Require patched Laravel floors and refresh the HTTP example

.github/workflows/ci.yml

@@ -333,8 +333,8 @@ jobs:
           - framework: Laravel
             version: '12'
             php: '8.2'
-            package: 'laravel/framework:^12.69.0'
-            exercised_package: 'laravel/framework:12.69.0'
+            package: 'laravel/framework:^12.72.0'
+            exercised_package: 'laravel/framework:12.72.0'
             bootstrap: fresh_supported_install
             script: laravel.php
           - framework: Symfony
@@ -656,15 +656,15 @@ jobs:
           - framework: Laravel
             version: '12'
             php: '8.4'
-            package: 'laravel/framework:^12.69.0'
-            exercised_package: 'laravel/framework:12.69.0'
+            package: 'laravel/framework:^12.72.0'
+            exercised_package: 'laravel/framework:12.72.0'
             bootstrap: fresh_supported_install
             script: laravel.php
           - framework: Laravel
             version: '13'
             php: '8.4'
-            package: 'laravel/framework:^13.30.0'
-            exercised_package: 'laravel/framework:13.30.0'
+            package: 'laravel/framework:^13.41.0'
+            exercised_package: 'laravel/framework:13.41.0'
             bootstrap: fresh_supported_install
             script: laravel.php
           - framework: Symfony
@@ -828,15 +828,15 @@ jobs:
           - framework: Laravel
             version: '12'
             php: '8.3'
-            package: 'laravel/framework:^12.69.0'
-            exercised_package: 'laravel/framework:12.69.0'
+            package: 'laravel/framework:^12.72.0'
+            exercised_package: 'laravel/framework:12.72.0'
             bootstrap: fresh_supported_install
             script: laravel.php
           - framework: Laravel
             version: '13'
             php: '8.3'
-            package: 'laravel/framework:^13.30.0'
-            exercised_package: 'laravel/framework:13.30.0'
+            package: 'laravel/framework:^13.41.0'
+            exercised_package: 'laravel/framework:13.41.0'
             bootstrap: fresh_supported_install
             script: laravel.php
     steps:

CHANGELOG.md

@@ -6,6 +6,13 @@ project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### Security
+
+- Raise the optional Laravel bridge floors to 12.72.0 and 13.41.0 for
+  the November concurrency and signed-URL advisories, reject affected installations before provider bindings,
+  and update the current qualification matrix and HTTP example dependency
+  graph. Historical qualification reports retain their original tuples (#421).
+
 ## [3.18.2] - 2026-11-13
 
 ### Fixed

composer.json

@@ -39,7 +39,7 @@
     },
     "suggest": {
         "ext-pcntl": "Required by framework console workers for graceful SIGINT and SIGTERM handling.",
-        "laravel/framework": "Enables the auto-discovered service-mode bridge on Laravel 12.69.0 or 13.30.0 and later releases of each major (the patched minimums for GHSA-f9x3-7vq9-cph6).",
+        "laravel/framework": "Enables the auto-discovered service-mode bridge on Laravel 12.72.0 or 13.41.0 and later releases of each major (the patched November 2026 security minimums).",
         "open-telemetry/api": "Optional worker tracing with the application's provider; supports API 1.10.1 and later in the 1.x line.",
         "symfony/framework-bundle": "Enables the Symfony 6.4, 7, and 8 service-mode bundle.",
         "symfony/console": "Required with symfony/framework-bundle to run the Symfony 6.4, 7, and 8 worker command."
@@ -97,7 +97,7 @@
             }
         },
         "durable-workflow": {
-            "product-train": "3.18.2",
+            "product-train": "3.18.3",
             "supported-server-versions": "2.5.0",
             "supported-server-release-baselines": {
                 "2": "2.5.0",
@@ -122,7 +122,7 @@
                 "external-payload-references": "opaque-reference"
             },
             "frameworks": {
-                "laravel": "^12.69.0|^13.30.0",
+                "laravel": "^12.72.0|^13.41.0",
                 "symfony": "^6.4|^7.0|^8.0"
             }
         }

