- How do I install kyslik/laravel-filterable in a Laravel app?
- Install it with Composer in a Laravel 5, 6, or 7 project and confirm the package's Composer constraints against your PHP and Laravel versions before adopting it. The package is MIT licensed and Composer-based, so initial integration is straightforward for legacy applications. Treat the advertised Laravel support cautiously because the last release is dated 2019-02-28.
- Does kyslik/laravel-filterable support Laravel 8, 9, 10, or 11?
- The package advertises Laravel 5, 6, and 7 support, but its last release predates Laravel 7. Treat Laravel 8+ and modern PHP compatibility as medium-high risk and verify with composer why-not and runtime tests. Do not rely on --ignore-platform-reqs in production unless you fork and test the package.
- How do I define which model fields can be filtered?
- Define an explicit allowlist of filterable fields in your application and only pass validated query-string parameters into the package's trait or filter layer. The package is a convenience layer, not an authorization system, so you must validate and authorize each filter yourself. Never expose arbitrary columns or relationships through query-string filtering.
- Can laravel-filterable filter relationships?
- The package supports relation filters, but relationship filtering is exactly where query complexity and data-leak risk increase. Confirm the actual relation-filter behavior with runtime tests and enforce allowlists, authorization, and query limits. For complex boolean or cross-relationship filtering, a maintained query builder or local scopes may be a better fit.
- Is kyslik/laravel-filterable safe for production use?
- It is not a drop-in production safety guarantee. The technical assessment rates security and abuse risk as medium because query-string-driven filtering can expose unintended columns or relationships, leak tenant data, and trigger expensive queries. Use allowlists, validation, authorization, query limits, and indexed columns, and wrap filtering behind an application-owned abstraction. Maintenance risk is high because the package is old and effectively unmaintained.
- How do I filter Eloquent models from query string parameters in Laravel?
- In Laravel 5, 6, or 7, add the package trait to the model, define the allowed filters, and apply the validated query-string parameters to your index or list query. Keep the query-param contract owned by your application rather than exposing package semantics directly. For new Laravel versions, prefer local Eloquent scopes or a maintained package such as spatie/laravel-query-builder.
- What are alternatives to kyslik/laravel-filterable?
- Common alternatives are spatie/laravel-query-builder, local Eloquent scopes, custom request filter classes, and application-owned filter objects mapped from validated query strings. The assessment recommends using kyslik/laravel-filterable as a reference pattern or fork for legacy Laravel 5/6/7 apps. For Laravel 8+ or strategic API search, choose a maintained package or build an internal abstraction.
- How do I test filtering and prevent unauthorized field access?
- Write feature tests that cover allowed filters, rejected or ignored filters, relation filters, tenant isolation, pagination interaction, and expensive query cases. Validate and authorize each filter before it reaches the package, and assert that unauthorized fields cannot change the query. Also test behavior after framework or dependency upgrades because the package is old.
- Does laravel-filterable work with pagination and API endpoints?
- Because the package translates query-string filters into Eloquent constraints, it can compose with pagination when the filtering is additive and read-only. Verify pagination interaction, query syntax, and latency in your actual Laravel version before rollout. Keep pagination and filtering behavior behind an application-owned API contract.
- Is kyslik/laravel-filterable maintained, and should I fork it?
- The package is effectively unmaintained: the last release is from 2019, community activity is low, and maintenance risk is high. Its MIT license permits a fork, but budget for fork ownership, dependency updates, security review, and Laravel upgrade testing. Isolate filtering behind an interface so you can replace it with local scopes or a maintained package later.