pushery / visual-feedback-for-laravel

v0.4.1 2026-09-04 18:59 UTC

Requires

• php: ^8.4
• ext-fileinfo: *
• ext-filter: *
• ext-hash: *
• ext-intl: *
• ext-json: *
• ext-mbstring: *
• laravel/framework: ^12.0 || ^13.0
• livewire/livewire: ^4.3
• psr/log: ^1.0 || ^2.0 || ^3.0

Requires (Dev)

• larastan/larastan: 3.10.0
• laravel/pao: ^1.1
• laravel/pint: ^1.0
• orchestra/testbench: ^10.0 || ^11.0
• pestphp/pest: ^5.0
• pestphp/pest-plugin-agent: ^5.0
• pestphp/pest-plugin-browser: ^5.0
• pestphp/pest-plugin-evals: ^5.0
• pestphp/pest-plugin-laravel: ^5.0
• pestphp/pest-plugin-phpstan: 5.2.0
• pestphp/pest-plugin-rector: 5.0.4
• pestphp/pest-plugin-type-coverage: ^5.0
• phpstan/phpstan: 2.2.12
• pushery/legal-consent-for-laravel: ^0.10 || ^0.11 || ^0.12 || ^0.13 || ^0.14 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19 || ^0.20 || ^0.21
• pushery/matomo-analytics-for-laravel: ^0.17 || ^0.19 || ^0.20 || ^0.21 || ^0.22 || ^0.23 || ^0.24 || ^0.25
• pushery/webhooks-for-laravel: ^2.0
• pushery/wirekit: ^2.21
• rector/rector: 2.6.5
• spaze/phpstan-disallowed-calls: 4.14.0

Suggests

• anthropic-ai/sdk: Score the bundled Boost skill with an LLM judge (composer test:evals). Deliberately not a dev dependency: without it every eval still runs and only the judge-backed expectations skip, so an ordinary test run costs nothing.
• pushery/legal-consent-for-laravel: ^0.10 — put the sentence legal-consent actually published on the guest's acknowledgment checkbox (privacy.source = legal-consent). It is a floor, not a preference: the bridge reads the acceptance fingerprint and the tenant from the returned document, and both arrived in 0.7. The floor is 0.10 because that is the release that made ui_wording nullable, and this bridge publishes documents without one — measured, not reasoned: a prefer-lowest run at 0.9.0 dies on NOT NULL constraint failed: legal_documents.ui_wording. 0.9 stood here until that run, which was the first this package ever had against its own floor.
• pushery/matomo-analytics-for-laravel: ^0.17 — Track feedback submissions as Matomo events. 0.17 is the oldest minor a test run here has actually covered, not a capability boundary: the bridge calls one method. For a 0.x package a caret is a ceiling as well as a floor, so each proven minor is named separately in require-dev rather than assumed.
• pushery/webhooks-for-laravel: ^2.0 — Deliver reports through signed webhooks via the WebhookChannel. 2.0 is a floor, not a preference: the bridge probes for the facade by its v2 name, Pushery\Webhooks\Facades\Webhooks, and v1 published the same class as Webhooks\Facades\Webhooks without the vendor prefix. On v1 that probe is simply false, so the platform fan-out disappears with no error at all — and a host that configured no webhook.url gets a job that throws instead of a delivery.
• pushery/wirekit: ^2.21 — publish the token-styled WireKit view tree (visual-feedback-wirekit) instead of the framework-free plain tree. 2.21 is a floor, not a preference: that tree builds its trigger from <x-wirekit::fab.button> with the placement prop and the accessible-name path that release introduced.

MIT

• laravel
• widget
• screenshot
• feedback
• livewire
• bug-report

Published on Packagist.org on 2026-09-04 18:59 UTC

README

Visual Feedback for Laravel

In-page feedback widget with client-side screenshot capture for Laravel and Livewire.

Your users see the bug. This gets you the picture — plus the browser, the viewport, the URL and the scroll position they were at — without asking them to explain any of it.

Install

composer require pushery/visual-feedback-for-laravel
php artisan vendor:publish --tag=visual-feedback

Then place the widget once in your layout and point the mail channel somewhere — VISUAL_FEEDBACK_MAIL_TO ships empty, and a report with nowhere to go still shows the reporter a success screen. Needs PHP 8.4+, Laravel 12+ and Livewire 4.3+.

What it does

• A Livewire widget in modal or inline mode — built-in floating button, standalone trigger, or a plain window event if you place your own.
• Screenshot capture in two stages: the browser's own screen capture where it exists, falling back silently to a DOM renderer that works everywhere, including iOS. The report records which stage produced the image.
• Region redaction that holds in both stages — the area is blacked out and input values cleared before anything is captured.
• Two view trees — framework-free, or WireKit components that inherit your design tokens.
• Delivery channels: mail, database and signed webhook, each isolated, individually queued, extensible with your own.
• Abuse protection with no external service — honeypot, server-anchored time trap and rate limits, running underneath any gate you add rather than instead of it, so a challenge provider being down can never leave the form unprotected. The honeypot and the time trap depend on nothing outside the request; the rate limits go through your cache, and what happens when that is down is a setting. The one deliberate off switch is abuse.min_fill_seconds = 0, which disarms the time trap — the value test suites reach for, and worth checking before it reaches a published config.
• Built to WCAG 2.1 AA, proven rather than asserted: a full axe sweep over every widget state in both trees, a keyboard-only run through the whole flow, and contrast measured on the values the browser actually rendered.

Documentation

Full docs: docs.pushery.com/visual-feedback-for-laravel

• Installation — requirements, publish tags, where the widget goes
• Configuration — every config key and its environment variable
• The capture cascade — the two stages, and which one produced a report
• Placing the trigger — the built-in button, your own, or the window event
• View trees — framework-free, or WireKit with your design tokens
• Delivery channels — mail, database, signed webhook, and adding your own
• Abuse protection — what the floor covers on its own, and the seam for adding your own gate
• Privacy and retention — the notice, and how long anything is kept
• Accessibility — what is proven, and the three things your page owes
• Integration contract — CORS, CSP, and what the DOM stage does not reproduce
• Testing — driving the widget from your own suite, and what the bundled suites already prove

Third-party notices

The capture bundle includes html2canvas-pro 2.4.1 (MIT). The version is named so you can match an advisory against what you actually ship.

Security

Please review the security policy and report vulnerabilities privately rather than opening a public issue.

Built by Pushery

This package is built and maintained by Pushery — a Berlin-based studio building Laravel applications, SaaS products, and open-source tools.

Building a Laravel UI? WireKit, Pushery's open-source Livewire component kit, gives you a polished component library out of the box. Browse the rest of our work at pushery.com.

License

The MIT License (MIT). See LICENSE for details.