docs/laravel-adoption-contract.json

@@ -3,14 +3,14 @@
   "schema_version": 1,
   "framework": {
     "package": "laravel/framework",
-    "constraint": "^12.69.0|^13.30.0",
+    "constraint": "^12.72.0|^13.41.0",
     "php_constraint": "^8.2",
     "qualification_matrix": [
-      {"laravel": "12", "php": "8.2", "package": "laravel/framework:^12.69.0", "exercised_package": "laravel/framework:12.69.0", "bootstrap": "fresh_supported_install"},
-      {"laravel": "12", "php": "8.3", "package": "laravel/framework:^12.69.0", "exercised_package": "laravel/framework:12.69.0", "bootstrap": "fresh_supported_install"},
-      {"laravel": "13", "php": "8.3", "package": "laravel/framework:^13.30.0", "exercised_package": "laravel/framework:13.30.0", "bootstrap": "fresh_supported_install"},
-      {"laravel": "12", "php": "8.4", "package": "laravel/framework:^12.69.0", "exercised_package": "laravel/framework:12.69.0", "bootstrap": "fresh_supported_install"},
-      {"laravel": "13", "php": "8.4", "package": "laravel/framework:^13.30.0", "exercised_package": "laravel/framework:13.30.0", "bootstrap": "fresh_supported_install"}
+      {"laravel": "12", "php": "8.2", "package": "laravel/framework:^12.72.0", "exercised_package": "laravel/framework:12.72.0", "bootstrap": "fresh_supported_install"},
+      {"laravel": "12", "php": "8.3", "package": "laravel/framework:^12.72.0", "exercised_package": "laravel/framework:12.72.0", "bootstrap": "fresh_supported_install"},
+      {"laravel": "13", "php": "8.3", "package": "laravel/framework:^13.41.0", "exercised_package": "laravel/framework:13.41.0", "bootstrap": "fresh_supported_install"},
+      {"laravel": "12", "php": "8.4", "package": "laravel/framework:^12.72.0", "exercised_package": "laravel/framework:12.72.0", "bootstrap": "fresh_supported_install"},
+      {"laravel": "13", "php": "8.4", "package": "laravel/framework:^13.41.0", "exercised_package": "laravel/framework:13.41.0", "bootstrap": "fresh_supported_install"}
     ]
   },
   "embedded_transition_authority": {

docs/portal/frameworks/laravel.md

@@ -17,11 +17,18 @@ next:
   <div class="choice"><h3>Cloud or Server</h3><p><code>durable-workflow/sdk</code> connects the same Laravel application structure to a separately operated namespace. The Laravel bridge keeps container resolution, configuration, Artisan, logging, events, and testing.</p></div>
 </div>
 
-The service-mode bridge supports Laravel 12.69.0 and 13.30.0, and later
-releases of each major (`^12.69.0|^13.30.0`). The Laravel bridge requires PHP
-8.2 or newer, with PHP 8.3 or newer for Laravel 13. These are the same patched
-framework and PHP floors published by Workflow 2.21.0 for embedded v2. The
-bare HTTP SDK continues to support PHP 8.1.
+The service-mode bridge supports Laravel 12.72.0 and 13.41.0, and later
+releases of each major (`^12.72.0|^13.41.0`). The Laravel bridge requires PHP
+8.2 or newer, with PHP 8.3 or newer for Laravel 13. These Laravel floors include
+the November security fixes:
+
+- [Task output injection](https://github.com/advisories/GHSA-63hm-g96r-2m2q)
+- [Signed URL query limits](https://github.com/laravel/framework/security/advisories/GHSA-v5ch-g375-82r6)
+- [Signed URL route parameters](https://github.com/laravel/framework/security/advisories/GHSA-6rv8-qj5v-p8ch)
+
+Embedded-to-service transitions require the installed Workflow package to
+publish the same Laravel and PHP support contract. The bare HTTP SDK continues
+to support PHP 8.1.
 
