filamentphp/filament
A powerful open-source UI framework for Laravel • Build and ship apps & admin panels fast with Livewire
How filament is put together
filamentphp/filament (4.x branch) is a PHP monorepo that builds Filament, an admin-panel/form/table builder framework for Laravel applications. The codebase is split into independently versioned Composer packages under packages/ (actions, forms, infolists, notifications, panels, query-builder, schemas, support, tables, widgets, upgrade, plus spatie/spark integration plugins), each with its own composer.json, service provider, stubs, views and assets. Runtime UI is a hybrid of PHP (Laravel service providers and fluent component classes) and JavaScript (Alpine.js components registered on alpine:init, bundled with esbuild and styled with Tailwind CSS 4). Data flows from developer-defined PHP component trees (Schemas, Tables, Actions) through Livewire-rendered Blade views into Alpine.js client state; docs-assets/app contains a small demo Laravel app used for documentation screenshots.
Languages
Frameworks
Infrastructure
Major components
packages/panels
Core admin panel framework: Panel/PanelProvider/PanelRegistry configuration, FilamentManager, panel web routes, global helpers, sidebar/dark-mode Alpine stores.
packages/actions
Action system providing modal/button actions (Create, Edit, Delete, bulk variants, Attach/Detach, Import/Export) with its own web routes and Alpine modals component.
packages/forms
Reactive form field components with FilePond uploads, RichEditor assets, and published view stubs.
packages/tables
Data table engine (Table.php, TableComponent.php) for columns, filters, sorting and bulk row operations, with column view stubs.
packages/schemas
Underlying Schema abstraction (Schema.php, JsContent.php) shared by forms/infolists/tables for structuring component trees.
packages/support
Shared infrastructure: filament.php config, SupportServiceProvider, helpers, Markdown, RawJs/JsContent utilities, timezone manager, CLI manager.
packages/notifications & widgets
In-app notification system (database/broadcast notifications with Alpine plugin) and dashboard chart/stat widgets (ChartWidget, StatsOverviewWidget).
packages/upgrade + bin/
v4 upgrade tooling: Rector-based codemods, compatibility checks, plus repo build scripts (bin/build.js) and issue-reproduction scaffolding.
A busy week of chart improvements and accessibility fixes alongside a wave of translation updates and small bug fixes.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A busy week of chart improvements and accessibility fixes alongside a wave of translation updates and small bug fixes.
Week of 2026-08-17
A quiet week focused on simplifying how hidden components are visually concealed in the interface.
Week of 2026-08-10
Only routine maintenance occurred this week, limited to updating a security-scanning tool.
Week of 2026-08-03
A large week mixing security and usability fixes for multi-factor authentication with documentation asset cleanups and many dependency updates.
Week of 2026-07-27
Multi-factor authentication received several refinements while the rich text editor and repeater fields got important bug fixes, plus a new language was added.
The past month on the Filament repository shows steady polish work on the upcoming version 4, with heavy focus on charts customization, accessibility fixes, and international translations across many languages. Bug fixes targeted table filters, multi-factor authentication, editors, and repeaters, while routine dependency bumps kept the tooling current. A quieter week mid-August was spent simplifying how hidden schema components are rendered.
Week by week
2026-08-24A busy week of chart improvements and accessibility fixes alongside a wave of translation updates and small bug fixes.latest6 changes
Fix
Table filter indicators are now screen-reader friendly
Filter indicators shown above tables are now exposed as an accessible list so people using assistive technology can understand them.
Feature
Charts got more customizable
Chart defaults were adjusted to better match Filament's look and developers gained more options to customize chart appearance.
Fix
Better default initials for user avatars
When generating avatar initials from names, leading punctuation is now skipped so names starting with symbols produce cleaner results.
Fix
Compatibility fixes for newer PHP
Prevented crashes in action views and a selection component that could occur on PHP 8.5 when handling missing values.
Chore
Translations expanded in Arabic, Swahili, and Khmer
Community contributors improved Arabic pluralization and added or completed Swahili and Khmer translations.
Refactor
Cleaner hiding behavior for hidden form fields
Hidden ('concealed') schema components now hide more consistently with better styling and validation behavior.
2026-08-17A quiet week focused on simplifying how hidden components are visually concealed in the interface.2 changes
Refactor
Simplified hidden component rendering
Work continued across several files to simplify how 'concealed' (hidden) components are handled.
Fix
More reliable way to hide components
Hidden schema components now use the browser's standard display:none mechanism instead of collapsing height, which is more consistent.
2026-08-10Only routine maintenance occurred this week, limited to updating a security-scanning tool.1 change
Chore
Updated security analysis tooling
The automated security workflow tool (zizmor) was bumped to a minor new version to keep supply-chain checks current.
2026-08-03A large week mixing security and usability fixes for multi-factor authentication with documentation asset cleanups and many dependency updates.6 changes
Fix
Security improvement for one-time login codes
Used multi-factor authentication codes are now cached by a hashed value rather than storing the secret itself, improving security.
Fix
Repeater can't be overfilled anymore
The 'clone' button on repeatable form fields is now automatically disabled once the maximum number of items is reached.
Chore
Documentation screenshots made reproducible
Randomness was removed from the docs demo app so screenshots come out identical every time they're regenerated.
Fix
Markdown editor refresh fix
The Markdown editor now reuses its underlying editor instance when refreshing instead of recreating it, preventing glitches.
Chore
Arabic translations rounded out
Missing Arabic translation keys were filled in across actions, panels, notifications, and widgets with better pluralization.
Chore
Routine dependency updates
Several JavaScript and GitHub Action dependencies were bumped to their latest versions.
2026-07-27Multi-factor authentication received several refinements while the rich text editor and repeater fields got important bug fixes, plus a new language was added.6 changes
Feature
Tajik language support added
The project gained full Tajik translations, expanding its language coverage.
Fix
Login security check happens before MFA prompt
The app now verifies a user is allowed into a panel before showing them the multi-factor authentication challenge.
Fix
Rich editor respects image size units
Image dimensions entered without units in the rich text editor now correctly get 'px' appended so styles render properly.
Fix
Fixes around multi-factor login details
Recovery code inputs now autocomplete correctly, and actions triggered from web addresses without popups work as expected.
Fix
Repeater fields bind data more reliably
Repeatable form containers now connect to their data before evaluating items, avoiding ordering issues.
Chore
Translation completions across languages
Portuguese (Brazil), Slovak, Czech, Polish, German, and Turkish translations were updated or completed by community contributors.
Dependencies and code review
Dependency advisories
Security Watch
1 vulnerable package (1 advisories) across 389 scanned dependencies.
nanoid 3.3.16
1 advisory. Fixed in 3.3.18.
How it can be abusedThis bug only bites code that passes a custom alphabet generator to nanoid with a size of zero, which would make the browser tab hang forever instead of returning an ID. Filament's JavaScript uses nanoid just to generate random IDs with the default settings, so an attacker has no realistic way to trigger this; it mainly affects developers who wrote their own custom generator.
- highGHSA-2v37-7h3g-55p8nanoid: custom generators can loop indefinitely when size is zero
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required