8b6eee19cf
Merge pull request #7405 from pixelfed/dependabot/composer/staging/larastan/larastan-3.12.1
...
chore(deps-dev): bump larastan/larastan from 3.12.0 to 3.12.1
2 days ago
f7d9afe194
chore(deps): bump predis/predis from 3.6.0 to 3.6.1
...
Bumps [predis/predis](https://github.com/predis/predis ) from 3.6.0 to 3.6.1.
- [Release notes](https://github.com/predis/predis/releases )
- [Changelog](https://github.com/predis/predis/blob/main/CHANGELOG.md )
- [Commits](https://github.com/predis/predis/compare/v3.6.0...v3.6.1 )
---
updated-dependencies:
- dependency-name: predis/predis
dependency-version: 3.6.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 days ago
cad674b788
Merge pull request #7402 from pixelfed/dependabot/composer/staging/spatie/laravel-honeypot-4.7.3
...
chore(deps): bump spatie/laravel-honeypot from 4.7.2 to 4.7.3
2 days ago
403fa110f2
Merge pull request #7401 from pixelfed/dependabot/composer/staging/spatie/laravel-backup-10.3.3
...
chore(deps): bump spatie/laravel-backup from 10.3.2 to 10.3.3
2 days ago
375231fd97
Merge pull request #7400 from pixelfed/dependabot/composer/staging/resend/resend-php-1.15.0
...
chore(deps): bump resend/resend-php from 1.14.0 to 1.15.0
2 days ago
b9cd3d50bb
chore(deps-dev): bump larastan/larastan from 3.12.0 to 3.12.1
...
Bumps [larastan/larastan](https://github.com/larastan/larastan ) from 3.12.0 to 3.12.1.
- [Release notes](https://github.com/larastan/larastan/releases )
- [Changelog](https://github.com/larastan/larastan/blob/3.x/RELEASE.md )
- [Commits](https://github.com/larastan/larastan/compare/v3.12.0...v3.12.1 )
---
updated-dependencies:
- dependency-name: larastan/larastan
dependency-version: 3.12.1
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 days ago
059c9a21bf
chore(deps): bump spatie/laravel-honeypot from 4.7.2 to 4.7.3
...
Bumps [spatie/laravel-honeypot](https://github.com/spatie/laravel-honeypot ) from 4.7.2 to 4.7.3.
- [Release notes](https://github.com/spatie/laravel-honeypot/releases )
- [Changelog](https://github.com/spatie/laravel-honeypot/blob/main/CHANGELOG.md )
- [Commits](https://github.com/spatie/laravel-honeypot/compare/4.7.2...4.7.3 )
---
updated-dependencies:
- dependency-name: spatie/laravel-honeypot
dependency-version: 4.7.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 days ago
20fcb137db
chore(deps): bump spatie/laravel-backup from 10.3.2 to 10.3.3
...
Bumps [spatie/laravel-backup](https://github.com/spatie/laravel-backup ) from 10.3.2 to 10.3.3.
- [Release notes](https://github.com/spatie/laravel-backup/releases )
- [Changelog](https://github.com/spatie/laravel-backup/blob/main/CHANGELOG.md )
- [Commits](https://github.com/spatie/laravel-backup/compare/10.3.2...10.3.3 )
---
updated-dependencies:
- dependency-name: spatie/laravel-backup
dependency-version: 10.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 days ago
71a0da216c
chore(deps): bump resend/resend-php from 1.14.0 to 1.15.0
...
Bumps [resend/resend-php](https://github.com/resend/resend-php ) from 1.14.0 to 1.15.0.
- [Release notes](https://github.com/resend/resend-php/releases )
- [Commits](https://github.com/resend/resend-php/compare/v1.14.0...v1.15.0 )
---
updated-dependencies:
- dependency-name: resend/resend-php
dependency-version: 1.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 days ago
b4d075bb2b
chore(deps): bump league/oauth2-client from 2.9.0 to 2.9.1
...
Bumps [league/oauth2-client](https://github.com/thephpleague/oauth2-client ) from 2.9.0 to 2.9.1.
- [Release notes](https://github.com/thephpleague/oauth2-client/releases )
- [Changelog](https://github.com/thephpleague/oauth2-client/blob/master/CHANGELOG.md )
- [Commits](https://github.com/thephpleague/oauth2-client/compare/2.9.0...2.9.1 )
---
updated-dependencies:
- dependency-name: league/oauth2-client
dependency-version: 2.9.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 days ago
f5fb32d202
Add ide helper
3 days ago
e8f4ee86bd
polish
1 week ago
a0b56980cc
polish
1 week ago
163cd9f589
polish
1 week ago
388d6e5726
Merge pull request #7286 from pixelfed/chore/upgrade-resend-php-v1
...
