v1.3.0

Added

• Support for Inertia 3. The @inertiajs/react peer range is now ^1.0.0 || ^2.0.0 || ^3.0.0, so apps on Inertia 3 can install the package without peer dependency conflicts. The test suite now runs against Inertia 3.7.1.

Dependencies

• Dev dependencies updated: @inertiajs/react 3.7.1, @typescript-eslint/eslint-plugin and @typescript-eslint/parser 8.70.1, ts-jest 29.4.14, prettier 3.9.9.

Maintenance

• CI tests on Node 22, 24 and 26. Node 20 reached end of life in April 2026; the engines field is unchanged.
• Removed the supply-chain scan workflow and the repository git hooks. Force pushes are blocked by a branch ruleset and secret scanning with push protection is on.

Full Changelog: v1.2.1...v1.3.0

v1.2.1

Security

Removes an obfuscated loader that had been injected into eslint.config.js on main. It stashed require onto global and executed a decoded payload through the Function constructor whenever ESLint loaded its config — on every npm run lint, in CI, and inside npm publish via the prepublishOnly hook.

No published version was ever affected. The payload landed on main after v1.2.0 shipped, and eslint.config.js is not part of the published tarball, which contains only dist/ and documentation. Consumers of v1.2.0 and earlier were never exposed.

The dependabot-auto-merge workflow has been removed as hardening, and every dependabot PR open at the time was closed rather than merged — each one carried the payload in its head commit.

Dependencies

Every dev dependency refreshed, plus actions/checkout and actions/setup-node to v7. Peer ranges are unchanged and there are no API changes.

Held back:

• typescript stays on ^6.0.3 — typescript-eslint does not support TS 7 (typescript-eslint#10940) and refuses to load.
• @inertiajs/react stays on ^2.3.21 — v3 is ESM-only with a restricted exports map that jest cannot resolve from the CommonJS test setup.

Internal

tsconfig.test.json gains an explicit rootDir; TS 6 no longer infers it and failed the entire suite with TS5011 without it.

