The <intersect> in sections/Notifications.vue wrapped four <placeholder>
elements directly. vue-intersect requires exactly one child (it checks
$slots.default.length and observes $slots.default[0]), so it logged
'[VueIntersect] You may only wrap one element in a <intersect> component.'
and only observed the first placeholder. Wrap the placeholders in a single
<div> so the slot has one root element.
These guest layouts also load app.js, which reads the csrf-token meta
tag to set the axios X-CSRF-TOKEN header. Without it, they logged the
same 'CSRF token not found' console error and had no CSRF header for
AJAX requests. Adds the meta tag to match the other layouts.
The app layout renders separate head blocks for auth vs guest users.
The guest block was missing the <meta name="csrf-token"> tag that
app.js reads to set the axios X-CSRF-TOKEN header, causing a console
error on the login and register pages. Add the meta tag to the guest
head to match the authenticated head block.
Caching an Eloquent model in a Cache::remember closure could deserialize
into a __PHP_Incomplete_Class on read, throwing 'attempt to access a
property on an incomplete object' and returning a 500. This surfaced on
guest profile pages (ProfileController::buildProfile reading
$user->user->settings) and affected several other latent call sites.
Changes:
- ProfileController: cache a plain settings array instead of the
UserSetting model; fall back to defaults when the settings row is missing
- StoryService::getById: fetch a live model instead of caching it
- InstanceService::getByDomain, CustomEmoji::scan: cache arrays
- Site/MobileController: cache Page data as an array via a shared
ManagesCachedPages trait; update blade views to array access
- Add public-route smoke/regression tests covering the cache-read path
- Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now)
- Remove Passport::enableImplicitGrant() (legacy grant, no clients use it)
- Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key)
- Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example
- Show swal alert when PATs disabled instead of hidden API error
- Improve store() error handling to surface 403 messages in the UI
- Remove OAUTH_PAT_ID row from admin diagnostics blade
These deprecated helpers will throw 'undefined function' errors at
runtime since laravel/helpers was removed. Replace with Str::random(),
Str::limit(), and Str::slug() respectively.
Fixes#6630 (partial — deletion causing broken PAT)
If a user deletes the OAuth client that serves as the personal access
client, all PAT creation breaks for the entire instance with a 500 error.
Changes:
- Add custom OAuthClientController@destroy that checks if the client
has the personal_access grant type before allowing deletion
- Returns 403 with a clear error message if deletion is blocked
- Add confirmation dialog before client deletion in the frontend
- Add error handling to show server error messages to the user
This prevents accidental destruction of the PAT infrastructure.
Fixes#6630 (partial — client secret issue)
In Passport v13, client secrets are hashed at the model level and only
available as plain_secret on the response from the creation endpoint.
The previous code immediately re-fetched the client list after creation,
losing the plain secret since it's not stored or returned on GET.
Changes:
- Capture plain_secret from the POST response
- Show a dedicated modal with the client ID and secret after creation
- Warn users to copy the secret immediately (it won't be shown again)
- Add a Copy button for convenience
- Show 'Hidden (only shown at creation)' in the table for existing clients
Fixes#6657
When media uploads fail with a 422 validation error (e.g. file too large),
the error dialog now shows the actual validation message including the
filename, instead of the generic 'An unexpected error occurred.'
Example: 'DSCF0273.JPG: The file may not be greater than 15000 kilobytes'
Also improved the default error case to surface server-provided messages
when available. Applied to both ComposeModal and ComposeClassic components.
- Remove 'loops' from config/exp.php and instance.discover.loops from config/instance.php
- Remove loops API routes (loopsApi, loopWatch) from web-api.php
- Delete LoopComponent.vue, loops.js entry point, and loops blade view
- Remove EXP_LOOPS diagnostic row from admin diagnostics page
The Loops feature was deprecated and hardcoded to disabled.
- Remove userRecommendations controller method and /api/local/exp/rec route
- Remove suggestions UI panel, data properties, and methods from Timeline.vue
- Remove commented-out suggestions card from feed template
The recommendations feature was deprecated and hardcoded to false/empty.
Daniel Supernault
Your Name
Shlee
Ray