Upgrade to Laravel 13

- laravel/framework ^12.0 -> ^13.0
- spatie/laravel-backup ^9.2.9 -> ^10.0 (forced: 9.x pins
  illuminate/notifications ^12.40, incompatible with L13)
- Drop psalm/plugin-laravel + vimeo/psalm (dev-only static analysis):
  the only version chain compatible with L13's testbench-core needs
  vimeo/psalm ^7.0.0-beta, which requires narrowing the project's
  declared PHP floor (composer platform.php is pinned to 8.3.0 to
  keep composer.lock installable on the oldest supported PHP patch;
  the psalm 7 betas require specific 8.3.16+/8.4.3+/8.5.0+ floors).
  Its CI workflow (.github/workflows/php-psalm.yml) was already
  disabled (`on: []`, "too many errors"). Larastan/PHPStan remains
  as the project's static analysis tool, unaffected.
- Rename VerifyCsrfToken/ValidateCsrfToken -> PreventRequestForgery
  in bootstrap/app.php and config/sanctum.php (the L13 rename; old
  classes remain as deprecated aliases but new code should reference
  the new name), and validateCsrfTokens() -> preventRequestForgery()
  in the middleware config.

Everything else (cache serializable_classes, cache/session/redis key
prefixes, upsert() uniqueBy, JobAttempted/QueueBusy event properties,
pagination view names, Manager::extend bindings, model-boot nested
instantiation) was checked against the app's actual code and found
to be either already handled, already using the new convention, or
not applicable to any pattern in this codebase.

All 715 tests pass (verified against a clean baseline with Redis
available locally via Docker); Pint and Larastan (the project's
configured `composer analyse` scope) are both clean.

bootstrap/app.php

@@ -21,9 +21,9 @@ use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
 use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;
+use Illuminate\Foundation\Http\Middleware\PreventRequestForgery;
 use Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance;
 use Illuminate\Foundation\Http\Middleware\TrimStrings;
-use Illuminate\Foundation\Http\Middleware\ValidateCsrfToken;
 use Illuminate\Foundation\Http\Middleware\ValidatePostSize;
 use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Http\Exceptions\HttpResponseException;
@@ -86,7 +86,7 @@ return Application::configure(basePath: dirname(__DIR__))
             StartSession::class,
             AuthenticateSession::class,
             ShareErrorsFromSession::class,
-            ValidateCsrfToken::class,
+            PreventRequestForgery::class,
             SubstituteBindings::class,
             CreateFreshApiToken::class,
             'restricted',
@@ -98,7 +98,7 @@ return Application::configure(basePath: dirname(__DIR__))
             AddQueuedCookiesToResponse::class,
             StartSession::class,
             ShareErrorsFromSession::class,
-            ValidateCsrfToken::class,
+            PreventRequestForgery::class,
             SubstituteBindings::class,
             CreateFreshApiToken::class,
         ]);
@@ -110,7 +110,7 @@ return Application::configure(basePath: dirname(__DIR__))
             GrantFirstPartyToken::class,
         ]);
 
-        $middleware->validateCsrfTokens(except: [
+        $middleware->preventRequestForgery(except: [
             'oauth/token',
         ]);
 

composer.json

@@ -22,7 +22,7 @@
         "intervention/image-laravel": "^4.1",
         "laravel-notification-channels/expo": "^2.0.0",
         "laravel-notification-channels/webpush": "^10.2",
-        "laravel/framework": "^12.0",
+        "laravel/framework": "^13.0",
         "laravel/horizon": "^5.0",
         "laravel/passport": "^13.4.4",
         "laravel/pulse": "^1.3",
@@ -42,7 +42,7 @@
         "predis/predis": "^3.2",
         "pusher/pusher-php-server": "^7.2",
         "resend/resend-php": "^0.13.0",
-        "spatie/laravel-backup": "^9.2.9",
+        "spatie/laravel-backup": "^10.0",
         "spatie/laravel-honeypot": "^4.7",
         "spatie/laravel-image-optimizer": "^1.8.2",
         "stevebauman/purify": "^6.2.0",
@@ -57,9 +57,7 @@
         "laravel/telescope": "^5.5",
         "mockery/mockery": "^1.6",
         "nunomaduro/collision": "^8.8",
-        "pestphp/pest": "^4.0",
-        "psalm/plugin-laravel": "^3",
-        "vimeo/psalm": "^6.5"
+        "pestphp/pest": "^4.0"
     },
     "autoload": {
         "psr-4": {
@@ -105,9 +103,6 @@
             "@php artisan package:discover --ansi"
         ],
         "analyse": "./vendor/bin/phpstan analyse --memory-limit=512M",
-        "psalm": "./vendor/bin/psalm",
-        "psalm:baseline": "./vendor/bin/psalm --update-baseline",
-        "psalm:report": "./vendor/bin/psalm --ignore-baseline --no-cache --show-info=true --report=psalm-report.txt --report-show-info=true",
         "test": [
             "docker compose -f docker-compose.test.yml up -d --wait",
             "./vendor/bin/pest --compact",

config/sanctum.php

@@ -1,7 +1,7 @@
 <?php
 
 use Illuminate\Cookie\Middleware\EncryptCookies;
-use Illuminate\Foundation\Http\Middleware\ValidateCsrfToken;
+use Illuminate\Foundation\Http\Middleware\PreventRequestForgery;
 use Laravel\Sanctum\Http\Middleware\AuthenticateSession;
 use Laravel\Sanctum\Sanctum;
 
@@ -81,7 +81,7 @@ return [
     'middleware' => [
         'authenticate_session' => AuthenticateSession::class,
         'encrypt_cookies' => EncryptCookies::class,
-        'validate_csrf_token' => ValidateCsrfToken::class,
+        'validate_csrf_token' => PreventRequestForgery::class,
     ],
 
 ];