Prepares for Laravel 13 where VerifyCsrfToken is deprecated in favor
of PreventRequestForgery. The old class remains as an alias in v13 but
will be removed in a future version.
Symfony 8.0 removes Request::get(). Laravel 13 will support Symfony 8,
so these 11 usages would break on upgrade. Using $request->input()
which checks both query string and request body (same behavior as the
old get() method).
- Enable strict mode for MySQL connection to prevent silent data
truncation, zero-date insertion, and division-by-zero errors.
- Remove Schema::defaultStringLength(191) which was a MySQL 5.7
workaround no longer needed on MySQL 8.0+ / MariaDB 10.3+.
- Remove endroid/qr-code: never imported in app code; only
bacon/bacon-qr-code is used directly (for 2FA QR generation).
- Remove nesbot/carbon: already pulled in transitively by
laravel/framework, laravel/horizon, and laravel/pulse.
Changes constraint from exact '7.4.13' to '^7.4.13'. The pin was
introduced for CVE-2026-48736 but is overly restrictive — any 7.4.x
release >= 7.4.13 includes the fix. This allows future security
patches to install via composer update.
Note: Symfony 8.x is blocked by laravel/framework ^12 which requires
symfony/http-foundation ^7.2.0. Symfony 8 support arrives with Laravel 13.
Adds a global rate limiter (240 req/min per user or IP) to all API
routes. Previously rate limiting was only applied ad-hoc on individual
routes, leaving some endpoints unprotected.
- Delete app/Jobs/RemoteFollowPipeline/RemoteFollowPipeline.php
- Delete app/Jobs/RemoteFollowPipeline/RemoteFollowImportRecent.php
- Neither job is dispatched anywhere in the codebase
- Remote follow is handled by ActivityPub Inbox and FollowPipeline
- Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now)
- Remove Passport::enableImplicitGrant() (legacy grant, no clients use it)
- Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key)
- Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example
- Show swal alert when PATs disabled instead of hidden API error
- Improve store() error handling to surface 403 messages in the UI
- Remove OAUTH_PAT_ID row from admin diagnostics blade
Replace Auth::user() with $request->user() and Auth::check() with
$request->user() !== null (or ! $request->user()) across all
controllers and middleware that have access to the request object.
This resolves 99 larastan.noAuthFacadeInRequestScope errors and
improves Octane compatibility.
For protected helper methods without $request in scope, uses the
request() helper instead.
Methods that previously lacked a Request parameter but used Auth
facade now accept Request $request via Laravel's auto-injection.
AuthScope/RequestUserTest: 22 tests verifying all controllers and
middleware that were migrated from Auth::user() to $request->user().
CI: update to checkout@v7, cache@v6
AuthScope/RequestUserTest: exercises every controller and middleware
that was refactored from Auth::user()/Auth::check() to $request->user().
Covers web routes (follow requests, compose, collections, discover,
profile, status, timeline, newsroom), API routes (verify_credentials,
timelines, notifications, blocks, mutes, favourites, bookmarks), and
middleware (admin, password.confirm, account interstitial).
All 390 tests pass with the auth-scope-3 and passport middleware fixes
applied together.
Laravel Passport 13 renamed:
- CheckScopes → CheckToken (verifies ALL listed scopes)
- CheckForAnyScope → CheckTokenForAnyScope (verifies ANY listed scope)
The old class names no longer exist, causing BindingResolutionException
on all /api/v1/admin/* routes that use the 'scope' or 'scopes' middleware
aliases.
Laravel Passport 13 renamed:
- CheckScopes → CheckToken (verifies ALL listed scopes)
- CheckForAnyScope → CheckTokenForAnyScope (verifies ANY listed scope)
The old class names no longer exist, causing BindingResolutionException
on all /api/v1/admin/* routes that use the 'scope' or 'scopes' middleware
aliases.
dansup
Shlee
Your Name