From 0a35b5441e2f348b1130172c51e0b8053f3ad238 Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 19:45:48 +0000 Subject: [PATCH] Require patched Laravel versions in both applications [skip ci] --- composer.json | 2 +- composer.lock | 46 ++++++++--------- microservice/composer.json | 2 +- microservice/composer.lock | 20 ++++---- .../Unit/LaravelSecurityFloorContractTest.php | 50 +++++++++++++++++++ 5 files changed, 85 insertions(+), 35 deletions(-) create mode 100644 tests/Unit/LaravelSecurityFloorContractTest.php diff --git a/composer.json b/composer.json index ad8f3a6..734ad64 100644 --- a/composer.json +++ b/composer.json @@ -15,7 +15,7 @@ "durable-workflow/waterline": "^2.0", "durable-workflow/workflow": "^2.22.0", "laravel/ai": "^0.6.0", - "laravel/framework": "^13.30", + "laravel/framework": "^13.41.0", "laravel/mcp": "^0.6.0", "laravel/tinker": "^3.0" }, diff --git a/composer.lock b/composer.lock index f8d8737..3a8c070 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "257ec6f4169d25ea0016821e3c5d0376", + "content-hash": "70c995dd92d85de30aaa45dbb7f64d19", "packages": [ { "name": "apache/avro", @@ -1710,16 +1710,16 @@ }, { "name": "laravel/framework", - "version": "v13.34.0", + "version": "v13.41.0", "source": { "type": "git", "url": "https://github.com/laravel/framework.git", - "reference": "c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4" + "reference": "95934d2868c90c1aa8e711791ea33d1e990e1719" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/laravel/framework/zipball/c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4", - "reference": "c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4", + "url": "https://api.github.com/repos/laravel/framework/zipball/95934d2868c90c1aa8e711791ea33d1e990e1719", + "reference": "95934d2868c90c1aa8e711791ea33d1e990e1719", "shasum": "" }, "require": { @@ -1740,12 +1740,12 @@ "guzzlehttp/promises": "^2.0.3 || ^3.0", "guzzlehttp/psr7": "^2.9 || ^3.0", "guzzlehttp/uri-template": "^1.0 || ^2.0", - "laravel/prompts": "^0.3.11", + "laravel/prompts": "^0.3.25", "laravel/serializable-closure": "^2.0.10", "league/commonmark": "^2.8.1", "league/flysystem": "^3.25.1", "league/flysystem-local": "^3.25.1", - "league/uri": "^7.5.1", + "league/uri": "^7.6", "monolog/monolog": "^3.10", "nesbot/carbon": "^3.8.4", "nunomaduro/termwind": "^2.0", @@ -1822,11 +1822,12 @@ "spatie/once": "*" }, "require-dev": { - "ably/ably-php": "^1.0", + "ably/pubsub-server": "^1.0|^2.0", "aws/aws-sdk-php": "^3.322.9", "ext-gmp": "*", "fakerphp/faker": "^1.24", - "intervention/image": "^4.0", + "intervention/image": "^4.2", + "jasonmccreary/double": "^1.1", "laravel/pint": "^1.18", "league/flysystem-aws-s3-v3": "^3.25.1", "league/flysystem-ftp": "^3.25.1", @@ -1835,10 +1836,10 @@ "league/flysystem-sftp-v3": "^3.25.1", "mockery/mockery": "^1.6.10", "opis/json-schema": "^2.4.1", - "orchestra/testbench-core": "^11.5.0", + "orchestra/testbench-core": "^11.6.0", "pda/pheanstalk": "^7.0.0 || ^8.0.0", "php-http/discovery": "^1.15", - "phpstan/phpstan": "2.2.15", + "phpstan/phpstan": "2.3.5", "phpunit/phpunit": "^11.5.50 || ^12.5.8 || ^13.0.3", "predis/predis": "^2.3 || ^3.0", "rector/rector": "2.6.3", @@ -1851,7 +1852,7 @@ "web-token/jwt-library": "^4.1" }, "suggest": { - "ably/ably-php": "Required to use the Ably broadcast driver (^1.0).", + "ably/pubsub-server": "Required to use the Ably broadcast driver (^1.0|^2.0).", "aws/aws-sdk-php": "Required to use the SQS queue driver, DynamoDb failed job storage, and SES mail driver (^3.322.9).", "brianium/paratest": "Required to run tests in parallel (^7.0 || ^8.0).", "ext-apcu": "Required to use the APC cache driver.", @@ -1865,7 +1866,7 @@ "ext-redis": "Required to use the Redis cache and queue drivers (^4.0 || ^5.0 || ^6.0).", "fakerphp/faker": "Required to generate fake data using the fake() helper (^1.23).", "filp/whoops": "Required for friendly error pages in development (^2.14.3).", - "intervention/image": "Required to use the image processing features (^4.0).", + "intervention/image": "Required to use the image processing features (^4.2).", "laravel/tinker": "Required to use the tinker console command (^2.0).", "league/flysystem-aws-s3-v3": "Required to use the Flysystem S3 driver (^3.25.1).", "league/flysystem-ftp": "Required to use the Flysystem FTP driver (^3.25.1).", @@ -1937,7 +1938,7 @@ "issues": "https://github.com/laravel/framework/issues", "source": "https://github.com/laravel/framework" }, - "time": "2026-09-29T12:46:21+00:00" + "time": "2026-11-10T15:44:39+00:00" }, { "name": "laravel/mcp", @@ -2014,16 +2015,16 @@ }, { "name": "laravel/prompts", - "version": "v0.3.24", + "version": "v0.3.27", "source": { "type": "git", "url": "https://github.com/laravel/prompts.git", - "reference": "5d3cdef29e93ca3b62b1871359db3078cd99908b" + "reference": "abdfc75a1ae6c6f21522daed50da7124cbff09d2" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/laravel/prompts/zipball/5d3cdef29e93ca3b62b1871359db3078cd99908b", - "reference": "5d3cdef29e93ca3b62b1871359db3078cd99908b", + "url": "https://api.github.com/repos/laravel/prompts/zipball/abdfc75a1ae6c6f21522daed50da7124cbff09d2", + "reference": "abdfc75a1ae6c6f21522daed50da7124cbff09d2", "shasum": "" }, "require": { @@ -2066,10 +2067,9 @@ ], "description": "Add beautiful and user-friendly forms to your command-line applications.", "support": { - "issues": "https://github.com/laravel/prompts/issues", - "source": "https://github.com/laravel/prompts/tree/v0.3.24" + "source": "https://github.com/laravel/prompts/tree/v0.3.27" }, - "time": "2026-08-20T12:55:36+00:00" + "time": "2026-11-09T16:07:10+00:00" }, { "name": "laravel/serializable-closure", @@ -7131,12 +7131,12 @@ "version": "v5.7.0", "source": { "type": "git", - "url": "https://github.com/vlucas/phpdotenv.git", + "url": "https://github.com/phpdotenv/phpdotenv.git", "reference": "301c07936b16d88628b126b01d082ba153cf4c40" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40", + "url": "https://api.github.com/repos/phpdotenv/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40", "reference": "301c07936b16d88628b126b01d082ba153cf4c40", "shasum": "" }, diff --git a/microservice/composer.json b/microservice/composer.json index cc90e52..dc54cbc 100644 --- a/microservice/composer.json +++ b/microservice/composer.json @@ -13,7 +13,7 @@ "durable-workflow/sdk": "^3.11.0", "durable-workflow/workflow": "^2.22.0", "durable-workflow/waterline": "^2.0", - "laravel/framework": "^12.69", + "laravel/framework": "^12.72.0", "laravel/tinker": "^2.10.1" }, "require-dev": { diff --git a/microservice/composer.lock b/microservice/composer.lock index b84d2ed..2109045 100644 --- a/microservice/composer.lock +++ b/microservice/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "eedffe0500e11c3890f0d50a9eb54e5f", + "content-hash": "74c7dc15f72ffdc9f9f960a4ab532160", "packages": [ { "name": "apache/avro", @@ -1427,16 +1427,16 @@ }, { "name": "laravel/framework", - "version": "v12.69.3", + "version": "v12.72.0", "source": { "type": "git", "url": "https://github.com/laravel/framework.git", - "reference": "58ea544a2a80dc03c168e13a5dc9a1d176a88717" + "reference": "b089d3020e508f49b3625726ab4a2c897f1b78d5" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/laravel/framework/zipball/58ea544a2a80dc03c168e13a5dc9a1d176a88717", - "reference": "58ea544a2a80dc03c168e13a5dc9a1d176a88717", + "url": "https://api.github.com/repos/laravel/framework/zipball/b089d3020e508f49b3625726ab4a2c897f1b78d5", + "reference": "b089d3020e508f49b3625726ab4a2c897f1b78d5", "shasum": "" }, "require": { @@ -1549,10 +1549,10 @@ "league/flysystem-sftp-v3": "^3.25.1", "mockery/mockery": "^1.6.10", "opis/json-schema": "^2.4.1", - "orchestra/testbench-core": "^10.9.0", + "orchestra/testbench-core": "^10.15.0", "pda/pheanstalk": "^5.0.6|^7.0.0", "php-http/discovery": "^1.15", - "phpstan/phpstan": "^2.1.41", + "phpstan/phpstan": "2.2.13", "phpunit/phpunit": "^10.5.35|^11.5.3|^12.0.1", "predis/predis": "^2.3|^3.0", "resend/resend-php": "^0.10.0|^1.0", @@ -1645,7 +1645,7 @@ "issues": "https://github.com/laravel/framework/issues", "source": "https://github.com/laravel/framework" }, - "time": "2026-09-29T12:53:25+00:00" + "time": "2026-11-10T15:45:11+00:00" }, { "name": "laravel/prompts", @@ -6647,12 +6647,12 @@ "version": "v5.7.0", "source": { "type": "git", - "url": "https://github.com/vlucas/phpdotenv.git", + "url": "https://github.com/phpdotenv/phpdotenv.git", "reference": "301c07936b16d88628b126b01d082ba153cf4c40" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40", + "url": "https://api.github.com/repos/phpdotenv/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40", "reference": "301c07936b16d88628b126b01d082ba153cf4c40", "shasum": "" }, diff --git a/tests/Unit/LaravelSecurityFloorContractTest.php b/tests/Unit/LaravelSecurityFloorContractTest.php new file mode 100644 index 0000000..ebc5407 --- /dev/null +++ b/tests/Unit/LaravelSecurityFloorContractTest.php @@ -0,0 +1,50 @@ + '13.41.0', + 'microservice' => '12.72.0', + ]; + + public function test_application_constraints_exclude_affected_framework_versions(): void + { + foreach (self::APPLICATION_FLOORS as $directory => $floor) { + $composer = $this->readJson($directory.'/composer.json'); + $constraint = $composer['require']['laravel/framework'] ?? null; + + $this->assertIsString($constraint, $directory); + $this->assertMatchesRegularExpression('/^\^\d+\.\d+\.\d+$/D', $constraint, $directory); + $this->assertTrue(version_compare(substr($constraint, 1), $floor, '>='), $directory); + } + } + + public function test_application_locks_exclude_affected_framework_versions(): void + { + foreach (self::APPLICATION_FLOORS as $directory => $floor) { + $lock = $this->readJson($directory.'/composer.lock'); + $packages = array_column($lock['packages'], null, 'name'); + $version = $packages['laravel/framework']['version'] ?? null; + + $this->assertIsString($version, $directory); + $this->assertTrue(version_compare(ltrim($version, 'v'), $floor, '>='), $directory); + } + } + + /** @return array */ + private function readJson(string $path): array + { + return json_decode( + (string) file_get_contents(dirname(__DIR__, 2).'/'.$path), + true, + flags: JSON_THROW_ON_ERROR, + ); + } +}