livewire/livewire: Alpine.js bumped to 3.17.1 on the 4.x branch (#10641)

Livewire bundles Alpine.js, so every Livewire release implicitly ships a specific Alpine version to your app. PR #10641 keeps that bundled copy current on the 4.x branch, bumping Alpine core and every official Alpine plugin from 3.17.0 to 3.17.1 ahead of the v4 release. The change is dependency-only — no PHP or JavaScript source code in Livewire was touched — and it was verified with a clean npm install, the full JavaScript test suite (110 passed, 1 skipped), and a production build. If you're upgrading from Livewire v3.8.10, here's what this means for you.

What changed in #10641

The diff is confined to package.json and package-lock.json. Eleven packages move from ^3.17.0 to ^3.17.1:

• alpinejs (the core)
• @alpinejs/anchor, @alpinejs/collapse, @alpinejs/csp, @alpinejs/focus, @alpinejs/intersect, @alpinejs/mask, @alpinejs/morph, @alpinejs/persist, @alpinejs/resize, @alpinejs/sort

Each lockfile entry now resolves to the published npm tarball with an updated integrity hash, which is what the PR title means by "from the published npm packages" — the versions are pinned to real registry artifacts, not git refs, so CI and local installs are reproducible. Deliberately untouched: @vue/reactivity ^3.2.45 (which Alpine uses internally as its reactivity engine, pinned around ~3.5.40 in the lockfile) and nprogress ^0.2.0 for progress indicators.

Why Livewire's Alpine version becomes your Alpine version

The key context for this PR is that Livewire ships Alpine inside its compiled JavaScript bundle. Whether you load Livewire via the @livewireScripts Blade directive or import from the vendor ESM bundle, the Alpine that boots in your browser is the one resolved from Livewire's own package.json. That's a deliberate design: it guarantees a compatible Alpine/Livewire pair out of the box with zero npm setup.

The flip side is that Alpine updates ride along with Livewire releases rather than your own composer or npm choices. Keeping the pinned version at the latest patch is how upstream Alpine fixes reach Livewire apps without anyone changing a line of their own code. Alpine 3.17.1 is a patch release — bug fixes rather than new features or breaking changes; consult Alpine's changelog for the itemized list — so this is routine maintenance, not a behavior shift.

Seeing the bump in your app

After upgrading to a Livewire build containing this PR, the bundled Alpine reports the new version. If you use the documented ESM pattern for registering Alpine plugins, the Alpine you import is the bundled copy:

// resources/js/livewire.js
import { Alpine, Livewire } from '../../vendor/livewire/livewire/dist/livewire.esm';
import focus from '@alpinejs/focus';

console.log(Alpine.version); // "3.17.1" after this bump

Alpine.plugin(focus);
Livewire.start();

If you use the plain @livewireScripts include instead, the same check works from the console:

{{-- Bundled Alpine now reports 3.17.1 --}}
@livewireScripts
<script>
    console.log(window.Alpine.version); // "3.17.1"
</script>

Upgrade impact from v3.8.10

For anyone coming from Livewire v3.8.10, this is about as low-risk as a change gets:

• No action required. The bump flows through the compiled bundle automatically; there are no new config options, no PHP API changes, and no directive changes (x-data, wire:model, and friends behave the same).
• Patch-level risk. Moving from Alpine 3.17.0 to 3.17.1 is a one-patch-version hop, validated by the full JavaScript suite and a production build as part of the PR.
• Self-managed Alpine is unaffected. If you install Alpine separately via npm and wire it up yourself, your version choice remains entirely yours — this PR only changes what Livewire bundles.
• Better bug triage. If you ever debug an Alpine-related issue on Livewire v4, reporting that you're on Alpine 3.17.1 keeps your report aligned with what Livewire ships, and rules out bugs already fixed upstream.

Takeaways

• PR #10641 bumps Alpine core and all ten bundled plugins from 3.17.0 → 3.17.1 on the 4.x branch; it's a dependency-only change.
• Nothing changes in Livewire's PHP, configuration, or public API — this is routine upstream maintenance.
• Verified with a clean install, the JavaScript suite (110 passed, 1 skipped), and a production build.
• Apps relying on Livewire's bundled Alpine will run 3.17.1 automatically after upgrading; teams managing their own Alpine installation are unaffected.
• Confirm the new bundle with Alpine.version (console or ESM import) once you're on the updated build.

Sources

• Pull request #10641
• Release v4.4.7