Filament v4.12 & v5.7: Major Performance Improvements and Security Patches
As of v4.12.6 and v5.7.6, the Filament team has promoted a heavily tested beta into stable releases for both the v4 and v5 branches. The headline story is a dramatic reduction in server-side render time, but the release also bundles several security fixes and developer-experience improvements you should know about.
Action required: These releases resolve multiple CVEs. If you are running any version of Filament v4 or v5, update immediately.
Forms & Schema: Up to 92% Faster Rendering
The team replaced large portions of the repeated Blade component rendering paths with direct PHP rendering using native <?php tags. This eliminates framework overhead on every field and schema component. The internal benchmark results are striking:
| Component | Previous | Current | Change | |---|---|---|---| | TextInput | 0.559 ms | 0.044 ms | ~92% faster | | Select | 0.634 ms | 0.052 ms | ~92% faster | | FileUpload | 0.586 ms | 0.083 ms | ~86% faster | | Repeater (10 items, 2 fields) | 28.077 ms | 2.885 ms | ~90% faster | | Checkbox | 0.314 ms | 0.033 ms | ~90% faster |
The Repeater improvement is especially impactful. Complex, data-heavy forms that nest many repeater items will feel significantly snappier without any code changes on your end.
Tables: Up to 52% Faster Rendering
Building on a previous round of table optimizations, this release squeezes out even more performance through lighter rendering paths for common actions, more efficient attribute handling, and per-record caching of visibility and authorization checks.
| Scenario | Previous | Current | Change | |---|---|---|---| | 50 rows, 5 TextColumns, 3 row Actions | 27.53 ms | 13.11 ms | ~52% faster | | 50 rows, 5 TextColumns, 1 ActionGroup (3 actions) | 33.09 ms | 16.73 ms | ~49% faster |
Applications with many rows, conditional visibility rules, or per-row authorization checks will benefit the most.
Security Updates
CSS Color Value Sanitization
A new Str::sanitizeCssColor() helper sanitizes user input before it is injected into style="" attributes, preventing CSS injection attacks.
Opt-in CSV Formula Injection Protection
Cell values starting with =, -, +, or <Tab> can be interpreted as formulas by spreadsheet software like Excel. Filament now offers opt-in protection that prefixes such cells with a " character to force plain-text treatment. This is opt-in to avoid altering legitimate values such as international phone numbers.
Query Builder Rule & Nesting Limits
New maxRules() and maxNestingDepth() methods on the Query Builder let you cap the number of rules and nesting levels a user can apply. Both the UI and server-side payload validation respect these limits, preventing runaway CPU and memory usage from oversized rule trees.
Quality-of-Life Additions
modalDismissesParentActions()— close a modal and unwind all parent actions in a nested action chain, ideal for multi-step workflows.- Grouped user & tenant menu items — register visually separated groups of menu items; actions are memoized once per request.
- Empty states for chart widgets — distinguish a broken chart from a valid but empty data set.
- Click-through modals & slide-overs — opt in to remove the blocking backdrop so users can interact with content behind the overlay.
- Stable navigation keys — reference parent navigation items by a stable key rather than their display label, avoiding breakage with translations or dynamic labels.
- Per-column search-term splitting — configure how search terms are split on a column-by-column basis.
- Conditional export columns — show or hide export columns dynamically via closures.
- Dynamic
maxContentWidth(), sidebar width, dark mode, and theme switcher — all now accept closures for runtime configuration.
Key Takeaways
- Update to v4.12.6 or v5.7.6 immediately to pick up CVE patches.
- Form fields render up to 92% faster; Repeater components see a ~90% reduction in render time.
- Table rendering is up to 52% faster, with per-record authorization caching.
- New security helpers cover CSS injection and CSV formula injection.
maxRules()andmaxNestingDepth()protect Query Builder endpoints from abuse.- All improvements ship as a non-breaking minor release—no migration required.
Source: Major performance improvements & security patches for Filament v4.12 and v5.7 — Laravel News
