Filament Complete User Profile Laravel Package

Product Decisions This Supports

• Ship-vs-buy for account/profile management: The package bundles user profile editing, email multi-factor authentication (one-time codes), and mobile account navigation into a Filament plugin. This is a real build-vs-buy lever: the alternative is 4–8 weeks of engineering to replicate OTP generation, cache-backed code storage, delivery, verification, resend throttling, and browser-tested mobile navigation.
• Security roadmap (MFA as a checkbox): v1.2.2 explicitly restores compatibility with Filament 5.10.x's native provider, meaning the package now delegates OTP lifecycle to the platform rather than maintaining a parallel session-based mechanism. That is a de-risking signal — the vendor is tracking upstream security primitives instead of forking them, which lowers the "who patches this when CVE-X lands" question in a security review.
• Support-matrix / upgrade-window decisions: Compatibility is pinned to Filament >=5.8.3 <6.0.0, Laravel 13.x, PHP 8.3+. This directly informs whether the profile/MFA surface blocks or permits an imminent Filament 6 upgrade, and whether teams on Laravel 12 or PHP 8.2 are excluded.
• Mobile-first account experience: The link → menuitem accessibility-role test update indicates the plugin is actively maintained against evolving ARIA semantics — relevant if account settings are a high-traffic mobile surface or if you carry WCAG obligations.
• Release cadence as a vendor-health input: 171 unit tests / 705 assertions across two Filament boundary versions, plus 24 Playwright browser tests and PHPStan, is the kind of evidence needed to justify a dependency in a regulated or long-lived product.

When to Consider This Package

Consider it when:

• You are building on Filament 5.8.3–5.10.x with Laravel 13.x and PHP 8.3+, and you need profile editing plus email-based MFA without owning the OTP implementation.
• You want the email OTP flow to ride Filament's native provider (as of v1.2.2) rather than a bespoke session store — fewer moving parts to audit.
• A 60-second resend cooldown and branded email notifications are acceptable out of the box; you are not trying to fully customise the MFA challenge UX.
• Mobile account navigation matters and you want accessibility coverage maintained upstream.
• Single-vendor maintenance risk is acceptable for a bounded, testable surface area.

Look elsewhere when:

• You are on Filament 6.x (excluded by the <6.0.0 ceiling), Laravel 12 or earlier, or PHP 8.2 — the support matrix rules you out today.
• You need TOTP/WebAuthn/passkeys rather than emailed one-time codes; email OTP is the flow being patched here, not a multi-factor strategy.
• You require vendor SLAs, an LTS commitment, or a security disclosure process — this is a single-maintainer package and the release notes do not evidence any of that.
• You are already deep into a first-party auth stack (Breeze/Jetstream/Fortify plus custom Filament pages) and adopting this would duplicate ownership.
• Your upgrade policy demands zero coupling to internal Filament mechanisms — v1.2.2's fix is precisely a coupling to Filament 5.10's cache-backed storage, so future Filament internals changes are a recurring re-integration cost.

How to Pitch It (Stakeholders)

For executives: This release is a maintenance patch, not a feature launch — and that is the good news. It restores email two-factor authentication compatibility with the newest Filament release (5.10.x) by handing code generation and verification to Filament's own provider, so we inherit upstream security hygiene instead of owning it. Our custom email notification and 60-second resend throttle are preserved, so the user-facing experience does not change. Verification is credible for a package of this size: 171 tests / 705 assertions run against both ends of the supported Filament range, 24 browser tests, and static analysis passing. The upgrade is a routine composer update with no breaking changes and no minimum-version bump.

For engineering: No migration work. Minimum Filament stays at 5.8.3; we remain compatible across 5.8.3, 5.9.x, and 5.10.x on Laravel 13.x and PHP 8.3+. The one architectural point to note: the package now depends on Filament's cache-backed OTP mechanism for 5.10+, replacing the legacy session store — so our cache backend becomes part of the MFA critical path and must be a shared, durable store (not an in-memory or per-node driver) in any multi-instance deployment. The <6.0.0 ceiling is the thing to track; a Filament 6 upgrade will require a package release before we can follow. The menuitem accessibility-role update is test-only but confirms our mobile account nav assertions still hold.

Recommendation: Accept v1.2.2 as a routine dependency bump, verify the cache driver backing OTP storage in staging, and add "Filament 6 compatibility" to the dependency-risk register.