Skip to content

Bump the composer group across 1 directory with 8 updates - #163

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/composer-15fe3e7339
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/composer-15fe3e7339

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer group with 8 updates in the / directory:

Package From To
inertiajs/inertia-laravel 3.5.1 3.7.0
laravel/framework 13.35.0 13.40.0
mongodb/laravel-mongodb 5.11.0 5.12.0
spatie/laravel-permission 8.3.0 8.3.2
barryvdh/laravel-ide-helper 3.7.0 3.8.0
laravel/boost 2.10.3 2.10.4
laravel/sail 1.68.0 1.69.0
pestphp/pest 5.3.1 5.3.5

Updates inertiajs/inertia-laravel from 3.5.1 to 3.7.0

Release notes

Sourced from inertiajs/inertia-laravel's releases.

v3.7.0

What's Changed

Full Changelog: inertiajs/inertia-laravel@v3.6.0...v3.7.0

v3.6.0

What's Changed

New Contributors

Full Changelog: inertiajs/inertia-laravel@v3.5.2...v3.6.0

v3.5.2

What's Changed

New Contributors

Full Changelog: inertiajs/inertia-laravel@v3.5.1...v3.5.2

Changelog

Sourced from inertiajs/inertia-laravel's changelog.

v3.7.0 - 2026-11-02

What's Changed

Full Changelog: inertiajs/inertia-laravel@v3.6.0...v3.7.0

v3.5.2 - 2026-10-21

What's Changed

New Contributors

Full Changelog: inertiajs/inertia-laravel@v3.5.1...v3.5.2

Commits
  • 9d3f906 [3.x] Support for Live props (#901)
  • cb1a80f [3.x] Allow Laravel 11 releases with security advisories in CI (#928)
  • 32e63b7 Apply middleware redirect to QUERY (#927)
  • 1e87062 [3.x] Add a --no-stop option to inertia:start-ssr (#925)
  • 771fd29 Update CHANGELOG
  • 4e91cf4 [3.x] Don't treat streamed or "0" responses as empty for Inertia requests (#919)
  • 6431f9a [3.x] Reset the cached SSR response when the page changes (#924)
  • d25c67c [3.x] Append Vary header instead of setting it (#920)
  • 8355911 Update SECURITY.md
  • 3158d13 Update SECURITY.md
  • Additional commits viewable in compare view

Updates laravel/framework from 13.35.0 to 13.40.0

Release notes

Sourced from laravel/framework's releases.

v13.40.0

v13.39.0

... (truncated)

Changelog

Sourced from laravel/framework's changelog.

v13.40.0 - 2026-11-03

v13.39.0 - 2026-10-27

... (truncated)

Commits
  • 1449bf2 Update version to v13.40.0
  • c37133b [13.x] Fix: Authenticate the Concurrency Process Result Envelope to Prevent T...
  • 1571da1 Fix JSON:API resource collections wrapping plain objects (#62299)
  • aa6dcc6 Update command_signatures.php (#62295)
  • b20bf7f Update facade docblocks
  • 86d3106 [13.x] database fundamentals to know if a read connection has catched up to a...
  • c40be6a Update facade docblocks
  • 9a484bf [13.x] Add a strict flag to InteractsWithData (#62254)
  • 3f50fa3 add QueryList.TerminateAll to lost connection detector (#62270)
  • ce1e6fa Fix @​param types wider than the native parameter type (#62271)
  • Additional commits viewable in compare view

Updates mongodb/laravel-mongodb from 5.11.0 to 5.12.0

Release notes

Sourced from mongodb/laravel-mongodb's releases.

5.12.0

This release adds first-class support for MongoDB Queryable Encryption. Encrypted fields are declared once in the connection configuration, and the MongoDB driver encrypts, decrypts and answers queries on them transparently. Eloquent models keep their plain shape: no attribute, property or cast is needed.

'driver_options' => [
    'autoEncryption' => [
        'keyVaultNamespace' => 'encryption.__keyVault',
        'kmsProviders' => [
            'local' => ['key' => base64_encode(file_get_contents(storage_path('encryption/master-key.bin')))],
        ],
        'encryptedFieldsMap' => [
            'patients' => [
                'fields' => [
                    // `queryType` and the range options are flat, and a bare
                    // string declares a randomized, non-queryable field.
                    'ssn' => ['bsonType' => 'string', 'queryType' => 'equality'],
                    'billing_amount' => ['bsonType' => 'int', 'queryType' => 'range', 'min' => 0, 'max' => 5000, 'sparsity' => 1],
                    'billing' => 'object',
                ],
            ],
        ],
    ],
],

The encrypted collection, its metadata collections and indexes, and the missing data keys are created by one command. The same creation is available with Schema::connection('mongodb')->createEncrypted('patients').

php artisan mongodb:encryption:create-collection
php artisan mongodb:encryption:status

Queryable Encryption requires MongoDB 8.0 or later for range queries (equality queries work from 7.0), on a replica set or a sharded cluster, with the Automatic Encryption Shared Library. Queries on encrypted fields cannot be combined with Atlas Search.

