Core Laravel Package

Product Decisions This Supports

• Build vs. buy for editorial tooling (buy, mostly). redaxo/core is not a library you composer require into an existing Laravel app — it is a complete, standalone PHP CMS application (PHP 8.3+) with its own admin backend, addon registry, and templating. The real decision it informs is "do we stand up a self-hosted CMS instead of building content editing, media handling, versioning, and multilingual structure ourselves?" On that framing it is a credible buy: media pool, media manager (image derivatives), cronjobs, backup, meta fields, article structure/versions, and a full permission model all ship in core or bundled system addons.
• Content modeling strategy. REDAXO's core bet is "custom modules with full control of input and output" rather than a fixed page/post schema. That supports a roadmap decision to let editorial define structured content types without engineering involvement — valuable if your content is heterogeneous (product pages, landing pages, documentation) and painful if your team expects an opinionated page builder out of the box.
• Multilingual and DACH market entry. Core supports multiple languages and the community is concentrated in German-speaking markets. If a roadmap item is launching a DE/AT/CH site with delegated editorial control, this is a lower-effort path than retrofitting i18n into a bespoke admin.
• Self-hosting and data residency. MIT-licensed, runs on your own infrastructure. This supports decisions where SaaS CMS procurement is blocked (data residency, procurement policy, no-vendor-lock-in mandates).
• Security investment planning. The release history is unusually informative: multiple GHSA-tracked advisories per cycle (authz checks missing on slice operations, a critical unauthenticated backend-session escalation in the structure/history plugin, backup export leaking password hashes and remember-me keys, several stored-XSS escaping gaps in media/link widgets). Use this as input to a decision on whether you need an internal security review gate and a defined patch-SLA before adoption — not as a reason to reject, since fixes ship promptly with credited reporters and CVE-style IDs.
• Integration architecture. Because it is application-shaped, not framework-shaped, the PM decision is "sidecar CMS behind a reverse proxy / shared session" or "headless-ish content source consumed via its API," not "install as a Composer dependency." The 0 dependents figure reflects this — it is a signal that the package graph is the wrong health metric here; ecosystem value lives in FriendsOfREDAXO addons and demo sites.

When to Consider This Package

• You need a self-hosted, MIT-licensed CMS for a content-heavy marketing, corporate, or multilingual site, and you want editorial teams building structured modules without deploys.
• Your team is PHP-fluent and comfortable with a non-Laravel codebase (own autoloading, own addon conventions, Psalm/PHPStan/phpunit/taint tooling). Existing Laravel Symfony-kernel assumptions do not transfer.
• You have German-speaking stakeholders or agency partners — or you are willing to invest in English onboarding. The docs and community are German-first; the English demo_base is explicitly the bridge, and the README warns that most help channels are German. Budget real ramp-up time.
• You value transparent security process: GHSA advisories, credited external reporters, rapid patch releases, and a use_directory_protection_check escape hatch suggest a maintainer who takes disclosure seriously.
• Look elsewhere if: you need a turnkey headless/API-first CMS (Directus, Strapi, Contentful), a Laravel-native admin (Filament, Statamic, October), enterprise vendor SLA and support contracts, or a large hiring pool (WordPress/Drupal). Also look elsewhere if your security posture cannot tolerate a young-ish hardening curve on authorization checks, or if you need a large plugin marketplace — 355 stars and a DACH-centric community is a thin hiring and third-party-integration surface outside Germany.

How to Pitch It (Stakeholders)

To executives: REDAXO is a mature, MIT-licensed PHP CMS that has shipped since 2004 and is actively maintained — releases are landing as recently as October 2026 with security patches and bugfixes. It lets us buy editorial capability (media management, versioning, multilingual structure, granular permissions) instead of building it, with no license cost and full data ownership. The trade-offs to accept explicitly: the community and documentation are German-first, so onboarding and recruiting carry a premium outside DACH; and the security history shows recurring authorization and output-escaping defects, which we should counter with a mandatory patch SLA and one internal review before go-live. Recommend a time-boxed spike, not a commitment.

To engineering: Treat this as an application to deploy and extend, not a Composer package to import — there is no Laravel service provider and no meaningful dependency footprint to inherit. The extension model is addons and modules; the core ships with the system addons we would otherwise write (structure, mediapool, media_manager, metainfo, backup, cronjob, be_style, install). Quality gates are real: composer check runs code style, PHPStan, Psalm (including taint analysis), and PHPUnit, and Psalm coverage is published — so contributions are viable if we need to upstream fixes. Two asks before we commit: pin to the latest 5.21.x patch line, and audit our permission model against the classes of bugs in the advisories (per-object authz on write operations, CSRF on state-changing endpoints, escaping on all widget output).

To the sponsor of the decision: The honest framing is that this is a solid buy with a narrow fit. It wins on cost, ownership, and content-modeling flexibility; it loses on ecosystem size, English-language support depth, and a security hardening curve that we must actively manage. If our roadmap centers on DACH editorial sites run by a PHP team, the case is strong. If it centers on API-first content delivery to a Laravel product, we should evaluate a Laravel-native or headless option first — and use this spike only as the cost baseline.