Livewire 4.x bumps bundled Alpine to 3.16.3

Livewire 4.x picks up a fresh patch of Alpine. PR #10584 updates the version constraints for alpinejs and all ten bundled @alpinejs/* plugins from ^3.16.2 to ^3.16.3, and regenerates package-lock.json directly from the real npm registry. The PR was validated with a clean npm install, the full JavaScript test suite (110 passed, 1 skipped), a production asset build, a production npm audit reporting zero vulnerabilities, and green runs across both GitHub matrices. It lands as a chore-level dependency release: no Livewire API changes, no new features, and nothing to migrate in your application code. If you are coming from Livewire v3.8.10, this is simply the Alpine patch line your app will run on once you move to the 4.x series.

What changed

Eleven packages were bumped in package.json, and every matching entry in the lockfile was repointed to 3.16.3 with fresh resolved URLs and sha512 integrity hashes:

• alpinejs (Alpine core)
• @alpinejs/anchor
• @alpinejs/collapse
• @alpinejs/csp
• @alpinejs/focus
• @alpinejs/intersect
• @alpinejs/mask
• @alpinejs/morph
• @alpinejs/persist
• @alpinejs/resize
• @alpinejs/sort

Because the constraints use the caret range (^3.16.3), any install from this lockfile resolves to exactly 3.16.3, while fresh installs of the package resolve to that version or a compatible later patch. The lockfile was regenerated from the live npm registry rather than hand-edited, which is why every resolved and integrity value changed alongside the version numbers.

Why bundling Alpine matters here

Livewire ships a compiled bundle that includes Alpine and these ten plugins, served to your users through the @livewireScripts directive. Most Livewire applications never install Alpine themselves — they inherit whatever version Livewire compiled into its distribution assets. That makes bumps like this one the mechanism by which upstream Alpine patch fixes reach the vast majority of apps: you get them the moment you update Livewire, with zero action required on your side.

There is a supply-chain angle too. The new lockfile pins verified integrity hashes for every package, and the production npm audit run against it reports zero vulnerabilities. The CSP plugin build continues to share the same ~3.5.40 range of @vue/reactivity with Alpine core, so no duplicate copies of that dependency are introduced.

What it looks like in your components

The directives and magic provided by the bundled plugins are unchanged — they just come from the newer patch. For example, this typical component uses three of the bumped packages (collapse, persist, and intersect) without any modification:

<div x-data="{ open: false, theme: $persist('light') }">
    <button @click="open = !open">Filters</button>

    <div x-show="open" x-collapse>
        <div x-intersect.once="loadSuggestions()">
            {{-- lazy-loaded content --}}
        </div>
    </div>
</div>

If you want to confirm what your app is running after upgrading, open the browser console and check:

Alpine.version // "3.16.3"

Since this is a patch release on the 3.16 line, the risk of behavioral surprises in code like the above is minimal, but it is worth a quick skim of Alpine's 3.16.3 changelog if your app leans heavily on any single plugin.

If you build your own bundle

Teams that opt out of the bundled script and compile Alpine themselves — for example, to tree-shake or register custom plugins via the Livewire.alpine hook — manage their own Alpine dependency. In that case, align your constraint with Livewire 4.x so you are not running a mismatched patch:

{
    "dependencies": {
        "alpinejs": "^3.16.3",
        "@alpinejs/collapse": "^3.16.3",
        "@alpinejs/persist": "^3.16.3"
    }
}

Run npm update alpinejs @alpinejs/* and rebuild your assets after bumping. If your app only consumes @livewireScripts, you can ignore this section entirely — Livewire handles the version for you.

Upgrade impact from v3.8.10

For anyone moving from Livewire v3.8.10 to the 4.x line, this PR contributes no migration work of its own. The v3 series carried its own bundled Alpine, and v4 now carries 3.16.3; your components, directives, and magic properties continue to work as before, subject only to whatever upstream patch fixes 3.16.3 includes. Update Livewire, rebuild if you compile assets, and you are done:

composer require livewire/livewire "^4.0"

No configuration changes, no new service provider steps, and no breaking directives are introduced by this change.

Takeaways

• PR #10584 bumps Alpine core and all ten bundled plugins from 3.16.2 to 3.16.3 on the 4.x branch, with a fully regenerated, registry-verified lockfile.
• Apps using the bundled @livewireScripts receive the new Alpine patch automatically — no code or config changes required.
• If you compile Alpine yourself, bump your own constraints to ^3.16.3 and rebuild to stay in sync.
• Validation was thorough: clean install, 110 passing JS tests, a successful production build, zero npm audit vulnerabilities, and green CI matrices.
• Risk is low: it is a patch-level dependency chore with no API surface changes for application code.

Sources

• Pull request #10584
• Release v4.4.7