Queryable Encryption

  • Declare encrypted fields in the connection and create the collection with the Schema DSL or Artisan: by @​GromNaN in #3577
  • Create every mapped encrypted collection at once, with interactive selection and a --dry-run preview: by @​GromNaN in #3607
  • Coerce the value written to an encrypted field to the declared BSON type, and derive the matching Eloquent cast: by @​GromNaN in #3645
  • Hide the reserved __safeContent__ field from hydrated models and reject writes to it: by @​GromNaN in #3652
  • Report a mapped collection that exists without the declared encrypted fields, and a collection whose fields differ from the configuration: by @​GromNaN in #3653
  • Key the encryptedFieldsMap by namespace before handing it to the driver. The map was keyed by collection name, so automatic encryption ignored it and a write to a mapped collection that the server did not know as encrypted stored the fields in plaintext: by @​GromNaN in #3657
  • Rotate the master key of the data keys with mongodb:encryption:rewrap-data-keys: by @​paulinevos in #3602
  • Forward tlsOptions to ClientEncryption, for a KMS reachable only through a private CA: by @​GromNaN in #3606
  • Report an unreachable server from mongodb:encryption:status: by @​zigzagdev in #3624
  • Keep the Connection API small. Only isAutoEncryptionEnabled() and getClientEncryption() are public, for diagnostics and for encryptExpression(). The rest of the encryption logic stays internal: by @​GromNaN in #3660

Breaking changes

  • Apply the connection prefix in the schema methods inherited from Laravel. hasTable(), dropIfExists(), getColumns() and getIndexes() now apply the prefix, as Laravel does. The migration repository relies on hasTable(), so with a prefix every migration ran again. An application that calls these methods with the real collection name must pass the unprefixed name. hasCollection() and getCollection() are not Laravel methods and keep taking the real name: by @​GromNaN in #3655

... (truncated)

Commits
  • faea6c1 Reduce the Queryable Encryption API on the Connection class (#3660)
  • 961377c Add AI Usage to CONTRIBUTING.md (#3661)
  • d3aa79c Keep the exact value of a double used as a relation key (#3658)
  • d7c0be0 Report a mapped collection that does not hold the declared encrypted fields (...
  • 697b04b PHPLARA-314: Key the encryptedFieldsMap by namespace before handing it to the...
  • 958c0d2 Apply the table prefix in the schema methods inherited from Laravel (#3655)
  • b017f9e PHPLARA-279 Hide the reserved __safeContent__ field from hydrated models (#...
  • 42219f0 PHPLARA-295 Deny server-side JavaScript operators in DatabaseQuery (#3651)
  • d4f0090 PHPLARA-271: Cast encrypted fields to the declared BSON type (#3645)
  • 1ca83aa PHPLARA-307: Report MongoDB query events without enabling the query log (#3646)
  • Additional commits viewable in compare view

Updates spatie/laravel-permission from 8.3.0 to 8.3.2

Release notes

Sourced from spatie/laravel-permission's releases.

8.3.2

Performance

  • Speed up repeated cached permission lookups by name and ID without changing lookup semantics (#2969).
  • Preserve loose comparisons, guard isolation, first-match ordering, shared model identity, and mutations of returned models. Custom models and keyed collections continue to use the original filter.
  • Keep lookup indexes tied to cache invalidation, including saved changes, deletion, explicit resets, and cache/tenant reinitialization.

Verification

  • Add regression coverage for numeric comparisons, custom accessors and keys, collection ordering, runtime casts, invalidation, strict missing-attribute handling, and release of cached model references.
  • Add an opt-in benchmark covering warm hits/misses, hydration, and retained memory. Indexing trades some hydration work and memory for faster repeated lookups; performance depends on the workload and is not unconditionally O(1).

No breaking changes. Public APIs, persistent cache format, and PHP/Laravel support are unchanged.

