Every meaningful change, recorded.

Security maintenance

Updated Symfony components from 7.4.22 to 7.4.23 in all three PHP lockfiles. The previous locks matched seven upstream advisories published on November 4:

• HEAD method matching and compiled host matching could weaken method- or path-based access rules in affected Symfony integrations.
• Script-name path parsing and base URL handling could disagree with external path rules or produce client-controlled URL authorities under specific web-server rewrites.
• Trusted proxy shortcuts and inline fragments could accept forwarded request metadata under their documented proxy conditions.
• YAML parsing could consume excessive processing time for crafted documents.

These are dependency-version matches, not confirmed application exploits. The reviewed application does not configure Symfony Firewall rules, inline fragments, the private_ranges proxy shortcut, host-placeholder routes, or request-supplied YAML parsing. The bundled Caddy configuration serves public/ directly through PHP-FPM. External CDN rules, custom rewrites and package consumers require their own deployment assessment. Existing installations should refresh their Composer locks to receive the patched components.

Compatible updates

• Laravel 13.39.0 → 13.40.0 and PHPUnit 12.5.42 → 12.5.43 across all three PHP projects; related URI, console, error-handler and Symfony contract dependencies refreshed within existing constraints.
• Boilerplate: Vite 8.3.5 → 8.3.6, Laravel Vite Plugin 3.2.0 → 3.2.1 and Concurrently 10.0.6 → 10.0.7.
• Website: Astro 7.4.4 → 7.4.7, with compatible Markdown, highlighting and bundler dependency updates.
• Both frontends: Tailwind CSS and its Vite integration 4.3.3 → 4.3.5.
• PHP and Node.js support baselines and application API contracts remain unchanged. Existing Dependabot proposals were checked before consolidating these updates; no duplicate update PRs were created.

Verification

• All 417 PHP tests passed: 295 boilerplate, 70 API Keys and 52 Coupon tests.
• Both package suites passed on Laravel 12 / PHP 8.2 and Laravel 13 / PHP 8.3; the boilerplate suite also passed on PHP 8.3.
• Six focused checks confirmed the patched request behavior for script-name prefixes, URL authorities, HEAD matching and mapped-address proxy trust. These component checks do not establish application exploitability.
• Composer manifest, lockfile, platform and formatting checks passed. Three Composer audits and both npm audits reported zero known advisories on November 9, 2026.
• Both frontends passed clean npm installs and production builds. All internal links in the website’s 36 generated pages resolved.
• Playwright verified desktop documentation, Roadmap and package navigation; the new Changelog entry and permanent link; and mobile reading and navigation without page errors.
• Docker production and development images built. The production container initialized configuration, route, view and event caches, started PHP-FPM and passed its configuration check.

The boilerplate update was tested in an isolated worktree, preserving ongoing feature development. No functional regressions were found within these checks.

PHP dependencies

• Updated CommonMark from 2.10.4 to 2.10.7, Composer Semver from 3.5.2 to 3.6.0, and Whoops from 2.18.7 to 2.19.1 in all three PHP projects.
• Reused the existing Boost Dependabot update to move the boilerplate from Laravel Boost 2.10.3 to 2.10.4.
• Updated the boilerplate’s Google Auth to 1.55.3, GAX to 1.51.2, and gRPC GCP support to 0.5.0 within the SDK’s declared constraints.
• Kept Laravel 13.39.0, Symfony 7.4.22, and the existing PHP support baselines.

Frontend dependencies

• Updated Rolldown from 1.2.15 to 1.2.16 and refreshed compatible parser, source type, and TypeScript helper dependencies in both frontend lock files.
• Kept Astro 7.4.4, Vite 8.3.5, Tailwind CSS 4.3.3, and the Node.js 22.23.4 baseline.

Compatibility note

Boost 2.10.4 removes the development-only application-info MCP tool. The application and packages do not reference that tool; external AI workflows that call it should review the upstream Boost release notes. Application API routes and response contracts are unchanged by this maintenance update.

Verification

• All 417 existing PHP tests passed: 295 boilerplate tests, 70 API Keys tests, and 52 Coupon tests.
• Both package suites passed on Laravel 12 / PHP 8.2 and Laravel 13 / PHP 8.3. The boilerplate suite also passed on PHP 8.3.
• Composer manifest, lockfile, platform and formatting checks passed. Three Composer audits and both npm audits reported zero known security advisories on November 2, 2026.
• Both frontends passed clean npm installs and production builds. All internal links in the website’s 36 generated pages resolved.
• Playwright verified desktop navigation through documentation, Roadmap and package pages; the latest Changelog entry and permanent-link reload; and mobile reading and navigation, with no page errors.
• Docker production and development images built successfully. The production container completed configuration, route, view and event cache initialization, and its PHP-FPM configuration check passed.

The boilerplate changes were validated in an isolated worktree so ongoing application feature work was preserved. No functional regressions were found within these checks.

Dependencies

• Updated all three PHP projects to Laravel 13.39.0, Symfony 7.4.22 HTTP Foundation, MIME and YAML components, and PHPUnit 12.5.42.
• Updated the boilerplate’s transitive dependencies, including Guzzle 8.3.1 and phpseclib 4.0.2.
• Updated frontend tooling to Vite 8.3.5, Axios 1.21.0, and Concurrently 10.0.6.
• Updated the website to Astro 7.4.4, Sharp 0.35.5, and daisyUI 5.7.50.
• Removed the unused spatie/laravel-data dependency and its published configuration. Existing API Resources continue to shape responses.

Configuration and compatibility

• Standardized the frontend Node.js baseline on 22.23.4 through .nvmrc, package engine requirements, GitHub Actions, and the boilerplate Docker asset build.
• Changed the boilerplate setup script to use npm ci for reproducible frontend installs.
• Declared the complete Laravel Framework dependency in both extension packages, with supported ranges ^12.69 | ^13.30.
• Added committed development lock files targeting PHP 8.3 and Laravel 13. Downstream applications continue to resolve their own dependencies.
• Updated package CI to audit committed lock files before resolving current dependencies, and to match dependency resolution to each PHP version in the compatibility matrix.

Verification

All 417 existing PHP tests passed:

Project	Tests	Assertions
Laravel API Boilerplate	295	784
Laravel API Keys	70	157
Laravel Coupon	52	126

• Both package suites also passed on Laravel 12 / PHP 8.2 and Laravel 13 / PHP 8.3. The boilerplate suite additionally passed on PHP 8.3.
• The boilerplate Vite build and the website’s 36-page static build passed. All website internal links resolved.
• A clean website install and build passed on Node.js 22.23.4 in Linux, matching the CI baseline.
• Both production and development Docker images built successfully. Production container configuration, route, view and event cache initialization, and the PHP-FPM configuration check passed.
• All three Composer audits and both npm audits reported zero known security advisories as of October 29, 2026.

No functional regressions were found within these tests and build checks.

Upgrade note: Use Node.js 22.23.4 or newer for frontend builds. Applications that use Laravel Data should retain it as an explicit dependency when adopting the boilerplate changes. The package development lock files require PHP 8.3; Laravel 12 consumers remain supported on PHP 8.2.

Stable distribution

• Laravel API Boilerplate is available as a GitHub Template, a Git clone, and composer create-project mrsuner/laravel-api-boilerplate "^1.0".
• mrsuner/laravel-api-keys and mrsuner/laravel-coupon are available as stable Composer packages for Laravel 12 and 13.
• Every component has an immutable v1.0.0 Git tag, a GitHub Release, an MIT license, and reproducible CI gates.

Installation

composer create-project mrsuner/laravel-api-boilerplate my-api "^1.0"
composer require mrsuner/laravel-api-keys "^1.0"
composer require mrsuner/laravel-coupon "^1.0"

See the installation guide and official package documentation for configuration and integration details.

Framework and runtime

• Upgraded the boilerplate to Laravel 13.26.1 and raised the minimum PHP version to 8.3.
• Updated Laravel Boost to 2.5, Tinker to 3.0, and PHPUnit to 12.5.
• Updated Sanctum’s CSRF middleware to Laravel 13’s PreventRequestForgery implementation.
• Switched new installations to JSON session serialization.

Package compatibility

• Added Laravel 13 support to laravel-api-keys and laravel-coupon.
• Both packages now support Laravel 12 and 13 through dedicated Testbench and PHPUnit matrices.
• Laravel 11 is no longer included in the supported Composer constraints.

Dependencies and delivery

• Cleared all known Composer and npm security advisories across the workspace.
• Upgraded the website from Astro 5 to Astro 7.
• Added reproducible npm installs to the boilerplate Docker build with package-lock.json and npm ci.
• Added GitHub Actions and Dependabot configuration to all four repositories.

Verification

The maintenance release passed 417 PHP tests across the three PHP projects. It also passed clean database migrations, route and scheduler discovery, Scribe generation, a production Docker build, and the 35-page website build.

Deployment note: JSON session serialization invalidates existing cookie sessions, so users will need to sign in again. Applications using OAuth or FCM should also complete a staging smoke test with real provider credentials.