[dependabot]

Bumps the composer-major group with 2 updates in the / directory: laravel-notification-channels/webpush and laravel/framework.

Updates laravel-notification-channels/webpush from 11.0.0 to 13.0.1

Release notes

Sourced from laravel-notification-channels/webpush's releases.

13.0.1

Retagging because of mistagging. No functional changes.

13.0.0

What's Changed

• Breaking: Return web push delivery reports from the notification channel by @​QuentinGab in laravel-notification-channels/webpush#224. Now, MessageSentReport[] is returned from WebPushChannel::send() instead of void, exposing delivery results through Laravel's native afterSending()/NotificationSent hooks. If you override send() or handleReports(), update your method signatures accordingly.

New Contributors

• @​QuentinGab made their first contribution in laravel-notification-channels/webpush#224

Full Changelog: laravel-notification-channels/webpush@12.1.0...13.0.0

12.1.0

What's Changed

• Increase push subscription endpoint column length to 1024 by @​oliinykdm in laravel-notification-channels/webpush#223. Existing installations: republish migrations (php artisan vendor:publish --tag=migrations) and run php artisan migrate to apply increase_push_subscriptions_endpoint_length. Fresh installs get the wider column automatically.
• Fix tests on Laravel 12 and lower-Laravel 13-versions

New Contributors

• @​oliinykdm made their first contribution in laravel-notification-channels/webpush#223

Full Changelog: laravel-notification-channels/webpush@12.0.0...12.1.0

12.0.0

This is a major release containing several breaking changes:

• Breaking: minishlink/web-push is bumped to v11, which replaces its Guzzle-specific implementation with a PSR-18 HTTP client. If you use this library directly, please consult their release notes.
• Breaking: on Laravel 13.13+, push notifications are now sent through Laravel's HTTP client instead of Guzzle. This means global HTTP middleware, request logging, and Http::fake() now apply to web push requests. When running Laravel 13, at least v13.13 is required because earlier Laravel HTTP clients can't safely be used as PSR-18 clients; Laravel 12 keeps using a Guzzle client under the hood as a fallback.
• Raised the PHPStan level project-wide to level 9. No behavior change expected under normal usage.

⚠️ Please consider upgrading to v12.1.0 directy given the database-related change there.

Full Changelog: laravel-notification-channels/webpush@11.0.0...12.0.0

Commits

• 53d950c feat: return web push delivery reports from the notification channel (#224)
• 6e9bea3 fix: increase push subscription endpoint column length to 1024 (#223)
• 1ea4d1a fix: add guzzle psr-7
• e18f26b fix: guzzle discovery in laravel 12
• 8b294aa refactor: use laravel http facade
• dbfb8c6 refactor: raise phpstan level
• c76e03d chore: update changelog
• See full diff in compare view

Updates laravel/framework from 13.39.0 to 13.40.0

Release notes

Sourced from laravel/framework's releases.

