Nova Places Laravel Package

Technical Evaluation

Recommendation up front: do not adopt. This package's primary external dependency has been decommissioned, the package itself is archived, and its host framework (Nova) has moved through two major versions since the last commit. Score of 0.115 is a fair reflection of viability.

Architecture fit

• Standard Nova custom field pattern: a PHP Field class that serializes options to the front end plus a compiled Vue component that renders the autocomplete input.
• The component depends on Algolia Places (places.js) for typeahead search and geocoding, with results (formatted address, lat/lng, country, city, admin hierarchy) written back into the Nova resource.
• This is a thin convenience layer, not deep infrastructure — the package is small, single-purpose, and easy to read. Architecturally it is a client-side widget bolted onto a server-side field definition, with no server-side proxy or data ownership.

Integration feasibility

• Low. Algolia Places was sunset in 2022; Algolia directed users to alternative geocoding providers rather than a first-party replacement. Any environment installing this field will fail at runtime — the autocomplete endpoint simply does not resolve.
• Last release 2020-05-07 predates Nova 4 (2022) and Nova 5. Nova 4 overhauled the field/asset pipeline (Vite-era builds, updated component registration), so the compiled component is very likely incompatible without a rewrite.
• Composer install may also warn or fail on abandoned-package metadata against modern Laravel constraints.

Technical risk

• Upstream service death (blocking). The autocomplete call is the entire value proposition. There is no degradation path in the package — the field renders as a broken or inert input.
• Unmaintained dependency chain. 14 stars, single maintainer, archived, zero security or compatibility patch velocity. Any CVE or framework break is permanent.
• Client-side key exposure. The Places integration used a public search-only key embedded in the browser bundle — an acceptable pattern for a dead vendor, but not a pattern to reintroduce without evaluating the replacement's key-scoping model.
• Silent data-quality failure. Because Nova validation on this field is typically loose, a broken widget degrades gracefully into a free-text box — meaning the failure mode is polluted address data rather than a visible error.
• Supply-chain exposure. Installing an archived Composer package pulls a fixed, unpatchable transitive tree into the admin surface, which usually has privileged access.

Key questions

• Is this package already deployed in any environment, or is this a greenfield evaluation? If deployed, what data quality has accumulated since 2022?
• What is the actual product requirement — address validation, geocoding (lat/lng for mapping), or just typing ergonomics? The three have different replacement profiles.
• Which Nova major version is in use, and what is the upgrade horizon?
• Is there budget/ownership for a small custom Nova field, or is a buy-and-configure third-party field required?
• Are there data-residency or cost constraints that steer us toward Google Places, Mapbox, HERE, or self-hosted OSM/Nominatim+Photon?

Integration Approach

Stack fit

• Targets Laravel/Nova 2–3 era, PHP 7.x, Vue 2, and the Algolia Places CDN script. That is two framework generations behind a current Laravel/Nova install.
• Fit against a modern Nova 5 + Laravel 11 stack is effectively zero without a fork and rewrite.

Migration path

• Greenfield: exclude. Do not attempt to resurrect. The vendor service cannot be restored.
• Already installed: treat as an incident. Sequence: (1) confirm the widget is non-functional in production; (2) decide retain-the-UX vs. drop-the-field; (3) build or buy a replacement field; (4) backfill/normalize the address records the broken widget produced; (5) remove the Composer dependency.
• Replacement options, roughly ordered by effort:
  • Custom Nova field wrapping Google Places Autocomplete — best accuracy and address-component parsing, paid, well-documented, straightforward Vue component.
  • Mapbox Search / Geocoding — strong cost profile at volume, good component granularity.
  • Self-hosted Nominatim or Photon — no per-call cost and no key exposure, but you own uptime, index refresh, and latency.
  • HERE / OpenCage — viable fallbacks if licensing or region coverage favors them.
• The package's PHP field class is a usable reference for the data shape (address string + lat/lng + components); reuse that contract so existing resource columns and any downstream mapping code don't change.

Compatibility

• Assume no compatibility with Nova 4/5, PHP 8.1+, or Laravel 9+. Verify before spending any evaluation time — but the dead vendor service makes the point moot.

Sequencing

1. Confirm usage and blast radius (grep resources for the field, check DB for null/partial geo columns).
2. Freeze new usage; document the replacement's data contract.
3. Prototype the replacement field against one resource.
4. Roll out, then run a data-quality pass on records created post-2022.
5. Remove the package and lock the Composer manifest.

Operational Impact

Maintenance

• None available. Archived repository, last release over five years old, no path to a patch even if a fix is trivial. Every future issue is yours to own.
• Any fork inherits the vendor-integration rewrite plus ongoing maintenance of a bespoke field — realistic only if address autocomplete is a core differentiator.

Support

• Community-only, effectively zero: 14 stars, single maintainer, inactive. No vendor SLA, no security advisories, no upgrade guides.
• Internal support burden shifts entirely to the adopting team, including on-call for a widget that fails silently.

Scaling

• Moot for the package itself. For the replacement, plan quota and cost modeling early: Places-class APIs are priced per session/keystroke-batch and admin panels with heavy address entry can generate surprising volume. Prefer session tokens and debouncing, and cap results server-side where the provider supports it.

Failure modes

• Hard: provider endpoint gone → autocomplete never fires, field renders inert. This is the current state.
• Soft: API key revoked, quota exhausted, or CORS/network blocked → same inert field with no visible error to the operator.
• Silent: users type free-text addresses; downstream geocoding, routing, or reporting quietly degrades. This is the expensive one and is likely already happening.
• Install-time: Composer resolution failures against modern Laravel constraints; abandoned-package warnings during CI.

Ramp-up

• Reading the codebase is cheap — it is small and conventional. The cost is not comprehension, it is replacement: a custom Nova field plus provider selection, key management, quota monitoring, and a data-quality remediation pass. Budget days-to-weeks, not hours, and scope it as a small project with a named owner rather than a swap-in dependency.
• If the business need is marginal, the cheapest correct decision is to delete the field and accept manual address entry with server-side validation, rather than standing up a new paid provider integration.