Admin Auth Laravel Package

Product Decisions This Supports

• Build vs. buy for per-user localization: This package still handles a narrow, common need—applying an authenticated user’s stored language preference to the application locale on each request—so adopting it avoids writing and maintaining custom middleware. What changes in 2.1.0 is the cost side of that equation: the package now requires spatie/laravel-permission ^8.3, so “buy” also means accepting an authorization-library dependency and its upgrade path.
• Upgrade sequencing and release risk: 2.1.0 contains no code changes of its own, but it forces an app that pins spatie/laravel-permission ^7 to upgrade that package too. Treat this as a platform-level dependency bump triggered by a small locale package, and schedule it deliberately rather than letting it ride along with an unrelated release.
• Feature compatibility decisions (carried forward from 2.0.4): The middleware safely handles enum-cast language attributes instead of passing a non-string value into setLocale(). If your User model uses Laravel enum casts for language, that integration blocker is already removed.
• Contract-implementation audit: If your app implements the Role / Permission contracts itself, the permission v8 upgrade requires findByName() / findOrCreate() to accept BackedEnum|string. This is the one place where the upgrade can require first-party code changes—worth scoping before commit.
• Vendor footprint / packaging considerations: Distribution archives no longer ship tests, Docker, and QA config, which is operationally cleaner for production deployments. However, the new hard runtime dependency on spatie/laravel-permission measurably widens the transitive footprint of adopting this package.
• Maintenance confidence: The release shows active maintenance—dev-environment updates (MariaDB 12.3, Testbench), CI test coverage output, phpmd 3, AGENTS.md/CLAUDE.md documentation, and internal housekeeping dropping a stale phpmd.xml .gitattributes entry. These are signals of healthy stewardship, not product features.

When to Consider This Package

Consider adoption when:

• You are building a Laravel application where each user has a persisted language preference on the user record.
• You want locale applied automatically per request without custom middleware.
• Your user model may use enum casts for the language attribute.
• You want a small, focused dependency rather than a full localization platform.
• Your app is already on, or is ready to move to, spatie/laravel-permission ^8.3—or you are willing to make that upgrade part of this adoption.

Look elsewhere when:

• You need URL-based locale routing, geo-IP negotiation, or complex fallback language logic.
• You need translation content management, editorial workflows, or translation service integrations.
• Your application does not store per-user language preferences, or locale is determined globally.
• You require a package that owns the entire internationalization stack rather than only request-level locale application.
• You are pinned to spatie/laravel-permission ^7 and cannot take the v8 upgrade in this release window; 2.1.0 will block you until you can.
• You do not use spatie/laravel-permission at all—pulling in an authorization library solely to switch locale is disproportionate, and a short custom middleware is the better trade.
• You implement the Role / Permission contracts in first-party code and cannot yet absorb the BackedEnum|string signature change.

How to Pitch It (Stakeholders)

For executives: This remains a small, low-risk piece of functionality—automating each user’s preferred language—and the underlying package is actively maintained. The 2.1.0 release adds no new features and no breaking changes to this package’s own code, but it does require a major upgrade of a widely used authorization library. That upgrade is the real work item, so it should be scheduled and resourced rather than treated as a routine patch. Recommendation: proceed, but sequence it alongside the permission-library upgrade and confirm no custom authorization contracts are affected.

For engineering: 2.1.0 bumps spatie/laravel-permission from ^7.4 to ^8.3 with no code changes in this package; the only first-party risk is custom Role / Permission contract implementations, which must accept BackedEnum|string in findByName() / findOrCreate(). Verify the app’s permission pin and run the authz test suite as part of the bump. Distribution archives are slim, dev/CI setup is current, and the 2.0.4 enum-cast fix for language attributes still stands. No migrations are indicated. If the permission upgrade can’t land now, defer this package version—2.0.4 remains functionally equivalent for locale handling.