v13.40.0

• [13.x] Fix Paginator::links() return type by @​dhrupo in laravel/framework#62226
• [13.x] Fix updating JSON paths with arrays and collections on MySQL and MariaDB by @​xurshudyan in laravel/framework#62225
• [13.x] Use the write connection in BelongsToMany createOrFirst lookup by @​xurshudyan in laravel/framework#62223
• [13.x] Drop check constraints when dropping columns on SQL Server by @​xurshudyan in laravel/framework#62222
• [13.x] Centralize + improve tests for InteractsWithData by @​inxilpro in laravel/framework#62217
• [13.x] Fix Redis tagged cache flush blocking Redis when flushing many tags by @​MohannadElemary in laravel/framework#62215
• [13.x] Qualify dropped and renamed indexes with the table schema on PostgreSQL by @​xurshudyan in laravel/framework#62213
• [13.x] Reconnect after losing the connection during a transaction by @​xurshudyan in laravel/framework#62211
• [13.x] Add missing PostgreSQL full text languages by @​xurshudyan in laravel/framework#62210
• [13.x] Add Queue::whenJobRunsLongerThan by @​jackbayliss in laravel/framework#62141
• [13.x] Fix named arguments in Cookie::queue() by @​xurshudyan in laravel/framework#62246
• [13.x] Fix ImageFile::default() returning a plain File rule by @​Marzaan in laravel/framework#62244
• [13.x] Fix pagination contracts render() return type by @​dhrupo in laravel/framework#62242
• [13.x] Fix SQL Server ignoring orderBy on update and delete with limit by @​xurshudyan in laravel/framework#62239
• [13.x] Preserve error_get_last() for suppressed errors by @​xurshudyan in laravel/framework#62228
• Prepare reusable development environments for Amp orbs by @​DGarbs51 in laravel/framework#62231
• Allow $middleware->replace() to accept an array of replacements by @​ziadoz in laravel/framework#62230
• [13.x] Show released jobs as released in queue:work output by @​jackbayliss in laravel/framework#62180
• Add $middleware->insertBefore() and $middleware->insertAfter() helper methods by @​ziadoz in laravel/framework#62261
• [13.x] Reconnect the Cloud log socket after a failed write by @​jamesdangercarpenter in laravel/framework#62258
• [13.x] Dispatch ScheduledTaskSkipped when a task already ran on another server by @​jackbayliss in laravel/framework#62256
• [13.x] Fix forceIndex() generating invalid SQL on SQLite for PRIMARY and multiple indexes by @​tharlei in laravel/framework#62255
• [13.x] Add Schedule::whenTaskRunsLongerThan by @​jackbayliss in laravel/framework#62233
• [13.x] Roll back to savepoint on concurrency errors in nested transactions by @​xurshudyan in laravel/framework#62248
• [13.x] Fix toResourceCollection() on filtered collections by @​xurshudyan in laravel/framework#62266
• Fix lazily loaded images not being freed until garbage collection by @​tamc in laravel/framework#62265
• Bump stefanzweifel/git-auto-commit-action from 7.2.0 to 7.2.1 in the github-actions group by @​dependabot[bot] in laravel/framework#62288
• KeyGenerateCommand: improve help message about '--show' by @​valerio-bozzolan in laravel/framework#62286
• [13.x] Record failed batch jobs when the model is missing by @​xurshudyan in laravel/framework#62280
• [13.x] Fix broadcasting to multiple encrypted Pusher channels by @​xurshudyan in laravel/framework#62279
• [13.x] Fix Str::remove() rejecting a Traversable subject by @​Amirhf1 in laravel/framework#62278
• [13.x] Fix Str::substrCount() treating offset and length as bytes by @​Amirhf1 in laravel/framework#62277
• [13.x] Fix withExists() and loadExists() on SQL Server by @​xurshudyan in laravel/framework#62273
• [13.x] Fix cursorPaginate() columns on union queries with multiple orders by @​xurshudyan in laravel/framework#62272
• [13.x] Fix @​param types wider than the native parameter type by @​dhrupo in laravel/framework#62271
• [13.x] Detect QueryList.TerminateAll() as lost connection by @​jackbayliss in laravel/framework#62270
• [13.x] Add a strict flag to InteractsWithData by @​inxilpro in laravel/framework#62254
• [13.x] database fundamentals to know if a read connection has catched up to a write connection by @​tpetry in laravel/framework#62198
• [13.x] Fix CommandSignatureTest by @​jackbayliss in laravel/framework#62295
• [13.x] Fix JSON:API resource collections wrapping plain objects by @​lazerg in laravel/framework#62299
• [13.x] Fix: Authenticate the Concurrency Process Result Envelope to Prevent Task Output Injection by @​Arr0way in laravel/framework#62297

Changelog

Sourced from laravel/framework's changelog.

