Getting Started

Upgrade to kanekescom/filamentum:^0.0.7 via composer require or composer update kanekescom/filamentum, commit composer.lock, run tests, and deploy. Treat v0.0.7 as a security patch if the package handles CSV export/import or ships .htaccess rules.
Look first at the package service provider, vendor/kanekescom/filamentum/src, any publishable config/filamentum.php, CSV export/import classes, middleware/routes, and published .htaccess stubs.
Publish or refresh package assets/config only if your app relies on published copies: use php artisan vendor:publish with the package provider/tag, then diff before overwriting local customizations.
First use case: audit every CSV export/import endpoint and deployed .htaccess after upgrading. Add regression tests for spreadsheet formula injection and for blocked dotfiles/sensitive paths.

Implementation Patterns

Pin v0.0.7 in composer.json, deploy through the normal release pipeline, clear caches (php artisan config:clear, route:clear), and smoke-test CSV and .htaccess behavior in staging.
For CSV workflows, keep exports behind auth/policies, stream large exports, validate imports, and reuse the package sanitization where possible. If you customize exporters, escape cells beginning with =, +, -, or @.
Treat .htaccess as deployable infrastructure: generate or publish it during release, diff it against the previous version, and keep environment-specific rules in a separate include file when possible.
Integrate with existing admin middleware and audit logging; queue large CSV jobs; test under Apache if .htaccess is part of your security model.

CSV injection is not just comma escaping: spreadsheet apps may execute formula-like cells. Verify v0.0.7 covers custom exporters and queued exports, not only default package routes.
.htaccess only applies to Apache with AllowOverride enabled. Nginx/IIS deployments need equivalent server config; check staging/prod drift and confirm .env, .git, and composer files are not publicly served.
Do not edit vendor files. Override via published config, views, middleware, or custom services; after publishing, compare against the vendor stub so the security fix is not lost.
Debug by reviewing PR #8, package tests, php artisan route:list, relevant config via php artisan config:show, application logs, and the deployed .htaccess. Clear config cache after any config change.
Release notes are sparse: confirm the exact CSV sanitization and .htaccess rule changes before assuming behavior beyond the stated security improvement.