Filament Activity Timeline Laravel Package

Security release: the widget state can no longer be changed by a crafted Livewire request. Upgrading is recommended for every install that uses ActivityTimelineWidget.

Security

• Every public property of ActivityTimelineWidget is now #[Locked]. Livewire lets a browser write to any public property that is not locked, so a crafted request could change the source, raise the page size, turn the presentation diagnostics on, or replace presentationOverrides. Replacing the overrides dropped the hiddenAttributes the widget was mounted with and revealed those attributes in the change lists. Attributes listed in the hidden_attributes configuration were never affected, and the record itself was never swappable, so a timeline always stayed scoped to the record it was mounted with.
• The visible window is bounded by the new pagination.max_per_page setting (500 by default). The page size could previously grow without limit, from the "load more" button or from a crafted request. A per_page configured above the ceiling is still honoured in full.
• filterByEvent() only accepts an event the timeline offers as a filter tab. The event was already bound as a query parameter, so no injection was possible: the widget simply no longer queries an event it was not configured to expose.

Fixed

• An authorization failure while reading activity is no longer swallowed into the generic error state. AuthorizationException, AuthenticationException, ValidationException, HttpResponseException and any HttpExceptionInterface now reach the exception handler, so a denied timeline answers with a 403 instead of looking like a record with no history. Any other failure still degrades to the error state and is still reported.
• A per_page of 0 or below is clamped to 1.

Upgrading

• No code change is required for a standard setup.
• If you set widget properties from your own JavaScript ($wire.set(...)), Livewire now throws a CannotUpdateLockedPropertyException. Configure the widget through mount() or by extending timeline() instead.
• If you published the configuration file, you can add 'max_per_page' => 500 under pagination. Without it, the ceiling falls back to 500.
• If one of your custom sources throws an AuthorizationException, the timeline now answers with a 403 instead of the error panel.

Full changelog: https://github.com/La-boite-a-code/Filament-Activity-Timeline/blob/main/CHANGELOG.md

Patch release: restores the PHP 8.3 + Spatie source combination.

Fixed

• Installing the package with the Spatie source on PHP 8.3 was impossible: the dev dependency and suggestion pinned spatie/laravel-activitylog to ^5.0, which requires PHP 8.4. The constraint is now ^4.12|^5.0 and the test suite runs against both major versions, including the v4 split migration stubs.

CI

• Dependabot now runs against main: it had been scanning the pre-release default branch, and its commit prefixes now follow the repo conventions (chore(deps) for composer, ci for GitHub Actions).

Full changelog: https://github.com/La-boite-a-code/Filament-Activity-Timeline/blob/main/CHANGELOG.md

First stable release of the semantic activity timeline for Filament.

Turn technical activity logs into clear, localized business events: a reusable presentation layer on top of spatie/laravel-activitylog (or any custom source), with per model labels, business record titles, translatable event sentences, readable old to new changes, server side filters and progressive loading.

Fixed since 0.1.0

• Filter tabs were dead on click: Blade never compiles directives inside component tag attributes, so the browser received a literal [@js](https://github.com/js)(...) expression. The event value is now inlined with a standard echo.
• The section heading and description never rendered when not explicitly configured: Livewire shares public properties with the view after the explicit view data, so a null property erased the resolved default. View data keys no longer collide with public property names.
• All CSS classes moved from fi-ta-* to fi-at-*: fi-ta is Filament's own table namespace, and core table styles were bleeding into the timeline.
• Colors now use Filament v4 palette variables correctly: v4 exposes complete oklch colors, so the previous rgb(var(...)) declarations were invalid and silently dropped.

Changed

• Refined timeline design: soft tinted event dots, hairline rail, aligned change labels, and quiet value chips (old value struck through, new value emphasized).
• Every color recombines a Filament core recipe, variable for variable, with zero color literals. Event dots reuse the core fi-color-{name} scoping, so colors registered in your panel (custom ones included) style custom events out of the box.

Documentation

• Expanded README: drop-in widget property reference, forResource(), event property bindings, every attribute format, presets, theming guide and the ActivitySource contract.

Full changelog: https://github.com/La-boite-a-code/Filament-Activity-Timeline/blob/main/CHANGELOG.md