Replace Auth::user() with $request->user() and Auth::check() with
$request->user() !== null (or ! $request->user()) across all
controllers and middleware that have access to the request object.
This resolves 99 larastan.noAuthFacadeInRequestScope errors and
improves Octane compatibility.
For protected helper methods without $request in scope, uses the
request() helper instead.
Methods that previously lacked a Request parameter but used Auth
facade now accept Request $request via Laravel's auto-injection.
Replace all references to non-existent $status with $gp (the GroupPost
instance already in scope). This was a bug where the closure variable
name was changed but references inside the method body were not updated.
Replace \Cache::, \Log::, \DB:: calls with their imported facade
equivalents. The backslash-prefix relies on global aliases which
PHPStan cannot resolve, causing class.notFound errors.
The storyPoll() method was never implemented on PollService.
Replace with null to fix phpstan staticMethod.notFound.
Note: Passport::personalAccessClientId() is also flagged but deferred
to a separate PAT refactoring effort.
- AdminReportController: fix closure param name and remove reference to
undefined $meta variable
- GroupsPostController: replace $status with $gp (the actual GroupPost
variable in scope)
- PortfolioController: replace undefined $metadata with null
- DeleteWorker: remove Cache::set() call with undefined $key
Add missing use statement for FeedUnfollowPipeline in PrivacySettings
and FollowerObserver. These caused PHPStan internal errors blocking
full analysis.
Convert all 273 short facade alias imports (e.g. 'use Cache;') to their
fully-qualified class names (e.g. 'use Illuminate\Support\Facades\Cache;')
across 193 files.
This resolves 643 PHPStan 'class.notFound' errors caused by the static
analyzer being unable to resolve global aliases, and aligns with modern
Laravel conventions. It also unblocks removing the aliases array from
config/app.php in a future change.
All 107 tests pass.
Delete 4 middleware wrapper classes that added no custom logic:
- EncryptCookies (empty $except)
- TrimStrings ($except matches framework default)
- VerifyCsrfToken (exceptions moved to validateCsrfTokens() in bootstrap)
- TrustProxies (headers matched framework default)
CSRF exceptions (/api/v1/*, oauth/token) are now configured via
$middleware->validateCsrfTokens(except: [...]) in bootstrap/app.php.
All 107 tests pass.
str_random() is a deprecated helper from laravel/helpers that was
missed in the initial helpers removal. Replace all 18 call sites
with the modern Str::random() equivalent.
Replace all deprecated helper function calls:
- str_slug() → Str::slug()
- starts_with() → str_starts_with()
- ends_with() → str_ends_with()
- array_first() → Arr::first()
- array_last() → Arr::last()
- array_flatten() → Arr::flatten()
Remove laravel/helpers package from composer.json as it is no longer
needed and will not be maintained for Laravel 13.
Replace all 'Controller@method' string references with
[Controller::class, 'method'] array syntax across all route files.
Remove the $namespace property and ->namespace() calls from
RouteServiceProvider.
This is required for Laravel 13 compatibility where string-based
controller routing and automatic namespace prefixing will be removed.
742 route references converted across 5 route files.
The $routeMiddleware property was renamed to $middlewareAliases in Laravel 11.
The old name still works in 12 via backwards compatibility but is on the
deprecation path for removal in Laravel 13.
CheckForMaintenanceMode was deprecated in Laravel 8 and will be removed in
Laravel 13. PreventRequestsDuringMaintenance is the modern replacement with
support for secret bypass tokens and pre-rendered maintenance views.
Your Name
Shlee
Daniel Supernault
Ashley Hull