[dependabot]

Bumps laravel/framework from 13.34.0 to 13.40.0.

Release notes

Sourced from laravel/framework's releases.

v13.40.0

• [13.x] Fix Paginator::links() return type by @​dhrupo in laravel/framework#62226
• [13.x] Fix updating JSON paths with arrays and collections on MySQL and MariaDB by @​xurshudyan in laravel/framework#62225
• [13.x] Use the write connection in BelongsToMany createOrFirst lookup by @​xurshudyan in laravel/framework#62223
• [13.x] Drop check constraints when dropping columns on SQL Server by @​xurshudyan in laravel/framework#62222
• [13.x] Centralize + improve tests for InteractsWithData by @​inxilpro in laravel/framework#62217
• [13.x] Fix Redis tagged cache flush blocking Redis when flushing many tags by @​MohannadElemary in laravel/framework#62215
• [13.x] Qualify dropped and renamed indexes with the table schema on PostgreSQL by @​xurshudyan in laravel/framework#62213
• [13.x] Reconnect after losing the connection during a transaction by @​xurshudyan in laravel/framework#62211
• [13.x] Add missing PostgreSQL full text languages by @​xurshudyan in laravel/framework#62210
• [13.x] Add Queue::whenJobRunsLongerThan by @​jackbayliss in laravel/framework#62141
• [13.x] Fix named arguments in Cookie::queue() by @​xurshudyan in laravel/framework#62246
• [13.x] Fix ImageFile::default() returning a plain File rule by @​Marzaan in laravel/framework#62244
• [13.x] Fix pagination contracts render() return type by @​dhrupo in laravel/framework#62242
• [13.x] Fix SQL Server ignoring orderBy on update and delete with limit by @​xurshudyan in laravel/framework#62239
• [13.x] Preserve error_get_last() for suppressed errors by @​xurshudyan in laravel/framework#62228
• Prepare reusable development environments for Amp orbs by @​DGarbs51 in laravel/framework#62231
• Allow $middleware->replace() to accept an array of replacements by @​ziadoz in laravel/framework#62230
• [13.x] Show released jobs as released in queue:work output by @​jackbayliss in laravel/framework#62180
• Add $middleware->insertBefore() and $middleware->insertAfter() helper methods by @​ziadoz in laravel/framework#62261
• [13.x] Reconnect the Cloud log socket after a failed write by @​jamesdangercarpenter in laravel/framework#62258
• [13.x] Dispatch ScheduledTaskSkipped when a task already ran on another server by @​jackbayliss in laravel/framework#62256
• [13.x] Fix forceIndex() generating invalid SQL on SQLite for PRIMARY and multiple indexes by @​tharlei in laravel/framework#62255
• [13.x] Add Schedule::whenTaskRunsLongerThan by @​jackbayliss in laravel/framework#62233
• [13.x] Roll back to savepoint on concurrency errors in nested transactions by @​xurshudyan in laravel/framework#62248
• [13.x] Fix toResourceCollection() on filtered collections by @​xurshudyan in laravel/framework#62266
• Fix lazily loaded images not being freed until garbage collection by @​tamc in laravel/framework#62265
• Bump stefanzweifel/git-auto-commit-action from 7.2.0 to 7.2.1 in the github-actions group by @​dependabot[bot] in laravel/framework#62288
• KeyGenerateCommand: improve help message about '--show' by @​valerio-bozzolan in laravel/framework#62286
• [13.x] Record failed batch jobs when the model is missing by @​xurshudyan in laravel/framework#62280
• [13.x] Fix broadcasting to multiple encrypted Pusher channels by @​xurshudyan in laravel/framework#62279
• [13.x] Fix Str::remove() rejecting a Traversable subject by @​Amirhf1 in laravel/framework#62278
• [13.x] Fix Str::substrCount() treating offset and length as bytes by @​Amirhf1 in laravel/framework#62277
• [13.x] Fix withExists() and loadExists() on SQL Server by @​xurshudyan in laravel/framework#62273
• [13.x] Fix cursorPaginate() columns on union queries with multiple orders by @​xurshudyan in laravel/framework#62272
• [13.x] Fix @​param types wider than the native parameter type by @​dhrupo in laravel/framework#62271
• [13.x] Detect QueryList.TerminateAll() as lost connection by @​jackbayliss in laravel/framework#62270
• [13.x] Add a strict flag to InteractsWithData by @​inxilpro in laravel/framework#62254
• [13.x] database fundamentals to know if a read connection has catched up to a write connection by @​tpetry in laravel/framework#62198
• [13.x] Fix CommandSignatureTest by @​jackbayliss in laravel/framework#62295
• [13.x] Fix JSON:API resource collections wrapping plain objects by @​lazerg in laravel/framework#62299
• [13.x] Fix: Authenticate the Concurrency Process Result Envelope to Prevent Task Output Injection by @​Arr0way in laravel/framework#62297

v13.39.0

• [13.x] Rebuild the phpredis client when a broken pipe surfaces as a warning by @​aleedhillon in laravel/framework#62111
• [13.x] Resolve view namespace hints like view locations by @​fgilio in laravel/framework#62005
• [13.x] feat(database): allow disabling primary key via #[Table(key: false)] by @​calebdw in laravel/framework#62113
• [13.x] add duration to JobAttempted event by @​jackbayliss in laravel/framework#62118
• [13.x] Write config, route and event cache files atomically by @​xurshudyan in laravel/framework#62117
• [13.x] Fix database cache lock aborting the transaction on PostgreSQL by @​xurshudyan in laravel/framework#62114

... (truncated)

Changelog

Sourced from laravel/framework's changelog.

v13.40.0 - 2026-11-03

• [13.x] Fix Paginator::links() return type by @​dhrupo in laravel/framework#62226
• [13.x] Fix updating JSON paths with arrays and collections on MySQL and MariaDB by @​xurshudyan in laravel/framework#62225
• [13.x] Use the write connection in BelongsToMany createOrFirst lookup by @​xurshudyan in laravel/framework#62223
• [13.x] Drop check constraints when dropping columns on SQL Server by @​xurshudyan in laravel/framework#62222
• [13.x] Centralize + improve tests for InteractsWithData by @​inxilpro in laravel/framework#62217
• [13.x] Fix Redis tagged cache flush blocking Redis when flushing many tags by @​MohannadElemary in laravel/framework#62215
• [13.x] Qualify dropped and renamed indexes with the table schema on PostgreSQL by @​xurshudyan in laravel/framework#62213
• [13.x] Reconnect after losing the connection during a transaction by @​xurshudyan in laravel/framework#62211
• [13.x] Add missing PostgreSQL full text languages by @​xurshudyan in laravel/framework#62210
• [13.x] Add Queue::whenJobRunsLongerThan by @​jackbayliss in laravel/framework#62141
• [13.x] Fix named arguments in Cookie::queue() by @​xurshudyan in laravel/framework#62246
• [13.x] Fix ImageFile::default() returning a plain File rule by @​Marzaan in laravel/framework#62244
• [13.x] Fix pagination contracts render() return type by @​dhrupo in laravel/framework#62242
• [13.x] Fix SQL Server ignoring orderBy on update and delete with limit by @​xurshudyan in laravel/framework#62239
• [13.x] Preserve error_get_last() for suppressed errors by @​xurshudyan in laravel/framework#62228
• Prepare reusable development environments for Amp orbs by @​DGarbs51 in laravel/framework#62231
• Allow $middleware->replace() to accept an array of replacements by @​ziadoz in laravel/framework#62230
• [13.x] Show released jobs as released in queue:work output by @​jackbayliss in laravel/framework#62180
• Add $middleware->insertBefore() and $middleware->insertAfter() helper methods by @​ziadoz in laravel/framework#62261
• [13.x] Reconnect the Cloud log socket after a failed write by @​jamesdangercarpenter in laravel/framework#62258
• [13.x] Dispatch ScheduledTaskSkipped when a task already ran on another server by @​jackbayliss in laravel/framework#62256
• [13.x] Fix forceIndex() generating invalid SQL on SQLite for PRIMARY and multiple indexes by @​tharlei in laravel/framework#62255
• [13.x] Add Schedule::whenTaskRunsLongerThan by @​jackbayliss in laravel/framework#62233
• [13.x] Roll back to savepoint on concurrency errors in nested transactions by @​xurshudyan in laravel/framework#62248
• [13.x] Fix toResourceCollection() on filtered collections by @​xurshudyan in laravel/framework#62266
• Fix lazily loaded images not being freed until garbage collection by @​tamc in laravel/framework#62265
• Bump stefanzweifel/git-auto-commit-action from 7.2.0 to 7.2.1 in the github-actions group by @​dependabot[bot] in laravel/framework#62288
• KeyGenerateCommand: improve help message about '--show' by @​valerio-bozzolan in laravel/framework#62286
• [13.x] Record failed batch jobs when the model is missing by @​xurshudyan in laravel/framework#62280
• [13.x] Fix broadcasting to multiple encrypted Pusher channels by @​xurshudyan in laravel/framework#62279
• [13.x] Fix Str::remove() rejecting a Traversable subject by @​Amirhf1 in laravel/framework#62278
• [13.x] Fix Str::substrCount() treating offset and length as bytes by @​Amirhf1 in laravel/framework#62277
• [13.x] Fix withExists() and loadExists() on SQL Server by @​xurshudyan in laravel/framework#62273
• [13.x] Fix cursorPaginate() columns on union queries with multiple orders by @​xurshudyan in laravel/framework#62272
• [13.x] Fix @​param types wider than the native parameter type by @​dhrupo in laravel/framework#62271
• [13.x] Detect QueryList.TerminateAll() as lost connection by @​jackbayliss in laravel/framework#62270
• [13.x] Add a strict flag to InteractsWithData by @​inxilpro in laravel/framework#62254
• [13.x] database fundamentals to know if a read connection has catched up to a write connection by @​tpetry in laravel/framework#62198
• [13.x] Fix CommandSignatureTest by @​jackbayliss in laravel/framework#62295
• [13.x] Fix JSON:API resource collections wrapping plain objects by @​lazerg in laravel/framework#62299
• [13.x] Fix: Authenticate the Concurrency Process Result Envelope to Prevent Task Output Injection by @​Arr0way in laravel/framework#62297

