Require patched Laravel and php-jwt versions

Raise the minimum versions so installs can no longer resolve releases with
known advisories (Dependabot alerts):

- laravel/framework / illuminate/*: ^12.69|^13.0 (TokenGuard auth bypass,
  CRLF injection in the email rule, signed URL path confusion, debug page XSS).
  Laravel 11 is end of life and gets no fixes, so support for it is dropped.
- firebase/php-jwt: ^7.0 (weak encryption in 6.x).
- orchestra/testbench: ^10.0|^11.0 to match.

Tests pass with both the lowest and the highest allowed versions.
This commit is contained in:
Maurice Preuß committed 2026-11-04 22:05:30 +01:00
1 parent 61385df92f
commit df7e506a5e
3 files changed
+9 -9

No files matched your search

+5 -5
View File
@@ -15,15 +15,15 @@
"require": {
"php": "^8.2",
"ext-json": "*",
"illuminate/support": "^11.0|^12.0|^13.0",
"illuminate/console": "^11.0|^12.0|^13.0",
"illuminate/support": "^12.69|^13.0",
"illuminate/console": "^12.69|^13.0",
"guzzlehttp/guzzle": "^7.8",
"socialiteproviders/manager": "^4.6",
"firebase/php-jwt": "^6.10|^7.0"
"firebase/php-jwt": "^7.0"
},
"require-dev": {
"laravel/framework": "^11.0|^12.0|^13.0",
"orchestra/testbench": "^9.0|^10.0|^11.0",
"laravel/framework": "^12.69|^13.0",
"orchestra/testbench": "^10.0|^11.0",
"phpunit/phpunit": "^11.0|^12.0"
},
"autoload": {