Skip to content

Update laravel/framework to 13.34.0 - #56

Merged
iazaran merged 1 commit into
mainfrom
fix-dependabot-laravel-13-30-0
Sep 30, 2026
Merged

iazaran merged 1 commit into
mainfrom
fix-dependabot-laravel-13-30-0

Conversation

@iazaran

@iazaran iazaran commented Sep 30, 2026

Copy link
Copy Markdown
Owner

Summary

  • update the locked laravel/framework package from v13.16.0 to v13.34.0
  • resolve Dependabot alert 30 / GHSA-jh5r-qr3c-85q8 (XSS in the debug page, patched in 13.30.0)
  • also bump league/commonmark 2.10.0 → 2.10.3 and league/flysystem 3.34.0 → 3.36.0 (+ flysystem-local 3.31.0 → 3.35.3), which clears three advisories published in the last day that Dependabot hasn't raised yet:
  • composer.json is unchanged. These are dev-only lock updates (pulled in through orchestra/testbench), so nothing changes for package users.

Verification

  • composer validate --strict
  • composer audit --locked (no advisories)
  • vendor/bin/phpunit (531 tests, 2,079 assertions, 2 skipped)
  • git diff --check

🤖 Generated with Claude Code

Resolves Dependabot alert 30 (GHSA-jh5r-qr3c-85q8). Also bumps
league/commonmark to 2.10.3 and league/flysystem to 3.36.0 to clear
GHSA-97jj-33gv-5xf9, GHSA-3q6v-r5mr-hxv8 and GHSA-cxf4-7mrp-vvpr.
@iazaran
iazaran merged commit 598fd1f into main Sep 30, 2026
24 checks passed
@iazaran
iazaran deleted the fix-dependabot-laravel-13-30-0 branch September 30, 2026 16:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant