Reprise Laravel Package

Product Decisions This Supports

Note on scope: this package is symfony/reprise — a Symfony-side integration for front-end bundlers (Vite, Rsbuild) and Stimulus, not a Laravel package. The Laravel equivalent lives in the laravel-vite-plugin / Vite ecosystem. Everything below assumes a Symfony/PHP backend with a JS front end, and the decision framing (adopt vs. build vs. wait) transfers to a Laravel team evaluating the same class of tooling.

• CSP / security compliance roadmap. v1.3.0 lets CSP nonces reach modulepreload links and their Link headers, and makes the preload header follow the final rendered tag. If strict Content-Security-Policy is a blocker for enterprise or regulated customers, this release removes a real "our asset pipeline can't do nonce-based CSP" objection. That is a roadmap unblock, not a nicety.
• Deployment reliability / incident reduction. Atomic writes of entrypoints.json and manifest.json, plus not caching a missing entrypoints.json, directly address the classic "blank page for some users right after deploy" and "stale negative cache" failure modes. Frame this as reducing a recurring class of production incidents rather than a library upgrade.
• Build vs. buy signal. The bulk of this release is long-tail glue work: rebuild loops when a tool watches the output directory, build --watch semantics, trailing slashes on publicPath/manifestKeyPrefix, atomic emit, reachable dev origins. This is precisely the maintenance tax a team pays for hand-rolling its own manifest reader and tag renderer. It strengthens the case for adopting a maintained integration over an in-house shim.
• Developer onboarding and environment parity. Wildcard/IPv6-reachable dev origins, honouring devServerOrigin, Stimulus controller reload without restart, and .jsx/.tsx local controller registration all shorten the loop for containerized, remote, and Docker/CI-based dev setups. Tie to onboarding-time and "works on my machine" support-ticket metrics.
• Front-end performance OKRs. Preloading chunks an entry reaches through another chunk reduces request waterfalls on deep dependency graphs — measurable against LCP and load-time targets on JS-heavy pages.
• Bundler optionality / migration de-risking. Parallel, near-symmetric investment in both Vite and Rsbuild (plus Rsbuild asking Rspack only for the stats fields the manifest needs) keeps the exit option open. That supports a "don't get locked into one bundler" platform strategy and makes a future Webpack/Vite/Rsbuild migration a smaller decision.
• Platform upgrade planning. CI now tests Symfony 8.1 instead of 8.0 — a useful forward-compatibility signal when scheduling framework upgrades.

When to Consider This Package

Adopt when:

• You run a Symfony application with a JS front end and want the PHP side to emit correct script/link tags, preloads, and manifest.json lookups without custom code.
• You have, or are about to have, a strict CSP requirement — the v1.3.0 nonce and header behaviour is the specific reason to be on this version rather than an older one.
• You deploy frequently with multiple app servers or zero-downtime rollouts and need manifest reads to never observe a half-written file.
• Your team develops in containers, behind proxies, or on wildcard/IPv6 hosts, and dev-server origin handling has been a friction point.
• You use Stimulus and want controller changes picked up in dev without a manual restart, including TSX/JSX controllers.
• You are choosing between Vite and Rsbuild (or hedging) and want one PHP-side integration that covers both.

Look elsewhere when:

• You are on Laravel — this is not the package for you; use the Laravel Vite integration instead.
• You are on a non-Symfony PHP framework, or your front end is a standalone SPA that never needs server-rendered asset tags.
• You want zero PHP-side glue: a pure CDN + bundler-manifest setup, or a legacy Webpack Encore stack, is a different decision with different constraints.
• You extend the package's internals. v1.3.0 drops joinUrl and the ViteOutputChunk type, and moves each bundler's hooks into its own module. No deprecation path was announced for these, so treat them as small breaking changes for downstream extenders even though the release doesn't label them as such. Verify before upgrading if you subclass or import from those internals.
• You need a stable, frozen API surface with formal deprecation cycles — this project is still normalizing internals release to release.

How to Pitch It (Stakeholders)

For executives (one paragraph): We evaluated symfony/reprise, the Symfony-side package that connects our PHP backend to our JavaScript build tooling. The new v1.3.0 release is a hardening release rather than a feature release, and it lands on the things that actually cost us money: it removes a blocker to adopting a strict Content-Security-Policy (a recurring enterprise and security-review requirement), makes asset manifest writes atomic so deploys stop producing intermittent blank pages, and fixes a set of developer-environment issues around containers, proxies, and dev-server origins. It is a low-risk upgrade with no announced breaking changes; two internal helper APIs were removed, which only matters if our engineers have extended the package. Recommendation: upgrade, and treat this as evidence that a maintained integration is cheaper than the in-house glue we would otherwise own.

For engineering (summary):

• No headline features; the value is correctness and stability.
• Security: CSP nonces now propagate to modulepreload links and Link headers; preload header tracks the final tag.
• Reliability: entrypoints.json / manifest.json written atomically; missing entrypoints.json no longer negatively cached; Rsbuild rebuild loop fixed when a tool watches the output directory; build --watch no longer treated as dev.
• Dev experience: reachable dev-server origin advertised for wildcard/IPv6 hosts; devServerOrigin honoured; Stimulus controllers reload without restart; .jsx/.tsx local controllers registered.
• Performance: transitive chunk preloading for Vite; Rsbuild requests only the Rspack stats fields the manifest needs.
• Upgrade caveats: joinUrl and the ViteOutputChunk type were dropped, and bundler hooks moved into per-bundler modules — check for internal imports or subclassing before bumping. CI now targets Symfony 8.1, so confirm your framework version is in range.