Filament v4.16.0: Security, Lazy Loading & Bug Fixes | Mohamed Said [Skip to content](#main) [ ![](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed SaidLaravel Backend Engineer ](https://www.msaied.com) - [Home](https://www.msaied.com) - [Projects](https://www.msaied.com/projects) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [About](https://www.msaied.com#about) [ Contact](https://www.msaied.com#contact) Menu Menu ---- Close - [HomeStart here](https://www.msaied.com) - [ProjectsCase studies](https://www.msaied.com/projects) - [ArticlesEngineering notes](https://www.msaied.com/articles) - [CertificatesCredentials](https://www.msaied.com/certificates) - [AboutHow I work](https://www.msaied.com#about) - [ContactGet in touch](https://www.msaied.com#contact) [Start a conversation](https://www.msaied.com#contact) [WhatsApp](https://wa.me/201094619204) [Email](mailto:hello@msaied.com) 1. [Home](https://www.msaied.com) 2. / 3. [Articles](https://www.msaied.com/articles) 4. / 5. [Filament](https://www.msaied.com/articles?category=filament) 6. / 7. Filament v4.16.0 Released: Security Hardening, Lazy Loading APIs & More [Filament](https://www.msaied.com/articles?category=filament) [Livewire](https://www.msaied.com/articles?category=livewire) Filament v4.16.0 Released: Security Hardening, Lazy Loading APIs & More ============================================================================ Filament v4.16.0 ships with Livewire method restrictions, standardized lazy loading configuration, opt-in item processing limits, table pagination enforcement, and a wave of bug fixes for repeaters, rich editors, and bulk selection. ![](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) [Mohamed Said](https://www.msaied.com#person) Published 26 Oct 2026 · Updated 31 Oct 2026 · 4 min read ShareCopy linkCopied ![Filament v4.16.0 Released: Security Hardening, Lazy Loading APIs & More](https://cdn.msaied.com/811/06569a963be3a67e056761798af93374.png) On this page +1. [Filament v4.16.0: What's New](#filament-v4160-whats-new) 2. [New Features](#new-features) 3. [Restrict Livewire Methods and Lock Server-Managed State](#restrict-livewire-methods-and-lock-server-managed-state) 4. [Standardized Lazy Loading Configuration APIs](#standardized-lazy-loading-configuration-apis) 5. [Opt-In Item Processing Limits](#opt-in-item-processing-limits) 6. [Opt-In Table Pagination Option Enforcement](#opt-in-table-pagination-option-enforcement) 7. [Modal Eyebrow Above the Heading](#modal-eyebrow-above-the-heading) 8. [SpatieMediaLibrary File Attachment Conversion Support](#spatiemedialibrary-file-attachment-conversion-support) 9. [Preserve Trusted Rich Editor Custom Block HTML](#preserve-trusted-rich-editor-custom-block-html) 10. [Extracted Shared JavaScript Renderer Infrastructure](#extracted-shared-javascript-renderer-infrastructure) 11. [Notable Bug Fixes](#notable-bug-fixes) 12. [Key Takeaways](#key-takeaways) Filament v4.16.0: What's New ---------------------------- Released on 26 October 2026 by Dan Harrin, **Filament v4.16.0** is a feature and fix release that tightens security, improves consistency across configuration APIs, and resolves a range of edge-case bugs. Here is a detailed breakdown of everything that landed. --- New Features ------------ ### Restrict Livewire Methods and Lock Server-Managed State One of the headline changes in this release is the ability to restrict which Livewire methods can be called from the client side and to lock server-managed state so it cannot be tampered with from the browser. This is a meaningful security improvement for applications that expose sensitive admin panels to the internet. ### Standardized Lazy Loading Configuration APIs Lazy loading configuration has been unified across Filament components. Previously, different parts of the framework exposed slightly different APIs for controlling lazy loading behaviour. This PR standardizes those APIs so developers have a single, predictable pattern to follow regardless of which component they are configuring. ### Opt-In Item Processing Limits You can now set opt-in limits on how many items are