Swap the custom 'rt' register token anti-spam mechanism for
spatie/laravel-honeypot on the registration and parental-controls
invite flows.
- Add spatie/laravel-honeypot and publish config/honeypot.php
- Remove getRegisterToken() and the rt validation rule from RegisterController
- Replace the rt hidden field with the @honeypot directive in both forms
- Attach ProtectAgainstSpam middleware to POST /register and the
parental-controls invite register route
- Update RegisterTest to disable honeypot for the valid registration case
Add ext-redis as a required PHP extension so phpredis can be used as
the Redis client without manual setup. predis remains available, so
users can switch between REDIS_CLIENT=phpredis and predis freely.
Modernize artisan and public/index.php to the streamlined bootstrap form,
migrate factories/seeders autoload to PSR-4 (database/seeds -> seeders), and
backfill missing env-driven config keys across app, session, database, queue,
mail, logging, and cache. All changes are additive and preserve existing
Pixelfed behavior and defaults.
Modernize artisan and public/index.php to the streamlined bootstrap form,
migrate factories/seeders autoload to PSR-4 (database/seeds -> seeders), and
backfill missing env-driven config keys across app, session, database, queue,
mail, logging, and cache. All changes are additive and preserve existing
Pixelfed behavior and defaults.
Adds a psalm:report script that ignores the baseline and writes a full
human-readable report to psalm-report.txt, including informational issues,
so all outstanding items to fix are surfaced in one file.
Port PR #6646 onto staging: add psalm/plugin-laravel with psalm.xml,
a staging-generated baseline, and a CI workflow that emits GitHub
annotations and uploads SARIF to Code Scanning. Fix the psalm.xml schema
for Psalm 6.5 (drop unsupported ClassMustBeFinal handler) and ignore
generated report artifacts in git/docker.
- Remove endroid/qr-code: never imported in app code; only
bacon/bacon-qr-code is used directly (for 2FA QR generation).
- Remove nesbot/carbon: already pulled in transitively by
laravel/framework, laravel/horizon, and laravel/pulse.
Changes constraint from exact '7.4.13' to '^7.4.13'. The pin was
introduced for CVE-2026-48736 but is overly restrictive — any 7.4.x
release >= 7.4.13 includes the fix. This allows future security
patches to install via composer update.
Note: Symfony 8.x is blocked by laravel/framework ^12 which requires
symfony/http-foundation ^7.2.0. Symfony 8 support arrives with Laravel 13.
Replace all deprecated helper function calls:
- str_slug() → Str::slug()
- starts_with() → str_starts_with()
- ends_with() → str_ends_with()
- array_first() → Arr::first()
- array_last() → Arr::last()
- array_flatten() → Arr::flatten()
Remove laravel/helpers package from composer.json as it is no longer
needed and will not be maintained for Laravel 13.
- Remove unmaintained jenssegers/agent package (no releases since 2021)
- Add matomo/device-detector v6.5 as actively maintained replacement
- Create App\Services\UserAgentService wrapper for drop-in compatibility
- Update UserDevice model and ApiV1Dot1Controller to use new service
Daniel Supernault
Your Name
dependabot[bot]
Shlee
Severin
Ramon van Belzen