[dependabot]

Bumps realrashid/sweet-alert from 7.3.2 to 8.0.0.

Release notes

Sourced from realrashid/sweet-alert's releases.

v8.0.0 — a complete rewrite

Version 8 rebuilds the package around a fluent, Laravel-native builder. The v7 API was one 700-line Toaster class; v8 is three purpose-built builders, five composable concerns, three enums, and a test suite that covers behaviour rather than the shape of the code.

Your existing code keeps working. alert()->success(), toast() and confirmDelete() display immediately the way they always did. A survey of five real applications using this package found Alert::success() in 52 files and none of the changed signatures anywhere.

Highlights

• AlertBuilder, ToastBuilder and InputBuilder, each with its own defaults
• Full SweetAlert2 coverage — deny buttons, progress steps, every input type, pre-confirm and pre-deny routes, per-alert themes, animations
• PHP 8.3 enums (AlertType, InputType, Position) with IDE completion
• when()/unless() and macro() on every builder
• @sweetAlert Blade directive, replacing @include('sweetalert::alert')
• Livewire v4 trait and Inertia middleware
• Laravel Boost guideline and skill, so AI assistants write v8 rather than v7
• VitePress documentation, Pest suite with architecture tests, Pint, PHPStan level 5

Guarded actions

A dialog that can only ask a question is half a feature. v8 acts on the answer with no JavaScript on your side:

<a href="{{ route('posts.destroy', $post) }}" data-confirm-delete>Delete</a>
<a href="{{ route('posts.publish', $post) }}" data-confirm data-confirm-method="PUT">Publish</a>
<form method="POST" action="{{ route('orders.refund', $order) }}" data-confirm>
@​csrf
<button type="submit">Refund</button>
</form>

Override the copy per element with data-confirm-title, -text, -icon, -button and -cancel. On confirm the package builds a form with the CSRF token and the right method and submits it.

data-confirm-delete worked this way before, but only on the request where confirmDelete() had been flashed — on any other render the link was an ordinary link and the browser opened the destroy URL with a GET. The listener is always present now. Closes #174 and #183.

SweetAlert2 is fetched on the first click, so a page carrying only a guarded link ships no JavaScript until someone uses it. If it cannot be fetched, the browser's own confirm() is used — a guarded delete never goes through unasked because a CDN was down.

submitTo()

The answer reaches your server instead of vanishing when the dialog closes:

Alert::input('What should we call you?')
    ->submitTo(route('profile.name'), 'POST', 'name')
    ->flash();

Closes #147.

topLayer()

... (truncated)

Changelog

Sourced from realrashid/sweet-alert's changelog.

v8.0.0 — a complete rewrite - 2026-09-07

Version 8 rebuilds the package around a fluent, Laravel-native builder. The v7 API was one 700-line Toaster class; v8 is three purpose-built builders, five composable concerns, three enums, and a test suite that covers behaviour rather than the shape of the code.

Your existing code keeps working. alert()->success(), toast() and confirmDelete() display immediately the way they always did. A survey of five real applications using this package found Alert::success() in 52 files and none of the changed signatures anywhere.

Highlights

• AlertBuilder, ToastBuilder and InputBuilder, each with its own defaults
• Full SweetAlert2 coverage — deny buttons, progress steps, every input type, pre-confirm and pre-deny routes, per-alert themes, animations
• PHP 8.3 enums (AlertType, InputType, Position) with IDE completion
• when()/unless() and macro() on every builder
• @sweetAlert Blade directive, replacing @include('sweetalert::alert')
• Livewire v4 trait and Inertia middleware
• Laravel Boost guideline and skill, so AI assistants write v8 rather than v7
• VitePress documentation, Pest suite with architecture tests, Pint, PHPStan level 5

Guarded actions

A dialog that can only ask a question is half a feature. v8 acts on the answer with no JavaScript on your side:

<a href="{{ route('posts.destroy', $post) }}" data-confirm-delete>Delete</a>
<a href="{{ route('posts.publish', $post) }}" data-confirm data-confirm-method="PUT">Publish</a>
<form method="POST" action="{{ route('orders.refund', $order) }}" data-confirm>
@​csrf
<button type="submit">Refund</button>
</form>

Override the copy per element with data-confirm-title, -text, -icon, -button and -cancel. On confirm the package builds a form with the CSRF token and the right method and submits it.

data-confirm-delete worked this way before, but only on the request where confirmDelete() had been flashed — on any other render the link was an ordinary link and the browser opened the destroy URL with a GET. The listener is always present now. Closes #174 and #183.

SweetAlert2 is fetched on the first click, so a page carrying only a guarded link ships no JavaScript until someone uses it. If it cannot be fetched, the browser's own confirm() is used — a guarded delete never goes through unasked because a CDN was down.

submitTo()

The answer reaches your server instead of vanishing when the dialog closes:

Alert::input('What should we call you?')
    ->submitTo(route('profile.name'), 'POST', 'name')
    ->flash();

Closes #147.

... (truncated)

Commits

• c89e518 Move code style and static analysis into their own CI job
• 4aba29a Merge pull request #198 from realrashid/dependabot/npm_and_yarn/docs/nanoid-3...
• b207d42 Bump nanoid from 3.3.11 to 3.3.18 in /docs
• 54210f6 Release v8.0.0 — complete rewrite with a fluent builder API
• See full diff in compare view

[rbruhn]

Replaced by #112, which also updates the middleware namespace, config, view and deploy task that v8 changed.