v13.39.0 - 2026-10-27

• [13.x] Rebuild the phpredis client when a broken pipe surfaces as a warning by @​aleedhillon in laravel/framework#62111
• [13.x] Resolve view namespace hints like view locations by @​fgilio in laravel/framework#62005
• [13.x] feat(database): allow disabling primary key via #[Table(key: false)] by @​calebdw in laravel/framework#62113
• [13.x] add duration to JobAttempted event by @​jackbayliss in laravel/framework#62118

... (truncated)

Commits

• 1449bf2 Update version to v13.40.0
• c37133b [13.x] Fix: Authenticate the Concurrency Process Result Envelope to Prevent T...
• 1571da1 Fix JSON:API resource collections wrapping plain objects (#62299)
• aa6dcc6 Update command_signatures.php (#62295)
• b20bf7f Update facade docblocks
• 86d3106 [13.x] database fundamentals to know if a read connection has catched up to a...
• c40be6a Update facade docblocks
• 9a484bf [13.x] Add a strict flag to InteractsWithData (#62254)
• 3f50fa3 add QueryList.TerminateAll to lost connection detector (#62270)
• ce1e6fa Fix @​param types wider than the native parameter type (#62271)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[rmcdaniel]

Closing this automatic update because it rewrites the frozen historical producer fixture rather than an active application dependency. legacy-marker-aliases/artifacts.json binds the original Workflow 2.5.5 producer to lock SHA256 ac9d95807e8e080d176a555a171315aba183fa13e546a51e02b6c2afd478c967. This PR changes that lock to ef3297149d561ea0cfb9950aa74c04f69ff933368793838bc6488fca392fa0a1 and changes dozens of transitive versions, while the recorded original-artifact contract remains unchanged. Merging it would replace the historical compatibility input and break its identity proof.

The active Server source dependency floor/lock is already corrected to Laravel 13.41 in merged #1216, with fresh audit/CI and independent review. The actual retired PHP 2.11.8 image remains unpatched and follows the reviewed exposure/retirement notice and #1214 follow-through. Updating a historical fixture is not an installed security patch. The proposed 13.40 update also does not cover the two signed-URL advisories whose complete floor is 13.41.

No advisory ignore, audit bypass, frozen tag/image change or PHP publication exception is introduced by this review. Historical fixture execution remains bounded synthetic qualification; it is not a deployment recommendation.