chore(deps): Update Composer dependencies (security-patch)#448
chore(deps): Update Composer dependencies (security-patch)#448nielsdrost7 wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughThis PR updates the Composer dependency manifest and security audit artifacts. A vulnerability audit report is populated with discovered advisories across multiple packages, and both direct and transient dependency versions are upgraded to newer releases. ChangesDependency Audit and Version Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@updated-packages.txt`:
- Line 13: The dependency update from laravel/boost v1.8.10 to v2.4.6 is a major
upgrade with breaking changes: ensure the project meets the new minimums (PHP
8.2+, Laravel 11+), rename any references of the old CodeEnvironment symbol to
Agent (including classes, type hints and method names), update config/boost.php
by replacing the code_environment key with agents and adjust code that reads
that config (e.g., calls to config('boost.code_environment') ->
config('boost.agents')), and run php artisan boost:install to let the package
auto-migrate configuration and adopt the new opt-in command flags; consult
UPGRADE.md for any additional changes and update any uses of boost:install flags
to the new format.
- Line 10: The package upgrade from barryvdh/laravel-debugbar v3.16.3 to v4.2.8
is a package transfer with breaking changes; remove the old dev dependency and
install fruitcake/laravel-debugbar as instructed (run the equivalent of composer
remove for barryvdh/laravel-debugbar and composer require for
fruitcake/laravel-debugbar), then update all references and imports from
Barryvdh\Debugbar to Fruitcake\LaravelDebugbar, adjust configuration keys
(rename hiddens → masked and update query bindings handling), remove or replace
removed features/usages (socket storage, Lumen-specific code, PDO extension
usage, and any global helper calls), and follow the official upgrade guide to
update code paths and tests before deploying.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 5d06e3f6-f30d-4858-93b3-edbc7adbeba2
⛔ Files ignored due to path filters (1)
composer.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
audit-report.jsonupdated-packages.txt
| maatwebsite/excel: 3.1.67 → 3.1.69 | ||
| nwidart/laravel-modules: v12.0.4 → v12.0.5 | ||
| spatie/laravel-permission: 6.24.0 → 6.25.0 | ||
| barryvdh/laravel-debugbar: v3.16.3 → v4.2.8 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check for laravel-debugbar v4 breaking changes and changelog
echo "=== Checking for breaking changes in laravel-debugbar v4 ==="
rg -n "DebugBar|Barryvdh" --type php -C 2 -g '!vendor/**'Repository: InvoicePlane/InvoicePlane-v2
Length of output: 133
🌐 Web query:
barryvdh/laravel-debugbar version 4 breaking changes and migration guide
💡 Result:
Laravel Debugbar version 4.0.0 introduced significant changes, most notably the transfer of package ownership from barryvdh/laravel-debugbar to fruitcake/laravel-debugbar [1][2][3]. To migrate to version 4.x, you must perform a manual replacement of the package [2][3]. Migration Steps: 1. Remove the old package: composer remove barryvdh/laravel-debugbar --dev --no-scripts [1][2][3] 2. Install the new package: composer require fruitcake/laravel-debugbar --dev --with-dependencies [2][3] 3. Update Namespaces: All references to the old namespace (Barryvdh\Debugbar) must be updated to the new namespace: Fruitcake\LaravelDebugbar [2][3][4]. Key Breaking Changes: - Package Ownership: The package is now maintained under the fruitcake organization [1][2][3]. - Removed Features: Support for Socket storage, Lumen framework, and PDO extension functionality has been removed [2][3][4]. - Helper Methods: The helper methods start_measure, add_measure, stop_measure, and measure have been removed; you should use debugbar->startMeasure and related methods instead [4]. - Configuration: Default configuration values have changed, and some options were removed [2][3]. It is recommended to publish the new configuration file and compare it with your existing settings [2][3]. - Dependencies: The package now requires php-debugbar 3.x, which removes dependencies on jQuery and Font Awesome [4]. - Internal Changes: The Query Collector now uses 'params' instead of 'bindings', and the 'hiddens' configuration option has been replaced by 'masked' [4]. For further details, consult the official upgrade guide at the fruitcake/laravel-debugbar repository [4][5].
