Alpine.js bumped to 3.17.3 across Livewire 4.x

Livewire 4.x now ships with Alpine.js 3.17.3 instead of 3.17.2, both for the alpinejs core package and for all ten official Alpine plugins that Livewire bundles. This is a dependency-layer chore: package.json ranges were raised, the lockfile was regenerated with fresh registry integrity hashes, and the branch was rebased onto the current 4.x head. There are no changes to Livewire's PHP code, JavaScript API, directives, or configuration. If you are upgrading from v3.8.10 to Livewire 4, this particular change should require nothing from you beyond installing the new release — and if you import Alpine yourself, one small npm bump keeps your build in sync.

What changed

The pull request touches only two files, and both are dependency declarations:

• package.json — the version floor for alpinejs and every bundled plugin moved from ^3.17.2 to ^3.17.3.
• package-lock.json — locked versions and their resolved/integrity entries were regenerated against the npm registry for all eleven packages, so exact tarballs are pinned and reproducible.

The full list of packages affected is: alpinejs, plus the anchor, collapse, csp, focus, intersect, mask, morph, persist, resize, and sort plugins. That is the complete set Livewire compiles into its bundled Alpine build, which is why all ten are bumped together rather than piecemeal.

For example, a dependency block on 4.x now reads:

"dependencies": {
    "alpinejs": "^3.17.3",
    "@alpinejs/anchor": "^3.17.3",
    "@alpinejs/collapse": "^3.17.3",
    "@alpinejs/morph": "^3.17.3"
}

Why the floor bump matters

Livewire ships a prebuilt Alpine bundle. Whichever Alpine version is locked when the release assets are compiled is the version that actually runs in your browser when you load Alpine via @livewireScripts. Raising this floor means every fresh install of Livewire 4 — including CI pipelines and release builds — is guaranteed to compile against Alpine 3.17.3, an upstream patch release containing fixes from the Alpine team.

There is a subtle semver point worth understanding: ^3.17.2 already allows 3.17.3, so a loose npm install might have resolved the newer patch anyway. But lockfile-driven installs (npm ci) resolve exactly what the lockfile says, which was still 3.17.2. Declaring ^3.17.3 and regenerating the lockfile removes that ambiguity — 3.17.3 is now the guaranteed minimum everywhere, not merely a permitted version. The refreshed integrity hashes also pin the precise tarballs, keeping builds reproducible and protecting the supply chain.

What this means when upgrading from v3.8.10

Moving from v3.8.10 to Livewire 4 is a major-version upgrade with plenty to review, but this change is deliberately low-friction:

• If you use Livewire's bundled Alpine (the default, via @livewireScripts), you get Alpine 3.17.3 automatically. No action needed.
• If you import Alpine yourself — the common pattern when registering custom plugins or directives — your own package.json governs which Alpine you bundle. Bump it in lockstep:

npm install alpinejs@^3.17.3 @alpinejs/collapse@^3.17.3 @alpinejs/focus@^3.17.3

Then your app entry point continues to work as before:

import { Livewire, Alpine } from '../../vendor/livewire/livewire/dist/livewire.esm'
import Collapse from '@alpinejs/collapse'

Alpine.plugin(Collapse)
Livewire.start()

Keeping your self-managed alpinejs on the same version as Livewire's bundled plugins avoids subtle mismatches between core Alpine and plugin behavior.

Verification and stability

Because this touches what runs in every Livewire-powered browser session, the PR was validated thoroughly before merge:

• A fresh npm install and a clean npm ci both succeeded, confirming the lockfile is internally consistent.
• The production asset build passed, so the shipped bundle compiles cleanly against 3.17.3.
• The JavaScript suite passed with 110 tests (1 skipped, as expected).
• All 64 GitHub checks passed across both the original and ready-for-review matrices. Two isolated browser timing failures cleared on retry of the failed jobs only — a known flake pattern, not a product regression requiring code changes.

Takeaways

• Livewire 4.x requires Alpine 3.17.3: the core alpinejs package plus all ten bundled @alpinejs/* plugins.
• Bundled-Alpine users get the patch automatically with no action.
• Self-managed Alpine users should bump their own dependency to ^3.17.3 to stay in sync.
• The lockfile now guarantees 3.17.3 as the minimum version for npm ci and release builds, with refreshed integrity hashes for reproducibility.
• No PHP code, JavaScript API, or directive changes — upgrading from v3.8.10 carries no additional work from this PR.

Sources

• Pull request #10702
• Release v4.4.7