- How do I install and register stepanenko3/nova-cards in Laravel Nova?
- Install it with composer require stepanenko3/nova-cards, then register the card in your NovaServiceProvider::cards() method or in a specific Dashboard::cards() method. Publish any optional assets if the package provides them, and confirm the Composer constraint covers your Nova major before installing. The package is additive, so no schema changes or migrations are involved.
- Which Laravel Nova versions does stepanenko3/nova-cards support?
- Check the package's composer.json constraints and source rather than assuming from the README. Nova 4 versus Nova 5 compatibility is the main adoption blocker for small card packages, and a lagging card can leave a blank panel on a dashboard operators see daily. Read the constraint before committing it to a production dashboard.
- Is nova-cards a static info card or a computed metric card?
- The package is positioned as reusable info cards for custom content, links, notices, and summaries, not as a replacement for Nova's first-party Value, Metric, Partition, or Trend cards. The evaluation flags a static-versus-computed ambiguity, so read the card class before promising computed metrics to stakeholders. If it is purely static, scope it to informational dashboard surfaces.
- Does nova-cards escape HTML, or can it render raw content?
- The realistic security risk for an info-card package is unescaped {!! !!} rendering of operator- or config-authored content inside the admin panel. Do a quick grep for raw Blade output before merging, and confirm who can influence the content. This audit should happen before deployment, not after.
- Does canSee() stop nova-cards from running queries for unauthorized users?
- No. canSee() gates rendering, not computation, so anything computed eagerly in cards() such as a count, scoped query, or drill-down link runs for every user regardless of the gate. If you add computed content, keep it lazy or move it behind explicit authorization. Treat this as a real finding class during review.
- Can I use stepanenko3/nova-cards outside a Laravel Nova installation?
- No. It is a strictly additive presentation-layer dependency for Nova with no value outside a Nova installation. It does not touch authentication, routing, persistence, queues, or models, so reject it at triage for non-Nova apps. The blast radius is limited to a dashboard panel rendering incorrectly.
- What maintenance risk should I know before adopting nova-cards?
- The package has a single maintainer, modest star count, zero dependents, and no SLA, so bus factor is one. Assume you may own the code outright after the next Nova major release. Decide in advance who owns the fork decision and what event triggers it.
- How large is the nova-cards codebase, and is it easy to audit?
- The total source surface is a few hundred lines of PHP and Vue, small enough for one engineer to read fully in about half an hour. That makes it feasible to review the card class, escaping behavior, and any computation before adoption. Small code size also keeps the integration blast radius low.
- What is the rollback plan if we remove nova-cards from a Laravel Nova app?
- There is no schema change, backfill, dual-write, or cutover, so removal is just composer remove plus deleting the card registration. Reversibility is total and the cost of being wrong is measured in hours. That is why it should be a low-ceremony dashboard addition rather than a roadmap item.
- Are there alternatives to nova-cards for Laravel Nova dashboards?
- For computed numbers, use Nova's first-party Value, Metric, Partition, or Trend cards rather than assuming nova-cards covers that use case. You can also build a custom Nova card with your own Vue component if you need full control. Choose nova-cards only when you want lightweight, reusable informational cards and have verified Nova version compatibility.