 SDK 3.10 removes Laravel 10 and 11 from service-mode framework support. Those
 majors are past their upstream end of life and have published advisories with

docs/portal/operate/upgrading.md

@@ -13,14 +13,14 @@ next:
 This guide covers PHP SDK {{ release.sdkVersion }} and its changes listed in the
 [changelog](https://github.com/durable-workflow/sdk-php/blob/main/CHANGELOG.md).
 The bare SDK retains PHP `^8.1`, and Symfony 6.4/7/8 support is unchanged.
-The Laravel bridge follows Workflow 2.21.0: PHP `^8.2` and patched Laravel
-`^12.69.0|^13.30.0`, with PHP 8.3 or newer for Laravel 13. SDK 3.10 removes
+The Laravel bridge requires PHP `^8.2` and patched Laravel
+`^12.72.0|^13.41.0`, with PHP 8.3 or newer for Laravel 13. SDK 3.10 removes
 Laravel 10/11 bridge support. Its provider checks the installed framework and
 PHP before registering application bindings, including during auto-discovery.
 Upgrade the platform before adopting this bridge; existing SDK 3.9.x and
-Workflow 2.20.x applications retain their own support contracts while upgrading.
-Stable-v1 authority remains unchanged. SDK 3.11 keeps these platform contracts
-and adds the occurrence-deadline rollout below.
+Workflow 2.20.x applications must also apply Laravel security updates while upgrading.
+Stable-v1 authority remains unchanged. SDK 3.11 adds the occurrence-deadline
+rollout below.
 
 ## Condition-wait occurrence deadlines
 

docs/quickstart-contract.json

@@ -3,8 +3,8 @@
   "schema_version": 2,
   "package": {
     "name": "durable-workflow/sdk",
-    "published_version": "3.18.2",
-    "composer_requirement": "3.18.2",
+    "published_version": "3.18.3",
+    "composer_requirement": "3.18.3",
     "onboarding_requirement": "^3.18"
   },
   "runtime_targets": {

docs/sdk-reference.md

@@ -10,11 +10,12 @@ runnable path.
 - **Laravel adoption:** start with the [ownership-first transition
   guide](https://php.durable-workflow.com/frameworks/laravel/) when moving a
   Laravel Workflow v1 application to v2 embedded or service mode, or when
-  moving embedded v2 to service mode. The SDK 3.10 bridge and Workflow 2.21.0
-  support PHP `^8.2` and patched Laravel `^12.69.0|^13.30.0`; Laravel 13 needs
-  PHP 8.3 or newer. The bare SDK retains PHP `^8.1`. Existing SDK 3.9.x and
-  Workflow 2.20.x applications keep their release's support contract while
-  upgrading PHP and Laravel. Stable-v1 authority is unchanged.
+  moving embedded v2 to service mode. The current bridge supports PHP `^8.2`
+  and patched Laravel `^12.72.0|^13.41.0`; Laravel 13 needs PHP 8.3 or newer.
+  Embedded-to-service transitions require the installed Workflow package to
+  publish that same support contract. The bare SDK retains PHP `^8.1`.
+  Existing applications must apply Laravel security updates while upgrading.
+  Stable-v1 authority is unchanged.
 - **Plain PHP service mode:** follow the quickstart below when a framework-neutral
   application and remote worker connect to Durable Workflow Cloud or a
   self-hosted Server.
@@ -878,12 +879,11 @@ and the shipped [client](../examples/message-stream-client.php) and
 
