Source Laravel Package

Product Decisions This Supports

First, the framing correction that drives everything else: redaxo/source (repo: redaxo/core) is not a Laravel package or an embeddable Composer library. It is a standalone, server-rendered PHP CMS application — the core plus bundled system addons (structure, mediapool, media_manager, cronjob, backup, install, be_style). With 0 dependents, it is not consumed as a dependency; it is installed as a platform. The PM decision here is platform/vendor selection, not "add this to composer.json." Any ticket written as "integrate this package into our Laravel app" is mis-scoped and should be re-written before estimation.

Decisions it legitimately informs:

• Build vs. buy for a content-managed site. REDAXO replaces a bespoke admin/content layer for brochure sites, multilingual corporate sites, and campaign pages. Custom "modules" (editor-defined input/output blocks) cover most bespoke content-modeling needs without custom code — a direct substitute for 4–8 weeks of internal admin-UI build.
• Roadmap sequencing for DACH-market products. The community, docs, and changelogs are German-first. If Germany/Austria/Switzerland is a target segment and content editors are German-speaking, this is a credible low-cost option; if not, the localization tax on your team (not the end users) is a recurring roadmap drag.
• Hosting/ops strategy. Standard PHP 8.3+ shared or container hosting, MySQL/MariaDB. No Node build pipeline, no proprietary runtime — favorable for cost-per-site and for handoff to agency partners.
• Security-maintenance budgeting. Releases 5.21.3 → 5.21.5 fixed multiple GHSAs, including a pre-auth admin-session takeover via the structure/history plugin plugin, stored XSS in media/link widgets, missing CSRF checks, and a backup export that leaked password hashes and remember-me keys. The maintainers respond fast and publish advisories properly (a positive maturity signal) — but it means you own a patch-SLA, not a vendor.
• Exit/portability planning. MIT (per README) plus conventional PHP/MySQL means content and data are portable; low lock-in. That de-risks the "buy" side of build-vs-buy.
• Not supported: headless/API-first product decisions, multi-tenant SaaS architecture, or anything needing REDAXO as a library inside an existing Laravel service.

When to Consider This Package

Adopt when all/most of these hold:

• You need a complete editor-facing CMS with an admin UI out of the box, not a content API.
• Primary audience is German-speaking editors and/or a DACH agency partner; German-first docs are an asset, not a liability.
• The site is content-heavy but model-simple: pages, categories, multilingual trees, media, reusable content blocks.
• You want zero license cost with full source access and the ability to fork.
• You have (or your agency has) PHP capability and a patch cadence — someone who will apply 5.x security releases within days, not quarters.
• Content modeling is stable enough that "modules" beat a bespoke schema — i.e., editors, not engineers, should own content structure.
• You can run a pilot on a low-risk property (marketing site, microsite, regional subsite) before any revenue-critical workload.

Look elsewhere when:

• You want a Laravel-native content layer (Nova/Filament + Eloquent, or a headless CMS consumed by your Laravel API). REDAXO does not slot in as a package; adopting it means a separate application, separate auth, separate deploy next to your Laravel app. If a second runtime is unacceptable, stop here.
• You need headless / GraphQL / API-first delivery to web + mobile + app clients. Core is classic server-rendered templating; API capability is addon territory and not a first-class contract.
• English-only team. You will be reading German changelogs (as in these very release notes) to decide whether a patch is urgent. Translated demos exist (demo_base), but release-note triage is not translated.
• You require a commercial SLA, named support contract, or indemnification. This is community-supported OSS.
• High-scale / high-traffic architecture, edge rendering, or ISR-style delivery.
• Compliance-driven procurement where the license field must be machine-verifiable: the package metadata reports NOASSERTION while the README and badge say MIT. That contradiction must be resolved in legal review (read LICENSE.md directly) before this goes on an approved-vendor list — a small but real blocker, not a footnote.
• You need ecosystem gravity: 354 stars and a German-centric community is a genuine bus-factor consideration for hiring and for agency handoff outside DACH.

How to Pitch It (Stakeholders)

To executives (30 seconds): REDAXO is a 20-year-old, MIT-licensed PHP CMS used mainly in the German-speaking market. It gives us a full editorial backend — pages, multilingual content, media, scheduling, backups — with no license cost, and it is replaceable: standard PHP and MySQL, no proprietary lock-in. The trade-off is that support is community-based, so we carry the patching obligation ourselves. Recommendation: pilot on one non-critical site, measure editor onboarding time and our patch effort for a quarter, then decide. Do not put it under revenue-critical workloads yet.

To engineering (the honest version): It's an application, not a dependency — a second runtime with its own auth, its own rex_* abstractions, and its own conventions; it will not live inside the Laravel app. Upside: competent, disciplined maintainership — Psalm/PHPStan/PHPUnit/taint analysis wired into composer check, Docker dev env, prompt GHSA disclosure with real fixes. Downside: a real attack surface that has recently produced auth-bypass, stored-XSS, and CSRF findings across bundled addons; several of those were in default-shipped addons, and one was reachable pre-authentication. That's not a reason to reject it — it's a reason to pin versions, track advisories, and budget a standing "apply security patch" task per site. Also confirm the license text, since metadata says NOASSERTION while the README claims MIT.

To content/editorial stakeholders: You get direct control over content structure via modules — new content types don't wait on an engineering sprint. Expect a German-first interface and documentation; the English demo_base is the fastest way to evaluate fit in a day.

Ask: approval for a time-boxed pilot on one low-risk site, plus a named owner for security patching. Success criteria: editor onboarding under one week, zero critical incidents, patch turnaround under 7 days.