processed in a single operation. This guards against accidental or malicious bulk operations that could overload your server or database. ### Opt-In Table Pagination Option Enforcement Similarly, table pagination options can now be enforced server-side on an opt-in basis, preventing clients from requesting arbitrarily large page sizes. ### Modal Eyebrow Above the Heading Contributor `@leek` added support for a modal **eyebrow** — a small label rendered above the modal heading. This is a common UI pattern for providing context (e.g. "Step 1 of 3" or a category label) without cluttering the heading itself. ### SpatieMediaLibrary File Attachment Conversion Support The `SpatieMediaLibraryFileAttachmentProvider` now supports conversions, contributed by first-time contributor `@r-e-m-y`. This makes it easier to serve resized or optimized variants of uploaded files directly through Filament's attachment system. ### Preserve Trusted Rich Editor Custom Block HTML Custom block HTML inside the rich editor is now preserved when the content is marked as trusted, preventing Filament from stripping valid custom markup during save or re-render cycles. ### Extracted Shared JavaScript Renderer Infrastructure A significant internal refactor extracts shared JavaScript renderer infrastructure into a common layer. This lays the groundwork for more consistent rendering behaviour across Filament's JavaScript-heavy components. --- Notable Bug Fixes ----------------- - **String relationship keys & SQL Server compatibility** — relationship keys that are strings are now preserved correctly, and SQL Server compatibility is improved. - **Repeater and builder item lists** — items are no longer lost from the list when new items are added. - **Field state on required description changes** — field state is preserved when the `required` description of a field changes dynamically. - **Required single toggle button selections** — selecting a required toggle button no longer loses the selection state. - **Bulk selection limit bypasses** — two separate PRs closed loopholes that allowed bulk selection limits to be bypassed, including when chunking records. - **RichEditor mentions stuck loading** — a race condition that left the mentions dropdown in a permanent loading state has been resolved. - **`filtersTriggerAction` and `columnManagerTriggerAction` click-through** — clicks on these trigger actions now propagate correctly. - **Action group visibility cache** — the visibility cache for action groups is cleared after a grouped action is called, preventing stale visibility states. - **Enum arrays when disabling sibling options** — enum-backed arrays are now handled correctly when disabling sibling checkbox/radio options. - **Keyboard access for copyable content** — copyable content inside focusable containers is accessible via keyboard again. --- Key Takeaways ------------- - Restrict Livewire methods and lock server state for stronger admin panel security. - Use the new unified lazy loading API across all Filament components. - Opt in to item processing limits and pagination enforcement to protect your server. - Add modal eyebrows for richer contextual UI in dialogs. - Multiple bulk selection and repeater bugs are resolved — upgrade if these affect you. - SQL Server users benefit from improved string relationship key handling. --- Source: [Filament v4.16.0 on GitHub](https://github.com/filamentphp/filament/releases/tag/v4.16.0) - [Filament](https://www.msaied.com/articles?search=Filament) - [Laravel](https://www.msaied.com/articles?search=Laravel) - [PHP](https://www.msaied.com/articles?search=PHP) - [Livewire](https://www.msaied.com/articles?search=Livewire) - [Release](https://www.msaied.com/articles?search=Release) - [Security](https://www.msaied.com/articles?search=Security) Frequently asked questions --------------------------- What security improvements does Filament v4.16.0 introduce?v4.16.0 adds the ability to restrict which Livewire methods can be invoked from the client side and to lock server-managed state, preventing browser-side tampering. It also closes two separate loopholes