v13.40.0 - 2026-11-03

• [13.x] Fix Paginator::links() return type by @​dhrupo in laravel/framework#62226
• [13.x] Fix updating JSON paths with arrays and collections on MySQL and MariaDB by @​xurshudyan in laravel/framework#62225
• [13.x] Use the write connection in BelongsToMany createOrFirst lookup by @​xurshudyan in laravel/framework#62223
• [13.x] Drop check constraints when dropping columns on SQL Server by @​xurshudyan in laravel/framework#62222
• [13.x] Centralize + improve tests for InteractsWithData by @​inxilpro in laravel/framework#62217
• [13.x] Fix Redis tagged cache flush blocking Redis when flushing many tags by @​MohannadElemary in laravel/framework#62215
• [13.x] Qualify dropped and renamed indexes with the table schema on PostgreSQL by @​xurshudyan in laravel/framework#62213
• [13.x] Reconnect after losing the connection during a transaction by @​xurshudyan in laravel/framework#62211
• [13.x] Add missing PostgreSQL full text languages by @​xurshudyan in laravel/framework#62210
• [13.x] Add Queue::whenJobRunsLongerThan by @​jackbayliss in laravel/framework#62141
• [13.x] Fix named arguments in Cookie::queue() by @​xurshudyan in laravel/framework#62246
• [13.x] Fix ImageFile::default() returning a plain File rule by @​Marzaan in laravel/framework#62244
• [13.x] Fix pagination contracts render() return type by @​dhrupo in laravel/framework#62242
• [13.x] Fix SQL Server ignoring orderBy on update and delete with limit by @​xurshudyan in laravel/framework#62239
• [13.x] Preserve error_get_last() for suppressed errors by @​xurshudyan in laravel/framework#62228
• Prepare reusable development environments for Amp orbs by @​DGarbs51 in laravel/framework#62231
• Allow $middleware->replace() to accept an array of replacements by @​ziadoz in laravel/framework#62230
• [13.x] Show released jobs as released in queue:work output by @​jackbayliss in laravel/framework#62180
• Add $middleware->insertBefore() and $middleware->insertAfter() helper methods by @​ziadoz in laravel/framework#62261
• [13.x] Reconnect the Cloud log socket after a failed write by @​jamesdangercarpenter in laravel/framework#62258
• [13.x] Dispatch ScheduledTaskSkipped when a task already ran on another server by @​jackbayliss in laravel/framework#62256
• [13.x] Fix forceIndex() generating invalid SQL on SQLite for PRIMARY and multiple indexes by @​tharlei in laravel/framework#62255
• [13.x] Add Schedule::whenTaskRunsLongerThan by @​jackbayliss in laravel/framework#62233
• [13.x] Roll back to savepoint on concurrency errors in nested transactions by @​xurshudyan in laravel/framework#62248
• [13.x] Fix toResourceCollection() on filtered collections by @​xurshudyan in laravel/framework#62266
• Fix lazily loaded images not being freed until garbage collection by @​tamc in laravel/framework#62265
• Bump stefanzweifel/git-auto-commit-action from 7.2.0 to 7.2.1 in the github-actions group by @​dependabot[bot] in laravel/framework#62288
• KeyGenerateCommand: improve help message about '--show' by @​valerio-bozzolan in laravel/framework#62286
• [13.x] Record failed batch jobs when the model is missing by @​xurshudyan in laravel/framework#62280
• [13.x] Fix broadcasting to multiple encrypted Pusher channels by @​xurshudyan in laravel/framework#62279
• [13.x] Fix Str::remove() rejecting a Traversable subject by @​Amirhf1 in laravel/framework#62278
• [13.x] Fix Str::substrCount() treating offset and length as bytes by @​Amirhf1 in laravel/framework#62277
• [13.x] Fix withExists() and loadExists() on SQL Server by @​xurshudyan in laravel/framework#62273
• [13.x] Fix cursorPaginate() columns on union queries with multiple orders by @​xurshudyan in laravel/framework#62272
• [13.x] Fix @​param types wider than the native parameter type by @​dhrupo in laravel/framework#62271
• [13.x] Detect QueryList.TerminateAll() as lost connection by @​jackbayliss in laravel/framework#62270
• [13.x] Add a strict flag to InteractsWithData by @​inxilpro in laravel/framework#62254
• [13.x] database fundamentals to know if a read connection has catched up to a write connection by @​tpetry in laravel/framework#62198
• [13.x] Fix CommandSignatureTest by @​jackbayliss in laravel/framework#62295
• [13.x] Fix JSON:API resource collections wrapping plain objects by @​lazerg in laravel/framework#62299
• [13.x] Fix: Authenticate the Concurrency Process Result Envelope to Prevent Task Output Injection by @​Arr0way in laravel/framework#62297

Commits

• 1449bf2 Update version to v13.40.0
• c37133b [13.x] Fix: Authenticate the Concurrency Process Result Envelope to Prevent T...
• 1571da1 Fix JSON:API resource collections wrapping plain objects (#62299)
• aa6dcc6 Update command_signatures.php (#62295)
• b20bf7f Update facade docblocks
• 86d3106 [13.x] database fundamentals to know if a read connection has catched up to a...
• c40be6a Update facade docblocks
• 9a484bf [13.x] Add a strict flag to InteractsWithData (#62254)
• 3f50fa3 add QueryList.TerminateAll to lost connection detector (#62270)
• ce1e6fa Fix @​param types wider than the native parameter type (#62271)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}