fix(deps): update dependency laravel/framework to v11.44.1 [security] #11
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
11.18.1->11.44.1GitHub Vulnerability Alerts
CVE-2024-52301
Description
When the
register_argc_argv phpdirective is set toon, and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request.Resolution
The framework now ignores argv values for environment detection on non-cli SAPIs.
CVE-2024-13919
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
CVE-2024-13918
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
CVE-2025-27515
When using wildcard validation to validate a given file or image field array (
files.*), a user-crafted malicious request could potentially bypass the validation rules.Release Notes
laravel/framework (laravel/framework)
v11.44.1Compare Source
Validatorinstance within certain rule classes by @crynobone in #54845Application::interBasePath()fails to resolve application when project name is "vendor" by @crynobone in #54871v11.44.0Compare Source
PHP_CLI_SERVER_WORKERSasstringinstead ofintby @crynobone in #54724readAtmethod to use in database channel by @utsavsomaiya in #54729Factory::$modelNameResolverby @samlev in #54736InteractsWithDatabaseby @cosmastech in #54748InteractsWithExceptionHandling&&ExceptionHandlerFakeby @cosmastech in #54747v11.43.2Compare Source
implode()by @nuernbergerA in #54704assertOnlyJsonValidationErrors/assertOnlyInvalidby @gdebrauwer in #54678QueueFake::pushRaw()by @cosmastech in #54703v11.43.1Compare Source
v11.43.0Compare Source
orWhereHasMorphmethod by @simonellensohn in #54659servecommand withPHP_CLI_SERVER_WORKERSby @crynobone in #54606ddJsonmethod onTestResponseclass by @chester-sykes in #54673Factory::guessModelNamesUsing()by @crynobone in #54665withWhereRelationmethod to builder by @utsavsomaiya in #54668v11.42.1Compare Source
assertStreamedandassertNotStreamedby @gdebrauwer in #54566assertJsonFragmentsassertion by @lioneaglesolutions in #54576doesntContainon eloquent collection by @gdebrauwer in #54567v11.42.0Compare Source
enum_value()by @cosmastech in #54432Number::currency()by @benjibee in #54456withAttributesby @tontonsb in #54422BuilderOn Clone callback support by @ralphjsmit in #54477PendingBatch@ensureJobIsBatchableby @cosmastech in #54485Relationby @cosmastech in #54560v11.41.3Compare Source
v11.41.2Compare Source
v11.41.1Compare Source
Macroableandfill()toSupport\Fluentby @stevebauman in #54404loadTranslationsFromfunction for simplicity and clarity by @selcukcukur in #54407v11.41.0Compare Source
TestComponentto be macroable by @ziadoz in #54359explodeExplicitRuleto support Customizable Date Validation by @mrvipchien in #54353addPath()method to theLangfacade and theTranslatorclass. by @selcukcukur in #54347Datefacade for storing the password confirmation timestamp by @crynobone in #54383v11.40.0Compare Source
schedule:teston commands using runInBackground by @dallyger in #54321/testsdirectory by @browner12 in #54325whereMorphedTo/whereNotMorphedToby @gdebrauwer in #54324v11.39.1Compare Source
v11.39.0Compare Source
ValidatedInputfunctions withInteractsWithDatatrait by @stevebauman in #54208Emailvalidation rule custom translation messages by @SanderMuller in #54202optimize:clearandoptimizeby @cosmastech in #54197UseFactoryby @cosmastech in #54215Rule::email()tests by @SanderMuller in #54226BladeComponentTagCompilerTestunderIlluminate\Tests\View\Bladeby @AhmedAlaa4611 in #54233addPath()Allow adding new path for translation loader. by @selcukcukur in #54277v11.38.2Compare Source
qualifyColumnHelper Method by @SanderMuller in #54187v11.38.1Compare Source
v11.38.0Compare Source
RefreshDatabaseby @SjorsO in #54075HasUniqueStringIdstrait by @hafezdivandari in #54096finallymethod to pipeline helper by @nunomaduro in #54110Eloquent/Builderpluck method by @MattBradleyDev in #54130@mixinonSoftDeletestrait by @nunomaduro in #54140times()calls by @browner12 in #54141optimizeandoptimize:clearcommands by @jonerickson in #54070USE databasestatement by @TheLevti in #54132Emailvalidation rule by @SanderMuller in #54067Dispatchable::newPendingDispatch()by @cosmastech in #54153FormRequest::array($key)andFluent::array($key)by @stevebauman in #54177HasRelationshipsgeneric by @SanderMuller in #54174PendingDispatch@getJob()by @cosmastech in #54158v11.37.0Compare Source
Dumpabletrait toUriby @nuernbergerA in #53960$ignoreCaseoption toStr::isby @stevebauman in #53981withoutQuerymethod to accept string or array input by @1weiho in #53973Illuminate\Http\Responseto output empty string if$contentis set tonullby @crynobone in #53872whereDoesntHaveRelation,whereMorphDoesntHaveRelationand their variants withORby @andrey-helldar in #53996RefreshDatabasetransaction was committed by @SjorsO in #53997Illuminate\Support\Urion testing HTTP Requests by @crynobone in #54038null&*key given indata_getby @jwjenkin in #54059v11.36.1Compare Source
getJob()method toPendingDispatchclass + Introduced tests by @pascalbaljet in #53951v11.36.0Compare Source
config/mail.phpwith supported configuration by @crynobone in #53874enum_value()to be use in standaloneilluminate/collectionsby @crynobone in #53871UriandUriQueryStringimplementStringableby @cosmastech in #53873new StringableoverStr::ofandstr()by @lucasmichot in #53883Uriclass to default, global aliases by @jasonmccreary in #53884loadMissingby @SychO9 in #53879numericAggregateon eloquent builder by @AmirRezaM75 in #53880new Fluentoverfluent()helper by @lucasmichot in #53890Collection::wrapby @lucasmichot in #53891Collection::rangeby @lucasmichot in #53895schema:dump --prunecommand by @andrey-helldar in #53870blankHelper from Serializing Eloquent Models by @SanderMuller in #53911Fluent::setmethod by @stevebauman in #53946v11.35.1Compare Source
Illuminate\Database\Query\Builderby @jnoordsij in #53841DatabaseTruncationtrait by introducingConnection::withoutTablePrefix()method by @hafezdivandari in #53842v11.35.0Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.