debt visible on a schedule instead of during a crisis. It's a dashboard, not a new process — no CI changes, no new headcount, no vendor contract. The v3.1.0 hardening signals an actively maintained dependency, which lowers the risk of it becoming the next thing we have to replace.

Engineering: Drop-in Filament page over existing Composer/npm/Bun projects. This release closes the most-requested gap (Bun) and fixes two accuracy problems that caused bad signal — dependency type now read from package.json, and JSON parsing now tolerates non-JSON preamble on stdout. Copy-command actions emit the right install syntax per client (bun add <pkg>@<version>). Costs: it executes package manager binaries from the app host, so it needs egress to registries and a container image that includes the clients; and it's read-only, so keep Renovate/Dependabot as the enforcement layer.

Security & compliance: Actions are pinned to full commit SHAs with Dependabot maintaining them, and a cooldown window (7d default / 14d major) reduces exposure to freshly compromised releases — the pattern reviewers now expect post- supply-chain incidents. The composer ecosystem was added to Dependabot coverage. Residual risk is the subprocess execution and registry egress: scope the route to admin roles, and confirm credential handling for private registries before rollout.

Recommendation: Approve for a time-boxed pilot on one internal Filament v3 app. Success criteria: page renders accurate prod/dev split, no false positives over two weeks, and Bun/npm command suggestions are correct for the team's client. Revisit at Filament v4 migration.