that allowed bulk selection limits to be bypassed. What are the new opt-in limits in Filament v4.16.0?There are two new opt-in protections: item processing limits, which cap how many items can be processed in a single operation, and table pagination option enforcement, which prevents clients from requesting page sizes outside the allowed set. How does the standardized lazy loading API affect existing Filament code?The change unifies previously inconsistent lazy loading configuration APIs across Filament components into a single predictable pattern. Existing code that already uses lazy loading may need minor adjustments to adopt the new standardized API. ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp)About the author ---------------- [Mohamed Said](https://www.msaied.com#person)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. [About](https://www.msaied.com#about) [GitHub ↗](https://github.com/EG-Mohamed) [LinkedIn ↗](https://www.linkedin.com/in/msaiedm/) [WhatsApp ↗](https://wa.me/201094619204) [Email Address ↗](mailto:hello@msaied.com) [My CV ↗](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) [Previous articleMastering Laravel Testing: A Video Course on Laravel Tests](https://www.msaied.com/articles/mastering-laravel-testing-a-video-course-on-laravel-tests) [Next articleFilament v5.8: Deferred Schema Loading, Table Grouping Improvements, and More](https://www.msaied.com/articles/filament-v58-deferred-schema-loading-table-grouping-improvements-and-more) On this page ------------- 1. [Filament v4.16.0: What's New](#filament-v4160-whats-new) 2. [New Features](#new-features) 3. [Restrict Livewire Methods and Lock Server-Managed State](#restrict-livewire-methods-and-lock-server-managed-state) 4. [Standardized Lazy Loading Configuration APIs](#standardized-lazy-loading-configuration-apis) 5. [Opt-In Item Processing Limits](#opt-in-item-processing-limits) 6. [Opt-In Table Pagination Option Enforcement](#opt-in-table-pagination-option-enforcement) 7. [Modal Eyebrow Above the Heading](#modal-eyebrow-above-the-heading) 8. [SpatieMediaLibrary File Attachment Conversion Support](#spatiemedialibrary-file-attachment-conversion-support) 9. [Preserve Trusted Rich Editor Custom Block HTML](#preserve-trusted-rich-editor-custom-block-html) 10. [Extracted Shared JavaScript Renderer Infrastructure](#extracted-shared-javascript-renderer-infrastructure) 11. [Notable Bug Fixes](#notable-bug-fixes) 12. [Key Takeaways](#key-takeaways) ### Have a technical challenge? Tell me what you’re building. I reply within two working days. [Start a conversation](https://www.msaied.com#contact) Related articles ----------------- [ ![](https://cdn.msaied.com/808/d118ca0a73009ac41175d54bc274a4d5.png) Laravel · 4 min read### Filament v5.8: Deferred Schema Loading, Table Grouping Improvements, and More 26 Oct 2026 ](https://www.msaied.com/articles/filament-v58-deferred-schema-loading-table-grouping-improvements-and-more) [ ![](https://cdn.msaied.com/810/7a7621033d764cdc5887dae467e11aad.png) Laravel · 3 min read### Mastering Laravel Testing: A Video Course on Laravel Tests 26 Oct 2026 ](https://www.msaied.com/articles/mastering-laravel-testing-a-video-course-on-laravel-tests) [ ![](https://cdn.msaied.com/809/0b89594a93580cc874cf4eb0da818f38.png) AI · 4 min read### Sloppy: Static Analysis for AI-Written PHP and Laravel Code 26 Oct 2026 ](https://www.msaied.com/articles/sloppy-static-analysis-for-ai-written-php-and-laravel-code) Have a technical challenge? ---------------------------- Tell me what you’re building. I reply within two working days. [Discuss your project ↗](https://www.msaied.com#contact) © 2026 Mohamed Said · Built with Laravel, meant to last.Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. - [Home](https://www.msaied.com) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [GitHub](https://github.com/EG-Mohamed) - [LinkedIn](https://www.linkedin.com/in/msaiedm/) - [WhatsApp](https://wa.me/201094619204) - [Email Address](mailto:hello@msaied.com) - [My CV](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) - [Sitemap](https://www.msaied.com/sitemap.xml)