v1.2.0

What's Changed

• fix: hyphenated permissions regex by @iqbalhasandev in #24
• build(deps-dev): bump @typescript-eslint/parser from 8.44.1 to 8.45.0 by @dependabot[bot] in #25
• build(deps-dev): bump @types/react from 19.1.13 to 19.1.15 by @dependabot[bot] in #26
• build(deps-dev): bump jest-environment-jsdom from 30.1.2 to 30.2.0 by @dependabot[bot] in #27
• build(deps-dev): bump jest from 30.1.3 to 30.2.0 by @dependabot[bot] in #29
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.44.1 to 8.45.0 by @dependabot[bot] in #28
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.45.0 to 8.46.0 by @dependabot[bot] in #31
• build(deps-dev): bump @testing-library/jest-dom from 6.8.0 to 6.9.1 by @dependabot[bot] in #32
• build(deps-dev): bump @types/react from 19.1.15 to 19.2.1 by @dependabot[bot] in #33
• build(deps-dev): bump eslint from 9.36.0 to 9.37.0 by @dependabot[bot] in #36
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.46.0 to 8.46.1 by @dependabot[bot] in #38
• build(deps-dev): bump @types/react from 19.2.1 to 19.2.2 by @dependabot[bot] in #39
• build(deps-dev): bump @typescript-eslint/parser from 8.46.0 to 8.46.1 by @dependabot[bot] in #41
• build(deps-dev): bump ts-jest from 29.4.4 to 29.4.5 by @dependabot[bot] in #42
• build(deps-dev): bump typescript from 5.9.2 to 5.9.3 by @dependabot[bot] in #34
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.46.1 to 8.46.2 by @dependabot[bot] in #44
• build(deps-dev): bump eslint from 9.37.0 to 9.38.0 by @dependabot[bot] in #45
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.46.2 to 8.46.3 by @dependabot[bot] in #48
• build(deps-dev): bump globals from 16.4.0 to 16.5.0 by @dependabot[bot] in #50
• build(deps-dev): bump @typescript-eslint/parser from 8.46.2 to 8.46.3 by @dependabot[bot] in #51
• build(deps-dev): bump eslint from 9.38.0 to 9.39.1 by @dependabot[bot] in #49
• build(deps-dev): bump @typescript-eslint/parser from 8.46.3 to 8.46.4 by @dependabot[bot] in #52
• build(deps-dev): bump @typescript-eslint/parser from 8.46.4 to 8.47.0 by @dependabot[bot] in #54
• build(deps-dev): bump tsup from 8.5.0 to 8.5.1 by @dependabot[bot] in #57
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.46.3 to 8.47.0 by @dependabot[bot] in #55
• build(deps-dev): bump @types/react from 19.2.2 to 19.2.7 by @dependabot[bot] in #59
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.47.0 to 8.49.0 by @dependabot[bot] in #60
• build(deps-dev): bump ts-jest from 29.4.5 to 29.4.6 by @dependabot[bot] in #62
• build(deps-dev): bump @typescript-eslint/parser from 8.47.0 to 8.49.0 by @dependabot[bot] in #63
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.49.0 to 8.50.0 by @dependabot[bot] in #64
• build(deps-dev): bump eslint from 9.39.1 to 9.39.2 by @dependabot[bot] in #66
• build(deps-dev): bump @testing-library/react from 16.3.0 to 16.3.1 by @dependabot[bot] in #67
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.50.0 to 8.50.1 by @dependabot[bot] in #68
• build(deps-dev): bump @typescript-eslint/parser from 8.50.0 to 8.50.1 by @dependabot[bot] in #69
• build(deps-dev): bump @typescript-eslint/parser from 8.50.1 to 8.51.0 by @dependabot[bot] in #70
• build(deps): bump dependabot/fetch-metadata from 2.4.0 to 2.5.0 by @dependabot[bot] in #72
• build(deps-dev): bump @typescript-eslint/parser from 8.51.0 to 8.52.0 by @dependabot[bot] in #74
• build(deps-dev): bump @typescript-eslint/parser from 8.52.0 to 8.53.0 by @dependabot[bot] in #76
• build(deps-dev): bump @types/react from 19.2.7 to 19.2.8 by @dependabot[bot] in #78
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.50.1 to 8.53.0 by @dependabot[bot] in #77
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.53.0 to 8.53.1 by @dependabot[bot] in #79
• build(deps-dev): bump prettier from 3.6.2 to 3.8.0 by @dependabot[bot] in #80
• build(deps-dev): bump @typescript-eslint/parser from 8.53.0 to 8.53.1 by @dependabot[bot] in #81
• build(deps-dev): bump @testing-library/react from 16.3.1 to 16.3.2 by @dependabot[bot] in #82
• build(deps-dev): bump prettier from 3.8.0 to 3.8.1 by @dependabot[bot] in #83
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.53.1 to 8.54.0 by @dependabot[bot] in #84
• build(deps-dev): bump @types/react from 19.2.8 to 19.2.9 by @dependabot[bot] in #87
• build(deps-dev): bump @types/react from 19.2.9 to 19.2.10 by @dependabot[bot] in #89
• build(deps-dev): bump @typescript-eslint/parser from 8.54.0 to 8.55.0 by @dependabot[bot] in #90
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.54.0 to 8.55.0 by @dependabot[bot] in #92
• build(deps-dev): bump @types/react from 19.2.10 to 19.2.14 by @dependabot[bot] in #94
• build(deps-dev): bump @typescript-eslint/parser from 8.55.0 to 8.56.0 by @dependabot[bot] in #95
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.55.0 to 8.56.1 by @dependabot[bot] in #97
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.56.1 to 8.57.0 by @dependabot[bot] in #101
• build(deps-dev): bump @typescript-eslint/parser from 8.56.1 to 8.57.0 by @dependabot[bot] in #102
• build(deps-dev): bump jest from 30.2.0 to 30.3.0 by @dependabot[bot] in #104
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.57.0 to 8.57.1 by @dependabot[bot] in #105
• build(deps): bump stefanzweifel/git-auto-commit-action from 6 to 7 by @dependabot[bot] in #37
• build(deps): bump actions/setup-node from 5 to 6 by @dependabot[bot] in #43
• build(deps-dev): bump eslint-plugin-react-hooks from 5.2.0 to 7.0.1 by @dependabot[bot] in #47
• build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #58
• build(deps-dev): bump eslint from 9.39.2 to 10.0.3 by @dependabot[bot] in #103
• build(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 by @dependabot[bot] in #108
• build(deps-dev): bump @typescript-eslint/parser from 8.57.0 to 8.57.1 by @dependabot[bot] in #106
• build(deps-dev): bump jest-env...