Full Changelog: spatie/laravel-permission@8.3.1...8.3.2

8.3.1

Fixes

  • Respect the explicit guard when hasRole() and hasAllRoles() receive a role model, including model-array checks. Fixes #2977 via #2978.
  • Refresh the cache manager when reinitializing permission caches, preventing stale stores after tenant or cache configuration switches (#2973).
  • Exclude pint.json from distribution archives (#2972).

Maintenance

  • Update test tooling to Pest 5.3.3, with Pest 4.7.8 for compatible PHP 8.3 and Laravel 12 stacks.
  • Test PHP 8.3–8.6 and Laravel 12/13 with appropriate lowest and highest dependencies (#2975, #2976, #2978).

No breaking changes. PHP and Laravel support are unchanged.

Full Changelog: spatie/laravel-permission@8.3.0...8.3.1

Changelog

Sourced from spatie/laravel-permission's changelog.

8.3.2 - 2026-10-19

Performance

  • Speed up repeated cached permission lookups by name and ID without changing lookup semantics (#2969).
  • Preserve loose comparisons, guard isolation, first-match ordering, shared model identity, and mutations of returned models. Custom models and keyed collections continue to use the original filter.
  • Keep lookup indexes tied to cache invalidation, including saved changes, deletion, explicit resets, and cache/tenant reinitialization.

Verification

  • Add regression coverage for numeric comparisons, custom accessors and keys, collection ordering, runtime casts, invalidation, strict missing-attribute handling, and release of cached model references.
  • Add an opt-in benchmark covering warm hits/misses, hydration, and retained memory. Indexing trades some hydration work and memory for faster repeated lookups; performance depends on the workload and is not unconditionally O(1).

No breaking changes. Public APIs, persistent cache format, and PHP/Laravel support are unchanged.

Full Changelog: spatie/laravel-permission@8.3.1...8.3.2

8.3.1 - 2026-10-19

Fixes

  • Respect the explicit guard when hasRole() and hasAllRoles() receive a role model, including model-array checks. Fixes #2977 via #2978.
  • Refresh the cache manager when reinitializing permission caches, preventing stale stores after tenant or cache configuration switches (#2973).
  • Exclude pint.json from distribution archives (#2972).

Maintenance

  • Update test tooling to Pest 5.3.3, with Pest 4.7.8 for compatible PHP 8.3 and Laravel 12 stacks.
  • Test PHP 8.3–8.6 and Laravel 12/13 with appropriate lowest and highest dependencies (#2975, #2976, #2978).

No breaking changes. PHP and Laravel support are unchanged.

Full Changelog: spatie/laravel-permission@8.3.0...8.3.1

Commits
  • e4e906f Merge pull request #2969: optimize cached permission lookups safely
  • c74c94e Preserve permission lookup semantics while indexing cached models
  • 17c93a2 Merge remote-tracking branch 'origin/main' into perf/index-permission-lookups
  • e868d6a Update CHANGELOG
  • 1ab5d33 Merge pull request #2978 from sean0407/codex/spatie-2977-role-guard-20261019
  • 1a43000 Strengthen role guard checks and update Pest tooling
  • b5570d5 fix: respect guard when checking role models
  • 182889d Test on PHP 8.6 (#2975)
  • da7bb6c Merge pull request #2976 from jnoordsij/consistent-composer-ci
  • 2d162c9 Use Pest 4 with the Laravel 12 Testbench stack
  • Additional commits viewable in compare view

Updates barryvdh/laravel-ide-helper from 3.7.0 to 3.8.0

Release notes

Sourced from barryvdh/laravel-ide-helper's releases.

v3.8.0

What's Changed

New Contributors

Full Changelog: barryvdh/laravel-ide-helper@v3.7.0...v3.8.0

Changelog

Sourced from barryvdh/laravel-ide-helper's changelog.

v3.8.0 - 2026-11-03

What's Changed

New Contributors

Full Changelog: barryvdh/laravel-ide-helper@v3.7.0...v3.8.0

Commits
  • f9521af Add phpstan files to export-ignore in .gitattributes (#1799)
  • 3a886dc fix: resolve scope builder class against the model being documented (#1796)
  • 20497cb Keep imported phpstan/psalm types unqualified (#1797)
  • cc26683 fix: strip redundant builder @param tags for optional scalar defaults (#1785)
  • 5060909 fix: Don't force |null on BelongsTo relations using ->withTrashed() (#1783)
  • 3a53071 Remove Laravel 11.x from integration test matrix
  • 04c8d5d Add regression test for unique() column type resolution (#1787)
  • 3f742fd Bump actions/checkout from 6 to 7 in the deps group (#1792)
  • e1b1ef7 Skip incrementEach and decrementEach for Eloquent helper (#1782)
  • 7fd3b7a Bump release-drafter/release-drafter from 6 to 7 in the deps group (#1776)
  • Additional commits viewable in compare view

