Dependencies

composer.json and package.json are the source of truth for what is installed and at which version. This document does not mirror them — it explains the packages whose role is not obvious from the name, and records the constraints worth knowing before upgrading.

Current versions:

./vendor/bin/sail composer show --direct
npm ls --depth=0

Backend — what each non-obvious package is for

Application patterns

Package	Role
lorisleiva/laravel-actions	The AsAction trait behind everything in app/Actions. One class = one use case, usable as controller, job or command.
spatie/laravel-data	DTOs in app/Data; also the input to TypeScript generation.
foxbytehq/laravel-backed-enums	Enum metadata (label, color, icon) for app/Entities, exported to TS. Note the vendor: foxbytehq, not the older webfox.
spatie/laravel-typescript-transformer	Generates resources/js/types/generated.ts; customized by app/Transformers.
nunomaduro/essentials	Opinionated framework defaults (strict models, immutable dates, etc.) applied globally — check config/essentials.php before assuming stock Laravel behavior.

Platform services

Package	Role
laravel/fortify	Authentication backend. laravel/breeze is a dev dependency only — it scaffolded the original views and is not the runtime auth layer.
laravel/sanctum	SPA session guard / API tokens.
laravel/scout + meilisearch/meilisearch-php	Search indexing; always used through App\Traits\ShopSearchable.
laravel/horizon + spatie/laravel-horizon-watcher	Queue processing; the watcher restarts workers in dev when watched files change (config/horizon-watcher.php).
laravel/reverb	Self-hosted WebSocket server speaking the Pusher protocol.
laravel/ai	LLM client used by app/Ai tools; configured in config/ai.php.
spatie/laravel-pdf + spatie/browsershot	PDF rendering, driven against the chromium container rather than a local Chrome.
spatie/laravel-webhook-client	Signature verification & storage for inbound webhooks.
rlanvin/php-rrule	RFC 5545 recurrence rules for repeating schedules.
staudenmeir/eloquent-has-many-deep	Multi-hop relationships that Eloquent can't express natively.
pelmered/fake-car	Realistic vehicle data for factories and seeders (a production dependency because seeders use it).
symfony/mailgun-mailer	Transactional mail transport.
twilio/sdk	SMS delivery and inbound message webhooks.
paquettg/php-html-parser	Parsing scraped/third-party HTML in normalizers.

Observability

Package	Role
sentry/sentry-laravel	Errors & performance traces.
laravel/nightwatch	Production monitoring agent.
laravel/pulse	Local/prod metrics dashboard, extended by four community cards: aaronfrancis/pulse-outdated (outdated composer deps), hungthai1401/vulnerable (vulnerable deps), morrislaptop/laravel-pulse-4xx (4xx responses), hosmelq/laravel-pulse-schedule (scheduled tasks). Disabled in tests via PULSE_ENABLED=false.
spatie/laravel-activitylog	Audit trail, wired in through App\Traits\LogsActivity.
spatie/laravel-ray	Dev debugging output (ray.php).

Dev tooling

Package	Role
brianium/paratest	Backs artisan test --parallel.
laravel/pint	PHP formatting; rules in pint.json.
rector/rector + driftingly/rector-laravel	Automated refactors; config in rector.php.
laravel/boost	MCP server exposing app info, schema, logs and docs search to AI tooling (boost.json).
laravel/pail	Log tailing.
laravel/sail	The Docker dev environment every command is wrapped in.

Frontend — what each non-obvious package is for

Package	Role
@inertiajs/vue3 + @inertiajs/vite	SPA bridge and its Vite integration (SSR disabled in vite.config.js).
preline	Tailwind-based component library; auto-initialized in app.ts.
@headlessui-float/vue, vue-tippy	Floating elements and tooltips (v-tooltip).
vue-skeletor	Loading skeletons, registered globally in app.ts.
@vuepic/vue-datepicker, vanilla-calendar-pro	Date picking and the scheduling calendar.
vue-draggable-plus	Drag-and-drop lists (replaced the unmaintained vuedraggable).
@tiptap/*	Rich-text editing; lazy-loaded because of its size.
unplugin-vue-define-options	Enables defineOptions() — how pages declare their layout / noLayout.
@intlify/unplugin-vue-i18n	Compiles the Locales/ catalogs at build time.
vite-plugin-watch	Runs composer run transform-types and npm run generate:icons on source changes.
puppeteer	Local headless Chrome for PDF/HTML tasks.
@grazulex/shipmark	Release/changelog tooling (.shipmarkrc.yml).
eslint-plugin-import-x	Import rules under ESLint flat config (replaced eslint-plugin-import).
prettier-plugin-classnames, prettier-plugin-tailwindcss, prettier-plugin-organize-imports	Class-name wrapping, Tailwind class sorting, import sorting.

Upgrade Considerations

• Consult Laravel release notes when bumping laravel/framework; Horizon, Pulse, Reverb, Scout and Sanctum track major versions with it.
• Keep Tailwind aligned with @tailwindcss/vite, @tailwindcss/postcss and the forms/typography plugins.
• Upgrade Sentry packages (sentry/sentry-laravel, @sentry/vue, @sentry/vite-plugin) together.
• Rector upgrades can introduce broad refactors; run on a dedicated branch and re-run Pint afterward.
• Vitest and @vitest/coverage-v8 must stay on matching majors.

See standards.md for enforced style & static analysis rules.