Skip to content
Laraspring
Buy Laraspring
FeaturesAgentsPricingCompareChangelogDocsBuy Laraspring

Changelog

Every version, and what it left undone.

Each entry ends with what is known to be missing, because a changelog that only lists wins is an advertisement. Breaking changes and what to do about them are recorded in UPGRADING.md inside the repository.

v0.1.0

Feature-complete MVP

Every domain the kit promises is built and proved: eight Composer packages, one reference edition, 650 tests across nine suites. The API is not frozen, which is what the leading zero means, and a rename or a moved seam can still land before 1.0.

Core

  • laraspring/core — the contracts every other package resolves each other through: tenancy, locale, account status, membership quota and the billable tenant.
  • Packages are consumed through a Composer path repository with symlinks in development, so an edit is live with no reinstall.

Authentication

  • Registration, login, password reset and email verification.
  • Magic links: single-use through the cache, rate limited per email and IP, with the same response for an unknown address as for a known one.
  • Social sign-in through any Socialite provider you name, with identity linking by verified email.
  • Two-factor with QR enrolment, a confirm step that cannot lock a half-enrolled user out, eight single-use recovery codes and refusal of a replayed code from an earlier window.

Organizations and tenancy

  • Owner, admin and member, with every path that would leave an organization ownerless refused.
  • Invitations addressed to an email rather than a user: hashed token, temporary signed URL, expiry, revocation, and the destination remembered across sign-in or registration.
  • Optional and required modes, with no personal organization created behind a user’s back.
  • One endpoint switches the active organization; a middleware on the web group re-asks on every later request.

Billing

  • Stripe through Cashier, with checkout and subscription changes hosted by the provider.
  • A plan catalogue keyed by logical id; no provider price identifier ever reaches the browser.
  • Charge the organization or the user through a config key rather than a migration, on a Customer record the package owns.
  • Reads are local state kept current by webhooks, so a gated page load never depends on Stripe being up.
  • Paywall mode, and seats enforced across the organizations package through a contract.

Mail, storage and i18n

  • One branded email template every transactional message is drawn inside, plus a preview browser never registered in production.
  • Presigned direct-to-bucket uploads with a local fallback endpoint, per-type limits and rules, and a confirm step that measures the object rather than trusting the browser.
  • English and Spanish across every string in the kit, screens and email alike, with email sent in the recipient’s language even from a queue.

Administration

  • A panel inside the product rather than a second application, behind one ability and depending on no other kit package.
  • Suspension with a reason and an optional end date, refused at the password form, magic links and OAuth alike, closing an open session on its next request.
  • Impersonation with the rules that make it safe: never another administrator, a banner on every page, destructive actions refused, both ends audited.

For coding agents

  • AGENTS.md for somebody building on the kit, CONTRIBUTING.md for somebody changing it, and CLAUDE.md pointing Anthropic’s tools at the first.
  • Seven skills under .claude/skills/, every step citing a real file and a real command.
  • Six gates every change has to survive, plus each package’s own suite booted with no edition around it.
  • A translation parity test, so a missing string fails loudly instead of falling back to English and looking correct.

Getting started

  • PHP 8.3+, Composer 2 and Node 20+, and nothing else: SQLite, the log mailer and a local upload disk by default.
  • An idempotent bin/setup, and an opt-in demo seeder writing nine accounts, three organizations and the awkward states, none of which calls Stripe.

Known limits of this version

  • —One edition ships: Inertia 2 with React 19. Livewire and Vue are on the roadmap, not on disk.
  • —One payment provider ships: Stripe. Lemon Squeezy and Polar are on the roadmap, behind the contracts that already exist.
  • —Two locales ship: English and Spanish.
  • —The public API is not frozen until 1.0.