Statamic Admin Bar Laravel Package

Getting Started

This is a pre-1.0 patch (v0.3.2) with no breaking changes — treat it as a low-risk upgrade you can take immediately, then spend your real time on the two things it actually touches: the published asset pipeline and dependency hygiene.

Minimal steps:

1. Update the constraint and install:

   composer update vendor/package --with-dependencies
   npm install
   

2. Republish assets — this release fixes a font URL that pointed at /build/assets, so stale published copies will keep the bug:

   php artisan vendor:publish --tag=<package>-assets --force
   php artisan optimize:clear
   

3. Hard-refresh the admin bar (or load with DevTools open) and confirm Familjen Grotesk resolves from public/vendor/<package>/... rather than /build/assets/.... That single 404 is the bug this release exists to fix.

Where to look first: the package's published asset directory (public/vendor/<package>/ or resources/vendor/<package>/), then config/<package>.php for an asset/base-path override, then the admin bar CSS/Blade partial that references the font. The release notes call out the published addon path explicitly — that's the contract to verify.

First use case: render a page with the admin bar enabled as a logged-in admin, watch the Network tab for the font request, and confirm it 200s from the vendor path. If you were previously patching this URL by hand in CSS, delete that workaround.

Implementation Patterns

Pin and verify on upgrade. v0.3.2 is a maintenance release, but pre-1.0 means minor bumps can still move. Use a caret constraint and run your asset build + a smoke test of the admin bar in the same PR:

composer update --with-dependencies && npm ci && npm run build && php artisan test

Treat published assets as build artifacts. Since the font URL is baked into published files, add republishing to your deploy script rather than relying on developers to remember it:

php artisan vendor:publish --tag=<package>-assets --force
php artisan optimize:clear

If you keep published assets in version control, let the diff show up in review — it's the cheapest way to catch path regressions.

Lean on the new Dependabot config. Mirror the package's grouped-update approach in your own repo so npm/Composer/Actions PRs arrive batched, not as a daily trickle. Pair it with the same npm release-age guardrail the package adopted (.npmrc, e.g. minimum-release-age=… or an equivalent before cutoff) so a compromised or broken just-published dependency can't land in your build on day zero.

Adopt Pint as a gate, not a chore. The Pint bump in this release will reformat differently than older versions. Pin it in composer.json (dev), run vendor/bin/pint --test in CI, and run vendor/bin/pint locally before committing — otherwise your next unrelated PR becomes a whitespace war.

Override, don't fork. Style the admin bar through the package's config/CSS extension point and keep your font URL override in config, not in a patched vendor file. That way the next republish doesn't silently revert you.

Gotchas and Tips

• Browser and CDN caching hides the fix. The font URL change won't appear until caches clear. Run php artisan optimize:clear (config, view, route) and bust any CDN/edge cache for the vendor asset path. If you still see /build/assets, your browser is serving a cached CSS file.
• --force on vendor:publish overwrites local edits. If you customised the published admin bar CSS or font files, move those changes to a config override or a separate stylesheet before republishing. Otherwise the upgrade quietly eats them.
• The npm release-age guardrail delays fresh packages. When you genuinely need a brand-new version for a security fix, you'll hit the age cutoff and see resolution failures. Know the escape hatch (temporarily relax the cutoff for that install) so it doesn't look like a registry outage.
• Dependabot + pre-1.0 = noisy majors. Group minor/patch, and consider ignoring majors for this package until 1.0 — the changelog shows maintenance churn, not a stability commitment.
• Debugging asset 404s: check the built CSS for the literal URL, then confirm the file exists at that path under public/. A correct URL with a missing file means you skipped the republish step, not that the fix failed.
• CI drift from formatter bumps: if your pipeline runs pint --test and the version floated, you'll get failures unrelated to your change. Pin the exact version in composer.lock and update it deliberately.
• Extension points worth knowing: the package's asset-tag/font registration and admin bar render hooks are the stable seams. Prefer a hook or config key over string-replacing URLs in published CSS — the latter is exactly the class of bug this release was fixing upstream.