Repository navigation
chore: upgrade to Laravel 13 - #92
Merged
Merged
Conversation
Bumps laravel/framework to 13.40, laravel/tinker to 3, brick/math to 0.14, fedeisas/laravel-mail-css-inliner to 6 and spatie/laravel-json-api-paginate to 2 (drops the removed base_url option). The Packagist advisories Composer listed affect 13.x releases before 13.30, not 13.40. - Exclude PreventRequestForgery instead of ValidateCsrfToken on the webhook routes; the alias no longer matches the web group's middleware, so webhooks got a 419. - Use #[Test] attributes, as PHPUnit 12 ignores /** @test */ and silently skipped the filter tests. - Fix the PHPStan errors from Laravel 13's narrower return types. Refs #31 Claude
brick/math 0.14 deprecates the upper snake case constants. Claude
Patch releases of livewire/livewire (4.4.8) and symfony/filesystem, html-sanitizer and yaml (8.1.11); composer audit now reports none. Claude
tomasvanrijsse
approved these changes
Nov 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #31
Upgrades to Laravel 13.40, following Boost's
/upgrade-laravel-v13guide.Changes
laravel/framework^13.40,laravel/tinker^3,brick/math^0.14.2,fedeisas/laravel-mail-css-inliner^6,spatie/laravel-json-api-paginate^2, Pest 4 / PHPUnit 12. The update also bumps Symfony to 8.1 / http-foundation 7.4.23, which fixes 7 of the 13 advisories in the current lock.PreventRequestForgery. TheValidateCsrfTokenalias doesn't match Laravel 13's web group, so GitHub and Bitbucket webhooks got a 419 (caught byCsrfProtectionTest)./** @test */is ignored, so the 9DateFilterTest/TextFilterTesttests were silently skipped. They now use#[Test].Collection::max(),option(), nullable$this->commandin seeders).RoundingMode::HALF_UPbecomesRoundingMode::HalfUp. The old constant is deprecated but behaves the same.Kept and follow-up
_uniqueKeyoverride stays: 13.40.0 still adds the random key (ResolvesJsonApiElements.php:467), and [13.x] Include identical BelongsToMany resources once in JSON:API compound documents laravel/framework#62360 isn't released yet. Follow-up: Drop the _uniqueKey override once laravel/framework#62360 is released #93.livewire/livewire4.4.8 andsymfony/filesystem,html-sanitizerandyaml8.1.11 fix the remaining advisories.composer auditnow reports none.Verification
composer docs:api: the only diffs inpublic/api.jsonare the local server URL and the order of the two auth error responses, so the API is unchangedClaude