 ## Laravel service mode
 
-Patched Laravel `^12.69.0|^13.30.0` applications auto-discover the provider from
+Patched Laravel `^12.72.0|^13.41.0` applications auto-discover the provider from
 the SDK package. The bridge requires PHP `^8.2`, with PHP 8.3 or newer for
 Laravel 13. The provider refuses unsupported or unknown installed framework/PHP
 versions before registering config, clients or workers. Upgrade PHP and Laravel
-before adopting this bridge, or retain the existing SDK 3.9.x release while
-upgrading the platform. The bare SDK's PHP `^8.1` support remains independent.
+before adopting this bridge. The bare SDK's PHP `^8.1` support remains independent.
 Publish the environment-backed configuration, add attributed handler services,
 and start the supervised Artisan command. The worker process needs `ext-pcntl`;
 the command refuses to start without it so `SIGINT` and `SIGTERM` always drain

examples/laravel-http/composer.json

@@ -6,7 +6,7 @@
     "require": {
         "php": "^8.3",
         "durable-workflow/sdk": "3.9.1",
-        "laravel/framework": "12.69.3",
+        "laravel/framework": "12.72.0",
         "laravel/octane": "2.21.0",
         "spiral/roadrunner-cli": "^2.6.0",
         "spiral/roadrunner-http": "^3.3.0"

src/Bridge/Laravel/LaravelPlatform.php

@@ -10,8 +10,8 @@
 final class LaravelPlatform
 {
     private const PLATFORMS = [
-        12 => ['floor' => '12.69.0', 'php' => 80200],
-        13 => ['floor' => '13.30.0', 'php' => 80300],
+        12 => ['floor' => '12.72.0', 'php' => 80200],
+        13 => ['floor' => '13.41.0', 'php' => 80300],
     ];
 
     public static function laravelConstraint(): string
@@ -41,7 +41,7 @@ public static function assertSupported(?string $laravelVersion, int $phpVersionI
         throw new RuntimeException(
             'The Durable Workflow Laravel bridge requires PHP ^8.2 and Laravel '.self::laravelConstraint()
             .'; Laravel 13 requires PHP ^8.3. Upgrade the application platform before activating the bridge'
-            .' or retain the existing SDK 3.9.x release while upgrading.',
+            .'. The bare HTTP client remains available independently of this optional bridge.',
         );
     }
 }

tests/FrameworkBridgeTest.php

@@ -277,7 +277,7 @@ public function testComposerMetadataAdvertisesOptionalSupportedFrameworks(): voi
             $manifest['extra']['laravel']['providers'],
         );
         self::assertSame(
-            '^12.69.0|^13.30.0',
+            '^12.72.0|^13.41.0',
             $manifest['extra']['durable-workflow']['frameworks']['laravel'],
         );
         self::assertSame('^6.4|^7.0|^8.0', $manifest['extra']['durable-workflow']['frameworks']['symfony']);

