Appearance
Updates
Tells the administrators when a newer kitloom is out and whether it fixes a security hole; the site sends its version, PHP, edition and a random id, nothing more.
kitloom/ · admins: kitloom/, kitloom/
Video lessons
Recorded in the Filament admin; the Nova admin works the same way.
kitloom is installed with Composer, so a site never updates itself: whoever runs the server does, with two commands. This module makes sure they hear about it. Twice a day the site asks kitloom's update server which releases came after the version it runs, and the administrators see the answer: what is new, which release fixes a security hole, and what to run.
What you see
Updates in the admin: the version you run, the releases since then (newest first), each with a short summary and a link to its changelog entry, and the commands that take the site there:
bashcomposer update "kitloom/*" php artisan migrateThey are run in the site's folder on your machine; then the new
composer.is deployed as any change is (Deployment). A release that fixes a security hole is shown in red. A new major version says which line oflock composer.to change first. Packages on another version than the rest (held back by a constraint, or a working copy) are listed below.json A badge on the menu with the number of releases waiting, red when one of them is a security release.
News: with kitloom/notifications, kitloom update is a topic of the owner's channels (Telegram, Slack, email…), under Site health, ticked on a new channel. Each release is told once: its version, "with a security fix" in the title when it has one, what changed and the command that updates; a new major version says first which constraint to change. Untick it on the channel to hear of releases only on the Updates screen.
The console:
php artisan kitloom:shows the same.updates --asks now,refresh --answers for a script, and the command exits with 1 while a security release waits, so a CI job or a cron mail can fail on it.json An AI agent connected through kitloom/ai reads the version and what waits in
describe_. It cannot update the site: that needs Composer on the server.site
Who sees all this: the permission See which kitloom releases are out (WordPress's update_), which administrators get when the module is installed. Change it on Users → Roles.
What the site sends, and what it does not
One request twice a day, and when an administrator presses Check now, to https://:
| Sent | Example |
|---|---|
| kitloom's version | 1. |
| PHP's version, without the patch | 8. |
| The edition: the admins the site has | Filament, Nova, Both, None |
| A random id the site made for itself | 3f6c1a0e- |
Nothing else: not the site's address, not its modules or themes, nothing about its users or content. The values travel in the request's headers, not in its address. The id is drawn from nothing — not the app key, not the domain — so it says no more than "the same site as last time"; it lets kitloom count sites once, not twice a day. A staging site made from a copy of production's database carries production's id; php artisan kitloom: gives it one of its own.
What kitloom keeps of it, and for how long, is in the privacy policy: no IP address, the id with the version, PHP and edition it last said, deleted after 90 days without a check.
Turning it off
dotenv
KITLOOM_UPDATE_CHECK=falseThen the site sends nothing and makes no id; the Updates screen links to the changelog instead. A server that may not reach out can ask a mirror instead: KITLOOM_.
A site that runs kitloom from a branch (dev-, a path repository) never asks: there is no release to compare with.
How the check runs
On Laravel's schedule (php artisan schedule: every minute, as for the rest of kitloom): twice a day, at a minute and an hour of the site's own, so thousands of sites do not ask at once. Without cron, opening the Updates screen checks when the last answer is more than a day old. The answer is kept in the cache, not in the database — a cache cleared on deploy only means the next check comes sooner. When the update server cannot be reached, the last answer stays, with the error beside it.
Configuration
config/ (php artisan vendor:):
| Key | What |
|---|---|
check (KITLOOM_) | false: never ask |
feed (KITLOOM_) | where to ask |
timeout | seconds before a check gives up (5) |
ai. | false: nothing in an agent's describe_ |
notifications. | false: no topic for the owner's channels |
filament., nova. | false: no Updates screen in that admin |
For developers
Kitloom\ — status() (an Update: the installed version, the releases waiting, whether one is a security release, when it was checked, the last error), check(), is. Events\ is dispatched once per new release (the newest when several came at once, with security when any of them fixes a hole).