Cairn Passes 200 Installs: Releases Bring the Users

Cairn, our privacy-first analytics package for Laravel, has passed 200 installs on Packagist. The second hundred took three weeks where the first took ten, and the daily numbers show that new releases are what bring people to it.

Cairn, our open-source, privacy-first analytics package for Laravel, has passed 200 installs on Packagist. The count stands at 219 this week. When we wrote about passing 100 on 11 October it was 130, so the second hundred arrived in a little over three weeks, where the first took ten.

The monthly figure tells the same story. Last time, 55 of the 130 installs had come in the previous month. Now it is 114, roughly double.

Installs follow releases

Packagist publishes a daily install count, and laid against the release dates the pattern is hard to miss. Almost every busy day is a release day:

8 August, 0.4.0: 6 installs, the most since launch.
7 and 8 September, 1.2.0 and 1.2.1: 22 installs over two days, double the whole week before them.
16 September, 1.2.2: 15 installs, on a day between two flat weeks.
24 October, 1.3.0: 9 installs, joint second-best day of October.

Between releases, through August and September, the count went quiet. From 9 to 15 September it recorded no installs at all, and the fortnight after 1.2.2 added eight.

Some of each spike is our own doing. Three of our sites run Cairn, and each of them pulls a new version when it ships. Composer counts those, and CI runs, the same as anyone else's. So we read a release-day spike as people noticing that something changed rather than as a precise count of new users. A new version lists the package at the top of Packagist's recent releases, puts a fresh commit on GitHub and gives us a reason to write something like the 1.3.0 release notes. Each of those is a place someone can find it.

What changed in October

October looks different. Since 5 October Cairn has had only three days without an install, and it has averaged about four a day, release or no release. A floor like that is not something we can trigger by tagging a version. It suggests people are finding the package through search, links and word of mouth as well as through the release feed.

We cannot tell you who they are. Cairn records no IP addresses and sets no cookies by default, and that applies to how we measure the package too. Packagist downloads are the only figure we have, and they say nothing about whether an install is still running a week later. They do say the interest is no longer arriving only when we ship something.

What that means for the roadmap

The lesson we take from it is simple: keep shipping small, useful changes, and say clearly what each one does. Each release since 1.0 has done one of two things. It has shown a number Cairn already recorded and never displayed, such as languages, Core Web Vitals and, in 1.3.0, slowest routes. Or it has fixed something a real install tripped over, like the Laravel 13 beacon in 1.2.1 or the JSON API in 1.3.0. Both kinds came from running the package on our own sites and from the issue tracker, and we plan to keep working that way.

If you are new to Cairn, the current version is 1.3.0:

composer require divoto/cairn:^1.3
php artisan migrate

That is the whole install. The dashboard is at /cairn.

What has not changed

The rules that held at 100 installs hold at 200. No IP address is stored anywhere. Nothing is written to a visitor's device in the default configuration. The visitor hash rotates its salt every 24 hours and the old salt is destroyed. The architecture tests that assert each of those run on every release.

Thank you

To everyone who has installed it, filed an issue or linked to it: thank you. Cairn has one star on GitHub, and that number lags well behind the installs. If the package is useful to you, a star is the cheapest way to help the next person find it.