tests/LaravelAdoptionContractTest.php

@@ -32,11 +32,11 @@ public function testBridgeCompatibilityMatchesTheEmbeddedLaravelSurface(): void
             'The optional Laravel bridge floor must not raise the bare HTTP SDK floor.');
         self::assertSame(
             [
-                ['laravel' => '12', 'php' => '8.2', 'package' => 'laravel/framework:^12.69.0', 'exercised_package' => 'laravel/framework:12.69.0', 'bootstrap' => 'fresh_supported_install'],
-                ['laravel' => '12', 'php' => '8.3', 'package' => 'laravel/framework:^12.69.0', 'exercised_package' => 'laravel/framework:12.69.0', 'bootstrap' => 'fresh_supported_install'],
-                ['laravel' => '13', 'php' => '8.3', 'package' => 'laravel/framework:^13.30.0', 'exercised_package' => 'laravel/framework:13.30.0', 'bootstrap' => 'fresh_supported_install'],
-                ['laravel' => '12', 'php' => '8.4', 'package' => 'laravel/framework:^12.69.0', 'exercised_package' => 'laravel/framework:12.69.0', 'bootstrap' => 'fresh_supported_install'],
-                ['laravel' => '13', 'php' => '8.4', 'package' => 'laravel/framework:^13.30.0', 'exercised_package' => 'laravel/framework:13.30.0', 'bootstrap' => 'fresh_supported_install'],
+                ['laravel' => '12', 'php' => '8.2', 'package' => 'laravel/framework:^12.72.0', 'exercised_package' => 'laravel/framework:12.72.0', 'bootstrap' => 'fresh_supported_install'],
+                ['laravel' => '12', 'php' => '8.3', 'package' => 'laravel/framework:^12.72.0', 'exercised_package' => 'laravel/framework:12.72.0', 'bootstrap' => 'fresh_supported_install'],
+                ['laravel' => '13', 'php' => '8.3', 'package' => 'laravel/framework:^13.41.0', 'exercised_package' => 'laravel/framework:13.41.0', 'bootstrap' => 'fresh_supported_install'],
+                ['laravel' => '12', 'php' => '8.4', 'package' => 'laravel/framework:^12.72.0', 'exercised_package' => 'laravel/framework:12.72.0', 'bootstrap' => 'fresh_supported_install'],
+                ['laravel' => '13', 'php' => '8.4', 'package' => 'laravel/framework:^13.41.0', 'exercised_package' => 'laravel/framework:13.41.0', 'bootstrap' => 'fresh_supported_install'],
             ],
             $this->contract['framework']['qualification_matrix'],
         );
@@ -48,13 +48,13 @@ public function testBridgeCompatibilityMatchesTheEmbeddedLaravelSurface(): void
         ], $this->contract['embedded_transition_authority']);
     }
 
-    public function testServiceModePublishesThePatchedLaravelFloorsForGhsaF9x37vq9Cph6(): void
+    public function testServiceModePublishesThePatchedLaravelFloorsForGhsa63hmG96r2m2q(): void
     {
-        // The maintained majors and patched floors published by Workflow 2.21.0.
-        $floors = '^12.69.0|^13.30.0';
+        // Current maintained majors and the CVE-2026-128083 patched floors.
+        $floors = '^12.72.0|^13.41.0';
         self::assertSame($floors, $this->contract['framework']['constraint']);
         self::assertSame($floors, $this->composer['extra']['durable-workflow']['frameworks']['laravel']);
-        foreach (['12.69.0', '13.30.0'] as $floor) {
+        foreach (['12.72.0', '13.41.0'] as $floor) {
             self::assertStringContainsString($floor, $this->composer['suggest']['laravel/framework']);
         }
         self::assertArrayNotHasKey('laravel/framework', $this->composer['conflict'] ?? [],
@@ -133,16 +133,16 @@ static function (string $workflow) use ($search, $replace): string {
             "            php: '8.4'\n",
         ), 'A framework cell must use its job\'s fixed PHP minor.'];
         yield 'exact minimum removed from a cell' => [$first(
-            "            exercised_package: 'laravel/framework:12.69.0'\n",
+            "            exercised_package: 'laravel/framework:12.72.0'\n",
             '',
         ), 'The CI Laravel cells differ from the adoption contract.'];
         yield 'cell exercises a later 12.x release' => [$first(
-            "exercised_package: 'laravel/framework:12.69.0'",
-            "exercised_package: 'laravel/framework:12.70.0'",
+            "exercised_package: 'laravel/framework:12.72.0'",
+            "exercised_package: 'laravel/framework:12.73.0'",
         ), 'The CI Laravel cells differ from the adoption contract.'];
         yield 'cell exercises a caret range' => [$first(
-            "exercised_package: 'laravel/framework:12.69.0'",
-            "exercised_package: 'laravel/framework:^12.69.0'",
+            "exercised_package: 'laravel/framework:12.72.0'",
+            "exercised_package: 'laravel/framework:^12.72.0'",
         ), 'The CI Laravel cells differ from the adoption contract.'];
         yield 'no installed-version assertion after the SDK' => [static fn (string $workflow): string => str_replace(
             "              --no-interaction --prefer-dist --no-progress\n"