Laravel 13 defaults serializable_classes to false, blocking arbitrary
PHP object unserialization from cache. This project caches CustomFilter
model instances (in getCachedFiltersForAccount), so it must be
explicitly allowlisted.
All other cache usage in this project stores scalars, arrays, or
Fractal-transformed array output — no other classes need allowlisting.
- Enable strict mode for MySQL connection to prevent silent data
truncation, zero-date insertion, and division-by-zero errors.
- Remove Schema::defaultStringLength(191) which was a MySQL 5.7
workaround no longer needed on MySQL 8.0+ / MariaDB 10.3+.
- Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now)
- Remove Passport::enableImplicitGrant() (legacy grant, no clients use it)
- Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key)
- Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example
- Show swal alert when PATs disabled instead of hidden API error
- Improve store() error handling to surface 403 messages in the UI
- Remove OAUTH_PAT_ID row from admin diagnostics blade
Remove auto-discovered package aliases (Purify, FFMpeg, Captcha) and
the unused Eloquent alias. These are registered automatically via
package auto-discovery.
Framework facade aliases must remain until all 344+ short-import
usages (e.g. 'use Cache;') are migrated to fully-qualified imports.
Use Pdo\Mysql::ATTR_SSL_CA when available (PHP 8.5+), falling back to
the legacy PDO::MYSQL_ATTR_SSL_CA constant for older PHP versions.
This eliminates the deprecation warning during Docker builds and runtime.
Replace all deprecated helper function calls:
- str_slug() → Str::slug()
- starts_with() → str_starts_with()
- ends_with() → str_ends_with()
- array_first() → Arr::first()
- array_last() → Arr::last()
- array_flatten() → Arr::flatten()
Remove laravel/helpers package from composer.json as it is no longer
needed and will not be maintained for Laravel 13.
- Remove 'loops' from config/exp.php and instance.discover.loops from config/instance.php
- Remove loops API routes (loopsApi, loopWatch) from web-api.php
- Delete LoopComponent.vue, loops.js entry point, and loops blade view
- Remove EXP_LOOPS diagnostic row from admin diagnostics page
The Loops feature was deprecated and hardcoded to disabled.
Remove the EXP_LC env var from config/exp.php and its diagnostic
row from the admin diagnostics page. This feature was already
marked as deprecated and unused.
Daniel Supernault
Shlee
Your Name
Severin
Krafting