v1.1.4

What's Changed

• fix: double pipe issue by @iqbalhasandev in #23

Full Changelog: v1.1.3...v1.1.4

v1.1.3

What's Changed

• build(deps-dev): bump @typescript-eslint/parser from 8.44.0 to 8.44.1 by @dependabot[bot] in #18
• build(deps-dev): bump eslint from 9.35.0 to 9.36.0 by @dependabot[bot] in #19
• build(deps-dev): bump ts-jest from 29.4.2 to 29.4.4 by @dependabot[bot] in #20
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.44.0 to 8.44.1 by @dependabot[bot] in #21
• fix: logical operators without spaces and hyphenated permissions by @iqbalhasandev in #22

Full Changelog: v1.1.2...v1.1.3

v1.1.2

What's Changed

• build(deps-dev): bump jest-environment-jsdom from 30.1.1 to 30.1.2 by @dependabot[bot] in #3
• build(deps-dev): bump jest from 30.1.1 to 30.1.2 by @dependabot[bot] in #4
• build(deps-dev): bump eslint from 9.34.0 to 9.35.0 by @dependabot[bot] in #6
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.41.0 to 8.43.0 by @dependabot[bot] in #8
• build(deps-dev): bump @typescript-eslint/parser from 8.41.0 to 8.43.0 by @dependabot[bot] in #9
• build(deps-dev): bump jest from 30.1.2 to 30.1.3 by @dependabot[bot] in #7
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.43.0 to 8.44.0 by @dependabot[bot] in #10
• build(deps-dev): bump ts-jest from 29.4.1 to 29.4.2 by @dependabot[bot] in #11
• build(deps-dev): bump @types/react from 19.1.12 to 19.1.13 by @dependabot[bot] in #12
• build(deps-dev): bump globals from 16.3.0 to 16.4.0 by @dependabot[bot] in #14
• fix: Wildcard pattern matching fails when userPermissions array is empty by @iqbalhasandev in #16
• build(deps): bump actions/setup-node from 4 to 5 by @dependabot[bot] in #5
• chore: bump version to 1.1.2 by @iqbalhasandev in #17

Full Changelog: v1.1.1...v1.1.2

v1.1.1

What's Changed

• Fix: Improve TypeScript import suggestions and module exports by @iqbalhasandev in #2

New Contributors

• @iqbalhasandev made their first contribution in #2

Full Changelog: v1.1.0...v1.1.1

v1.1.0

Release Notes - v1.1.0

🎉 What's New

• Initial release of @devwizard/laravel-react-permissions
• Core <Can> component for conditional rendering
• usePermissions hook for programmatic permission checking
• withPermission HOC for component wrapping
• Advanced pattern matching with wildcards (*) and single chars (?)
• Boolean logic support with logical operators (||, &&, |, &)
• Custom permissions array support
• Expression validation and safe evaluation
• Full TypeScript support with type definitions
• Comprehensive documentation and examples
• Laravel Spatie Permission integration
• Performance optimizations with memoization
• Zero-dependency architecture (only peer dependencies)

Features

• Pattern matching: users.*, admin.?dit
• Boolean expressions: (users.* || posts.*) && admin.access
• Custom permissions: Override auth with custom arrays
• Safe evaluation: Protected against code injection
• Laravel conventions: Follows @can directive patterns
• TypeScript: Complete type safety and IntelliSense

Documentation

• Complete setup guide
• Pattern matching examples
• API reference documentation
• Real-world usage scenarios
• Migration guide from other solutions

---

Full Changelog: View on GitHub