Upgrade resend/resend-php to ^1.14
1 week ago
e7e83b96e1
Upgrade resend/resend-php to ^1.0
...
Bump from ^0.13.0 to ^1.0 (installs v1.14.0). The only breaking change
in v1.0.0 is the removal of $resend->sendEmail in favor of
$resend->emails->send. Pixelfed uses the SDK only through Laravel's
'resend' mail transport, which already calls emails->send and declares
support for resend/resend-php ^1.0, so no application code changes are
needed. Verified the resend mailer resolves and email tests pass.
1 week ago
0243ad5228
Merge pull request #7283 from pixelfed/dependabot/composer/staging/laravel/pint-1.32.1
...
chore(deps-dev): bump laravel/pint from 1.31.1 to 1.32.1
1 week ago
62f6770dba
Merge pull request #7282 from pixelfed/dependabot/composer/staging/larastan/larastan-3.12.0
...
chore(deps-dev): bump larastan/larastan from 3.11.0 to 3.12.0
1 week ago
31022eb798
chore(deps-dev): bump laravel/pint from 1.31.1 to 1.32.1
...
Bumps [laravel/pint](https://github.com/laravel/pint ) from 1.31.1 to 1.32.1.
- [Release notes](https://github.com/laravel/pint/releases )
- [Changelog](https://github.com/laravel/pint/blob/main/CHANGELOG.md )
- [Commits](https://github.com/laravel/pint/compare/v1.31.1...v1.32.1 )
---
updated-dependencies:
- dependency-name: laravel/pint
dependency-version: 1.32.1
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
1 week ago
a372ff6f8e
chore(deps-dev): bump larastan/larastan from 3.11.0 to 3.12.0
...
Bumps [larastan/larastan](https://github.com/larastan/larastan ) from 3.11.0 to 3.12.0.
- [Release notes](https://github.com/larastan/larastan/releases )
- [Changelog](https://github.com/larastan/larastan/blob/3.x/RELEASE.md )
- [Commits](https://github.com/larastan/larastan/compare/v3.11.0...v3.12.0 )
---
updated-dependencies:
- dependency-name: larastan/larastan
dependency-version: 3.12.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
1 week ago
b8ce1b0e5a
chore(deps): bump intervention/image-driver-vips from 4.1.4 to 4.1.5
...
Bumps [intervention/image-driver-vips](https://github.com/Intervention/image-driver-vips ) from 4.1.4 to 4.1.5.
- [Release notes](https://github.com/Intervention/image-driver-vips/releases )
- [Commits](https://github.com/Intervention/image-driver-vips/compare/4.1.4...4.1.5 )
---
updated-dependencies:
- dependency-name: intervention/image-driver-vips
dependency-version: 4.1.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
1 week ago
a7d85e4734
Merge pull request #7221 from pixelfed/dependabot/composer/staging/laravel-notification-channels/webpush-13.0.1
...
chore(deps): bump laravel-notification-channels/webpush from 10.5.0 to 13.0.1
2 weeks ago
13a0cf139e
Merge pull request #7219 from pixelfed/dependabot/composer/staging/league/iso3166-4.5.0
...
chore(deps): bump league/iso3166 from 4.4.0 to 4.5.0
2 weeks ago
ad0c8c08bb
Merge pull request #7218 from pixelfed/dependabot/composer/staging/laravel/pint-1.31.1
...
chore(deps-dev): bump laravel/pint from 1.30.5 to 1.31.1
2 weeks ago
44da478801
Merge pull request #7220 from pixelfed/dependabot/composer/staging/laravel/telescope-5.24.0
...
chore(deps-dev): bump laravel/telescope from 5.23.0 to 5.24.0
2 weeks ago
e654143a1a
chore(deps): bump laravel/horizon from 5.48.3 to 5.49.0
...
Bumps [laravel/horizon](https://github.com/laravel/horizon ) from 5.48.3 to 5.49.0.
- [Release notes](https://github.com/laravel/horizon/releases )
- [Changelog](https://github.com/laravel/horizon/blob/5.x/CHANGELOG.md )
- [Commits](https://github.com/laravel/horizon/compare/v5.48.3...v5.49.0 )
---
updated-dependencies:
- dependency-name: laravel/horizon
dependency-version: 5.49.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 weeks ago
e36d42f668
chore(deps): bump laravel-notification-channels/webpush
...
Bumps [laravel-notification-channels/webpush](https://github.com/laravel-notification-channels/webpush ) from 10.5.0 to 13.0.1.
- [Release notes](https://github.com/laravel-notification-channels/webpush/releases )
- [Changelog](https://github.com/laravel-notification-channels/webpush/blob/master/CHANGELOG.md )
- [Commits](https://github.com/laravel-notification-channels/webpush/compare/10.5.0...13.0.1 )
---
updated-dependencies:
- dependency-name: laravel-notification-channels/webpush
dependency-version: 13.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
2 weeks ago
0388d3e4fb
chore(deps-dev): bump laravel/telescope from 5.23.0 to 5.24.0
...
Bumps [laravel/telescope](https://github.com/laravel/telescope ) from 5.23.0 to 5.24.0.
- [Release notes](https://github.com/laravel/telescope/releases )
- [Changelog](https://github.com/laravel/telescope/blob/5.x/CHANGELOG.md )
- [Commits](https://github.com/laravel/telescope/compare/v5.23.0...v5.24.0 )
---
updated-dependencies:
- dependency-name: laravel/telescope
dependency-version: 5.24.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 weeks ago
d1081f2bc7
chore(deps): bump league/iso3166 from 4.4.0 to 4.5.0
...
Bumps [league/iso3166](https://github.com/alcohol/iso3166 ) from 4.4.0 to 4.5.0.
- [Release notes](https://github.com/alcohol/iso3166/releases )
- [Changelog](https://github.com/alcohol/iso3166/blob/main/CHANGELOG.md )
- [Commits](https://github.com/alcohol/iso3166/compare/4.4.0...4.5.0 )
---
updated-dependencies:
- dependency-name: league/iso3166
dependency-version: 4.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 weeks ago
1ba0535bb0
chore(deps-dev): bump laravel/pint from 1.30.5 to 1.31.1
...
Bumps [laravel/pint](https://github.com/laravel/pint ) from 1.30.5 to 1.31.1.
- [Release notes](https://github.com/laravel/pint/releases )
- [Changelog](https://github.com/laravel/pint/blob/main/CHANGELOG.md )
- [Commits](https://github.com/laravel/pint/compare/v1.30.5...v1.31.1 )
---
updated-dependencies:
- dependency-name: laravel/pint
dependency-version: 1.31.1
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 weeks ago
42620e584b
Upgrade to Laravel 13
...
- laravel/framework ^12.0 -> ^13.0
- spatie/laravel-backup ^9.2.9 -> ^10.0 (forced: 9.x pins
illuminate/notifications ^12.40, incompatible with L13)
- Drop psalm/plugin-laravel + vimeo/psalm (dev-only static analysis):
the only version chain compatible with L13's testbench-core needs
vimeo/psalm ^7.0.0-beta, which requires narrowing the project's
declared PHP floor (composer platform.php is pinned to 8.3.0 to
keep composer.lock installable on the oldest supported PHP patch;
the psalm 7 betas require specific 8.3.16+/8.4.3+/8.5.0+ floors).
Its CI workflow (.github/workflows/php-psalm.yml) was already
disabled (`on: []`, "too many errors"). Larastan/PHPStan remains
as the project's static analysis tool, unaffected.
- Rename VerifyCsrfToken/ValidateCsrfToken -> PreventRequestForgery
in bootstrap/app.php and config/sanctum.php (the L13 rename; old
classes remain as deprecated aliases but new code should reference
the new name), and validateCsrfTokens() -> preventRequestForgery()
in the middleware config.
Everything else (cache serializable_classes, cache/session/redis key
prefixes, upsert() uniqueBy, JobAttempted/QueueBusy event properties,
pagination view names, Manager::extend bindings, model-boot nested
instantiation) was checked against the app's actual code and found
to be either already handled, already using the new convention, or
not applicable to any pattern in this codebase.
All 715 tests pass (verified against a clean baseline with Redis
available locally via Docker); Pint and Larastan (the project's
configured `composer analyse` scope) are both clean.
2 weeks ago
ce4343e3e2
Replace custom register token with spatie/laravel-honeypot
...
Swap the custom 'rt' register token anti-spam mechanism for
spatie/laravel-honeypot on the registration and parental-controls
invite flows.
- Add spatie/laravel-honeypot and publish config/honeypot.php
- Remove getRegisterToken() and the rt validation rule from RegisterController
- Replace the rt hidden field with the @honeypot directive in both forms
- Attach ProtectAgainstSpam middleware to POST /register and the
parental-controls invite register route
- Update RegisterTest to disable honeypot for the valid registration case
2 weeks ago
dcc4f87ba0
Require ext-redis to support phpredis client
...
Add ext-redis as a required PHP extension so phpredis can be used as
the Redis client without manual setup. predis remains available, so
users can switch between REDIS_CLIENT=phpredis and predis freely.
3 weeks ago
8f8b95e170
chore(deps-dev): bump larastan/larastan from 3.10.0 to 3.11.0
...