Updates laravel/boost from 2.10.3 to 2.10.4

Release notes

Sourced from laravel/boost's releases.

v2.10.4

What's Changed

Bumps the composer group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [inertiajs/inertia-laravel](https://github.com/inertiajs/inertia-laravel) | `3.5.1` | `3.7.0` |
| [laravel/framework](https://github.com/laravel/framework) | `13.35.0` | `13.40.0` |
| [mongodb/laravel-mongodb](https://github.com/mongodb/laravel-mongodb) | `5.11.0` | `5.12.0` |
| [spatie/laravel-permission](https://github.com/spatie/laravel-permission) | `8.3.0` | `8.3.2` |
| [barryvdh/laravel-ide-helper](https://github.com/barryvdh/laravel-ide-helper) | `3.7.0` | `3.8.0` |
| [laravel/boost](https://github.com/laravel/boost) | `2.10.3` | `2.10.4` |
| [laravel/sail](https://github.com/laravel/sail) | `1.68.0` | `1.69.0` |
| [pestphp/pest](https://github.com/pestphp/pest) | `5.3.1` | `5.3.5` |



Updates `inertiajs/inertia-laravel` from 3.5.1 to 3.7.0
- [Release notes](https://github.com/inertiajs/inertia-laravel/releases)
- [Changelog](https://github.com/inertiajs/inertia-laravel/blob/3.x/CHANGELOG.md)
- [Commits](inertiajs/inertia-laravel@v3.5.1...v3.7.0)

Updates `laravel/framework` from 13.35.0 to 13.40.0
- [Release notes](https://github.com/laravel/framework/releases)
- [Changelog](https://github.com/laravel/framework/blob/13.x/CHANGELOG.md)
- [Commits](laravel/framework@v13.35.0...v13.40.0)

Updates `mongodb/laravel-mongodb` from 5.11.0 to 5.12.0
- [Release notes](https://github.com/mongodb/laravel-mongodb/releases)
- [Commits](mongodb/laravel-mongodb@5.11.0...5.12.0)

Updates `spatie/laravel-permission` from 8.3.0 to 8.3.2
- [Release notes](https://github.com/spatie/laravel-permission/releases)
- [Changelog](https://github.com/spatie/laravel-permission/blob/main/CHANGELOG.md)
- [Commits](spatie/laravel-permission@8.3.0...8.3.2)

Updates `barryvdh/laravel-ide-helper` from 3.7.0 to 3.8.0
- [Release notes](https://github.com/barryvdh/laravel-ide-helper/releases)
- [Changelog](https://github.com/barryvdh/laravel-ide-helper/blob/master/CHANGELOG.md)
- [Commits](barryvdh/laravel-ide-helper@v3.7.0...v3.8.0)

Updates `laravel/boost` from 2.10.3 to 2.10.4
- [Release notes](https://github.com/laravel/boost/releases)
- [Changelog](https://github.com/laravel/boost/blob/main/CHANGELOG.md)
- [Commits](laravel/boost@v2.10.3...v2.10.4)

Updates `laravel/sail` from 1.68.0 to 1.69.0
- [Release notes](https://github.com/laravel/sail/releases)
- [Changelog](https://github.com/laravel/sail/blob/1.x/CHANGELOG.md)
- [Commits](laravel/sail@v1.68.0...v1.69.0)

Updates `pestphp/pest` from 5.3.1 to 5.3.5
- [Release notes](https://github.com/pestphp/pest/releases)
- [Changelog](https://github.com/pestphp/pest/blob/5.x/RELEASE.md)
- [Commits](pestphp/pest@v5.3.1...v5.3.5)

---
updated-dependencies:
- dependency-name: inertiajs/inertia-laravel
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: composer
- dependency-name: laravel/framework
  dependency-version: 13.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: composer
- dependency-name: mongodb/laravel-mongodb
  dependency-version: 5.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: composer
- dependency-name: spatie/laravel-permission
  dependency-version: 8.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: composer
- dependency-name: barryvdh/laravel-ide-helper
  dependency-version: 3.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: composer
- dependency-name: laravel/boost
  dependency-version: 2.10.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: composer
- dependency-name: laravel/sail
  dependency-version: 1.69.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: composer
- dependency-name: pestphp/pest
  dependency-version: 5.3.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Nov 9, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file php Pull requests that update Php code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants