- What does tomaszboloz/laravel-updater do?
- It is a Laravel package for self-updating applications from GitHub releases, including public and private repositories. It provides a Filament admin page and Artisan commands for checking and applying updates. The update flow can handle code replacement, Composer steps, migrations, npm build, and cache clearing.
- How do I install laravel-updater in a Laravel application?
- Install it with Composer using composer require tomaszboloz/laravel-updater. Then follow the package README to publish any configuration and register the Filament page or use the provided Artisan commands. Clear your config, route, and permission caches after installation, especially if you use Filament Shield.
- Does laravel-updater support private GitHub repositories?
- Yes. The package is described as supporting updates from both public and private GitHub releases. For private repositories, you will need to configure GitHub authentication such as a token with the right repository access. Keep those credentials secure and limit who can trigger updates.
- Can I use laravel-updater without Filament?
- Yes, the package exposes Artisan commands as well as a Filament admin panel page. If you do not use Filament, you can still run update checks and apply updates from the command line. If you do use Filament, the Updates page gives you an in-panel workflow.
- Does laravel-updater run Composer, npm, migrations, and cache clearing?
- The package is designed to handle code replacement, Composer steps, migrations, npm build, and cache clearing as part of an update flow. These are privileged operations, so confirm the exact commands and required filesystem permissions in the package documentation before enabling them. Run it only in an environment where the web process or CLI user has the necessary access.
- How does the Filament Shield permission integration work in laravel-updater?
- When Filament Shield is present, version 3.3.0 gates the Updates page behind a named Shield permission. Read the package source or README for the exact permission key, then seed it and assign it to an admin or platform role rather than a general operator role. Also verify whether the page is hidden or visible when the permission is missing or unseeded, because that fail-open versus fail-closed behavior matters in production.
- Is laravel-updater safe to use in production?
- Treat it as a privileged deployment tool because it can replace application files and run Composer, npm, migrations, and cache commands from a web process. Restrict access with Shield permissions, secure GitHub credentials, and ensure the runtime user has only the filesystem permissions it needs. Test the update path in staging before using it on a production application.
- Which Laravel, PHP, and Filament versions are supported by laravel-updater?
- Check the package composer.json and README for the authoritative Laravel, PHP, and Filament version constraints. Filament major-version alignment matters, and the Shield integration should be validated against your exact Shield version rather than a broad range. Pin the package version and test it against your application before rolling it out.
- How should I test and roll back a laravel-updater update?
- Test the update in staging with a copy of production, back up files and the database, and confirm where the release artifact originates. Because the updater can replace files and run migrations, rollback should rely on your normal backups and deployment strategy. Review the package documentation for any built-in maintenance-mode or backup behavior before enabling updates in production.
- Is laravel-updater actively maintained, and what are the alternatives?
- The TPM assessment notes a single maintainer, so check the release cadence, open issues, and security disclosure process before relying on it. Alternatives include CI/CD pipelines, Laravel Forge or Envoyer, Deployer, or manual release processes when you need stronger deployment controls. For Filament teams that want in-panel update visibility, laravel-updater can still fit well if access is tightly restricted.