Bumps [larastan/larastan](https://github.com/larastan/larastan ) from 3.10.0 to 3.11.0.
- [Release notes](https://github.com/larastan/larastan/releases )
- [Changelog](https://github.com/larastan/larastan/blob/3.x/RELEASE.md )
- [Commits](https://github.com/larastan/larastan/compare/v3.10.0...v3.11.0 )
---
updated-dependencies:
- dependency-name: larastan/larastan
dependency-version: 3.11.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
3 weeks ago
1c1ea5bb17
Merge pull request #7016 from pixelfed/dependabot/composer/staging/laravel/telescope-5.23.0
...
chore(deps)(deps-dev): bump laravel/telescope from 5.22.1 to 5.23.0
3 weeks ago
7eded54f1c
chore(deps)(deps): bump laravel/tinker from 2.11.1 to 3.0.2
...
Bumps [laravel/tinker](https://github.com/laravel/tinker ) from 2.11.1 to 3.0.2.
- [Release notes](https://github.com/laravel/tinker/releases )
- [Changelog](https://github.com/laravel/tinker/blob/3.x/CHANGELOG.md )
- [Commits](https://github.com/laravel/tinker/compare/v2.11.1...v3.0.2 )
---
updated-dependencies:
- dependency-name: laravel/tinker
dependency-version: 3.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
3 weeks ago
447b76fede
chore(deps)(deps-dev): bump laravel/telescope from 5.22.1 to 5.23.0
...
Bumps [laravel/telescope](https://github.com/laravel/telescope ) from 5.22.1 to 5.23.0.
- [Release notes](https://github.com/laravel/telescope/releases )
- [Changelog](https://github.com/laravel/telescope/blob/5.x/CHANGELOG.md )
- [Commits](https://github.com/laravel/telescope/compare/v5.22.1...v5.23.0 )
---
updated-dependencies:
- dependency-name: laravel/telescope
dependency-version: 5.23.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
3 weeks ago
595620e5b8
composer
3 weeks ago
584ce27f71
Add Sanctum support
3 weeks ago
4e0c567ecd
Add vimeo/psalm and composer scripts
4 weeks ago
1a234c3920
chore: add Psalm static analysis (plugin-laravel, baseline, CI)
...
Port PR #6646 onto staging: add psalm/plugin-laravel with psalm.xml,
a staging-generated baseline, and a CI workflow that emits GitHub
annotations and uploads SARIF to Code Scanning. Fix the psalm.xml schema
for Psalm 6.5 (drop unsupported ClassMustBeFinal handler) and ignore
generated report artifacts in git/docker.
4 weeks ago
1810caac2d
Update composer
4 weeks ago
1696dfacaa
chore: remove unused direct dependencies
...
- Remove endroid/qr-code: never imported in app code; only
bacon/bacon-qr-code is used directly (for 2FA QR generation).
- Remove nesbot/carbon: already pulled in transitively by
laravel/framework, laravel/horizon, and laravel/pulse.
4 weeks ago
0c849ca4e7
fix: unpin symfony/http-foundation to allow patch updates
...
Changes constraint from exact '7.4.13' to '^7.4.13'. The pin was
introduced for CVE-2026-48736 but is overly restrictive — any 7.4.x
release >= 7.4.13 includes the fix. This allows future security
patches to install via composer update.
Note: Symfony 8.x is blocked by laravel/framework ^12 which requires
symfony/http-foundation ^7.2.0. Symfony 8 support arrives with Laravel 13.
4 weeks ago
edb4368b08
refactor: replace deprecated laravel/helpers with native alternatives
...
Replace all deprecated helper function calls:
- str_slug() → Str::slug()
- starts_with() → str_starts_with()
- ends_with() → str_ends_with()
- array_first() → Arr::first()
- array_last() → Arr::last()
- array_flatten() → Arr::flatten()
Remove laravel/helpers package from composer.json as it is no longer
needed and will not be maintained for Laravel 13.
4 weeks ago
e4033b05bd
Update composer
4 weeks ago
2dbee8599d
fix: add larastan/larastan to composer.lock to fix docker build
4 weeks ago
79541afaa0
Merge origin/staging, resolve conflicts keeping matomo/device-detector over jenssegers/agent
4 weeks ago
552a55c2d2
Upgrade images to v4
4 weeks ago
9a9726af7c
Install Larastan for static analysis
...
- Add larastan/larastan v3.10 (dev dependency)
- Configure phpstan.neon at level 0 with Laravel extension
- Generate baseline for existing errors (711 items)
- Exclude files with missing class references
- Fix one non-ignorable return type error in BearerTokenResponse
- Add composer analyse script
Usage: composer analyse
4 weeks ago
dansup
dependabot[bot]
Your Name
Shlee