- How do I install peterbrinck/nova-laravel-news in a Laravel Nova application?
- Installation is a single composer require peterbrinck/nova-laravel-news command, followed by registering the card in your Nova service provider. In practice the Composer step is the highest-risk part: the last release was March 2019, so expect dependency resolution failures against a modern Laravel, Nova, and PHP matrix. If resolution succeeds, you may still hit auto-discovery, card registration signature, or view publishing issues.
- Does this Nova card support Nova 4 and Nova 5?
- No, not out of the box. The package was last released in March 2019, which predates Nova 3, 4, and 5, so the card registration API and view conventions it targets no longer match current Nova versions. You would need to fork and update the card class against the installed Nova API before it will load.
- Which Laravel and PHP versions does this package support?
- The published release targets a pre-PHP 8 era and uses Composer constraint conventions that are outdated by current standards. There is no official support statement for Laravel 8, 9, 10, 11, or PHP 8.x. On a modern stack, treat the version constraints as something you must lift yourself in a fork rather than something the package provides.
- Is peterbrinck/nova-laravel-news still maintained?
- No. The repository has roughly 17 stars, zero dependents, and no release since March 2019, which means no security patching path exists upstream. If you install it as-is, whoever adopts it becomes the de facto maintainer. The MIT license is the key mitigation: fork-and-own is legally clean and should be the default posture.
- How does the card fetch Laravel News content, and does it cache the feed?
- The card makes a single synchronous outbound HTTP call to the Laravel News feed when the Nova dashboard renders. The caching and timeout posture is unclear from the package, so you should verify both before relying on it in production. It also appears to rely on simplexml_load_file and allow_url_fopen assumptions that can break under modern PHP hardening and egress policies.
- Is the Laravel News feed content safe from XSS inside the Nova dashboard?
- That is a real concern worth auditing. Third-party feed content rendered unescaped inside an authenticated admin panel is an XSS vector, and the package does not document any sanitization. If you fork it, escape all feed fields and route content through a sanitization library already in your stack rather than trusting it as HTML.
- What happens if the Laravel News feed is unreachable?
- The failure mode is silent: the card renders blank with no operator signal. There is no documented neutral fallback or error logging, so a blocked egress rule or a feed outage looks identical to a broken install. Any fork should add a visible empty state and log fetch failures.
- Should I fork this package or write my own Nova card?
- Writing a first-party card is the recommended path. The code surface is tiny, so a minimal card that fetches, caches, sanitizes, and renders the feed with a neutral fallback and logged failures is measured in hours. Use this repository as a free reference: read the card class, copy the shape, and discard the 2019 constraints. Forking and vendoring under an internal namespace is acceptable but only marginally cheaper up front and carries inherited baggage.
- Will this card work in an air-gapped or egress-restricted environment?
- No. The card depends on an outbound HTTP request to the Laravel News feed on every dashboard render, so it cannot function without permitted egress. Combined with the allow_url_fopen and simplexml_load_file assumptions, restricted hosts are an explicit non-fit. Cache the feed locally in a scheduled job if you must support constrained networks.
- Can I show this Laravel News card on a client-facing or customer-visible dashboard?
- That is not advisable. The package fits internal, engineering-facing Nova dashboards only, where the audience is already authenticated admins. Customer- or client-visible dashboards, headless or API-only services, and any environment whose policy forbids unmaintained dependencies in admin tooling are explicit non-fits.