Raise the minimum versions so installs can no longer resolve releases with
known advisories (Dependabot alerts):
- laravel/framework / illuminate/*: ^12.69|^13.0 (TokenGuard auth bypass,
CRLF injection in the email rule, signed URL path confusion, debug page XSS).
Laravel 11 is end of life and gets no fixes, so support for it is dropped.
- firebase/php-jwt: ^7.0 (weak encryption in 6.x).
- orchestra/testbench: ^10.0|^11.0 to match.
Tests pass with both the lowest and the highest allowed versions.
Fixed (called endpoints that don't exist):
- charge(): POST v1/billing/charge (Stripe options aren't passed through anymore)
- Invoice::getInvoiceTemporaryUrl(): GET instead of a non-existent PUT
- OrderItems::create(): POST v1/orders/{order}/items
- createUser() / isEmailExisting(): admin endpoints with the app token
- sshKeysByUserId(): app endpoint; no longer returns the first user's keys for every user
- createOrderPreview(): country_iso goes into billing_address as the API expects
- public endpoints (products, order preview) work without a token
- SshKeys::find() results can be deleted
Added:
- Billable: sshKeys() (create, update, delete), billingOverview(), PaymentMethod::delete()
- AnikeenId: products(), boxes(), shipping labels (list, show, pdf, issue, ship, price list),
createOrderForUser(), createTransactionForUser(), findOrCreateSocialiteUser()
Requirements: PHP 8.2+, Laravel 11-13 (Laravel 10 and PHP 8.1 are end of life).
Docs generator handles union types; README regenerated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- $user->appSubscriptions(): create (idempotency_key), find, all, checkout, revoke, pause,
resume, update against /v1/client/subscriptions with a client credentials token, so apps don't
depend on the user's login
- user id from the billable's anikeen_id (AnikeenId::useUserIdField())
- ApiException with status, stable error code, isNotFound/isConflict/isTemporary; network
errors no longer escape as raw Guzzle exceptions
- rejected app tokens are renewed once; asApp() never changes the shared client's token
- tests (testbench + Guzzle mock) and CI
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Maurice Preuß
René Preuß