Run i18n:export to refresh the locale JSON exports and locales.json
manifest (picks up all current lang/ folders, sorted by display name),
then rebuild frontend assets via Laravel Mix.
Empty lang/x/web.php values (untranslated Crowdin placeholders) were
being exported as empty strings, overriding the English UI fallback and
breaking non-English languages. Recursively strip empty strings before
writing the JSON build files, then regenerate all language files.
The <intersect> in sections/Notifications.vue wrapped four <placeholder>
elements directly. vue-intersect requires exactly one child (it checks
$slots.default.length and observes $slots.default[0]), so it logged
'[VueIntersect] You may only wrap one element in a <intersect> component.'
and only observed the first placeholder. Wrap the placeholders in a single
<div> so the slot has one root element.
- Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now)
- Remove Passport::enableImplicitGrant() (legacy grant, no clients use it)
- Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key)
- Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example
- Show swal alert when PATs disabled instead of hidden API error
- Improve store() error handling to surface 403 messages in the UI
- Remove OAUTH_PAT_ID row from admin diagnostics blade
Fixes#6630 (partial — deletion causing broken PAT)
If a user deletes the OAuth client that serves as the personal access
client, all PAT creation breaks for the entire instance with a 500 error.
Changes:
- Add custom OAuthClientController@destroy that checks if the client
has the personal_access grant type before allowing deletion
- Returns 403 with a clear error message if deletion is blocked
- Add confirmation dialog before client deletion in the frontend
- Add error handling to show server error messages to the user
This prevents accidental destruction of the PAT infrastructure.
Fixes#6630 (partial — client secret issue)
In Passport v13, client secrets are hashed at the model level and only
available as plain_secret on the response from the creation endpoint.
The previous code immediately re-fetched the client list after creation,
losing the plain secret since it's not stored or returned on GET.
Changes:
- Capture plain_secret from the POST response
- Show a dedicated modal with the client ID and secret after creation
- Warn users to copy the secret immediately (it won't be shown again)
- Add a Copy button for convenience
- Show 'Hidden (only shown at creation)' in the table for existing clients
Fixes#6657
When media uploads fail with a 422 validation error (e.g. file too large),
the error dialog now shows the actual validation message including the
filename, instead of the generic 'An unexpected error occurred.'
Example: 'DSCF0273.JPG: The file may not be greater than 15000 kilobytes'
Also improved the default error case to surface server-provided messages
when available. Applied to both ComposeModal and ComposeClassic components.