The 564,705-line checkout is a full commerce application
Bagisto's checkout has roughly 564,705 lines of source covering the ordinary work of running an online store. Its Laravel packages separate catalog, products, inventory, customers, checkout, sales, tax, shipping, payments, promotions, CMS pages, and the admin interface. Vue components and Blade templates drive the two visible sides: the public shop and the management panel. That breadth saves a Laravel team from inventing order state and catalog plumbing.
The size is also a warning against casual adoption. Our checkout contained 3,834 files and occupied 103.5 MB before npm installation. Custom work follows Bagisto's package structure, repositories, events, service providers, migrations, and frontend conventions. A developer can replace or extend large areas, but every altered checkout becomes a commerce application the team must secure, migrate, test, and keep compatible with later releases.
The 26-second npm path only covers assets
Our npm path installed 51 packages in 26 seconds and built the Vite assets in 4 seconds. That is a pleasantly small JavaScript layer for a repository of this size. The official quick route starts elsewhere with composer create-project, followed by an interactive Artisan installer. It asks for application and database configuration before serving a storefront, which our Node-focused sandbox did not attempt.
Installation added only 43 MB to our Node 22 image, while the real runtime has a longer bill. The current Composer file requires PHP 8.3 through 8.4 and several PHP extensions. Official prerequisites call for Composer 2.5 or newer, MySQL 8.0.32 or MariaDB 10.3, at least 4 GB of RAM, and Apache or Nginx. Those requirements are normal for Laravel commerce, though far beyond one npm command.
What happened when we ran it
Our test method used a fresh Node 22 sandbox at commit 3dc65fa. It installed 51 npm packages in 26 seconds and completed the build in 4 seconds. Npm audit reported 0 known vulnerabilities: 0 critical, 0 high, 0 moderate, and 0 low. The Vite asset graph compiled in that environment. A configured PHP application, database migration, browser checkout, payment, or email flow was outside the run.
The test step was skipped because package.json exposes only dev and build, with no test script or target. Our scan still found a tests directory and 5 CI workflow files. It also found a compose file but no repository Dockerfile, which matches the Sail setup: the application image builds from a Dockerfile supplied by installed Laravel vendor files. The 4-second build should not be presented as storefront verification.
Core packages cover retail, while multi-vendor is sold separately
The 564,705-line checkout has meaningful retail depth. Composer maps packages for configurable and booking products, cart and catalog rules, returns, GDPR, full-page cache, inventory, data transfer, multiple payment integrations, and social login. The architecture guide documents a standard module shape with routes, controllers, models, repositories, database migrations, language files, views, and tests. That consistency makes Bagisto approachable to a practiced Laravel developer.
The 3,834-file core should still be compared with the sales pages before scoping a project. Bagisto's README describes multi-vendor, multi-tenant, B2B, POS, mobile, and headless uses together. The linked multi-vendor page includes a Buy Now route to a separate marketplace product. If seller dashboards and commissions drive the purchase, obtain the exact module list, license terms, and upgrade policy before estimating the build.
PHP 8.3 and MySQL 8.0.32 set the operating floor
Bagisto's documented local floor is PHP 8.3 or 8.4, MySQL 8.0.32 or MariaDB 10.3, Composer 2.5+, and 4 GB of RAM. The installer writes environment settings, creates the schema, seeds data, links public storage, and creates the administrator. Production then adds a properly rooted web server, TLS, mail transport, payment secrets, backups, cache rules, and monitoring around a stateful application.
The included compose path shows the heavier development option. Beside Laravel, it declares MySQL, Redis, Elasticsearch 7.17.0, Kibana, and Mailpit. Our sandbox had 3 CPUs and 8 GB of RAM, but it did not start those services or measure their combined demand. Search indexing and queued jobs also need operators to keep their workers alive; the repository cannot supervise a production host by itself.
v2.5.0-beta2 and an open cache bug require staging
GitHub's newest release is named v2.5.0-beta2 and was published on September 8, 2026. The stable v2.4 line had reached v2.4.10 on August 21. One open v2.4 issue reports that editing a CMS page can leave cached copies stale for other locales, currencies, or logged-in customers. It carried a Bug Fixed label when fetched, but it was still open, so confirm the fix in the exact tag you deploy.
Our 51-package npm check had no test target to catch that server-side behavior. Bagisto does contain a tests directory, yet our lab did not execute a suite. The official upgrade guide assumes backups and staging, then walks through a fresh checkout, dependency installation, environment review, database migrations, storage copying, custom package copying, and cache clearing. That is a controlled release task, not an unattended update button.
September commits and 28 open items show active maintenance
GitHub recorded a push on September 11, 2026, one day after the cache report, and listed 28 issues and pull requests when fetched. The repository had 28,110 stars and several v2.4 releases across the preceding months. Recent commits merged admin and category fixes, while current issues include checkout state validation and multi-locale caching. Activity is frequent, and the combined open count is not a defect count.
Our run gives Bagisto a useful baseline: 26 seconds to install the 51 npm packages, 4 seconds to build, 43 MB on disk, and 0 npm audit findings. It does not settle the harder questions around PHP upgrades, checkout correctness, extension cost, or production operations. A Laravel agency can justify that work because the core already models a large share of retail. A small merchant without PHP ownership should favor a managed product or a simpler plugin stack.