Citations:
- 1: https://github.com/fruitcake/laravel-debugbar/releases/tag/v4.0.0
- 2: https://www.linkedin.com/pulse/laravel-debugbar-v400-ultimate-guide-dev-inception-dp97f
- 3: https://laravel-news.com/laravel-debugbar-4-0-0
- 4: https://github.com/fruitcake/laravel-debugbar/blob/master/UPGRADE.md
- 5: https://fruitcake.nl/blog/laravel-debugbar-v4-release
Critical: Package transfer and breaking changes in laravel-debugbar v4 upgrade.
laravel-debugbar v3.16.3 → v4.2.8 is not a routine major version update—the package was transferred from barryvdh/laravel-debugbar to fruitcake/laravel-debugbar with extensive breaking changes:
- All namespaces changed from
Barryvdh\DebugbartoFruitcake\LaravelDebugbar - Multiple features removed (Socket storage, Lumen support, PDO extension, global helper methods)
- Configuration keys changed (
hiddens→masked, query bindings handling changed) - Requires manual package replacement:
composer remove barryvdh/laravel-debugbar --devfollowed bycomposer require fruitcake/laravel-debugbar --dev
Review the official upgrade guide and test thoroughly before deploying.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@updated-packages.txt` at line 10, The package upgrade from
barryvdh/laravel-debugbar v3.16.3 to v4.2.8 is a package transfer with breaking
changes; remove the old dev dependency and install fruitcake/laravel-debugbar as
instructed (run the equivalent of composer remove for barryvdh/laravel-debugbar
and composer require for fruitcake/laravel-debugbar), then update all references
and imports from Barryvdh\Debugbar to Fruitcake\LaravelDebugbar, adjust
configuration keys (rename hiddens → masked and update query bindings handling),
remove or replace removed features/usages (socket storage, Lumen-specific code,
PDO extension usage, and any global helper calls), and follow the official
upgrade guide to update code paths and tests before deploying.
| barryvdh/laravel-debugbar: v3.16.3 → v4.2.8 | ||
| driftingly/rector-laravel: 2.1.9 → 2.3.0 | ||
| larastan/larastan: v3.9.0 → v3.9.6 | ||
| laravel/boost: v1.8.10 → v2.4.6 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
laravel/boost version 2.0 breaking changes and upgrade notes
💡 Result:
Laravel Boost v2.0 introduced significant architectural changes to support custom agents, improved configuration, and better extensibility. Below is a summary of the breaking changes and upgrade requirements. ### Upgrading to 2.x If you are not using custom agents or overriding Boost internals, the upgrade process is straightforward: 1. Update your dependencies. 2. Run php artisan boost:install to automatically handle the migration of your Boost configuration and resources [1][2]. ### Key Breaking Changes * Minimum Requirements: Boost 2.x requires PHP 8.2+ and Laravel 11.x+ [1][2]. * Terminology Refactor: The term CodeEnvironment has been replaced with Agent throughout the codebase [1][3]. * CodeEnvironment → Agent * CodeEnvironmentsDetector → AgentsDetector * registerCodeEnvironment() → registerAgent() * getCodeEnvironments() → getAgents() * Configuration Path: The configuration key in config/boost.php has been renamed from code_environment to agents [1][2]. * Command Signature: The boost:install command flags have shifted from negative opt-out to positive opt-in [1][2]: * Old: php artisan boost:install {--ignore-guidelines} {--ignore-mcp} * New: php artisan boost:install {--guidelines} {--skills} {--mcp} * Contract Renames: Several internal contracts were renamed for clarity [1][3]: * Laravel\Boost\Contracts\Agent → Laravel\Boost\Contracts\SupportsGuidelines * Laravel\Boost\Contracts\McpClient → Laravel\Boost\Contracts\SupportsMcp * Laravel\Boost\Contracts\SupportSkills → Laravel\Boost\Contracts\SupportsSkills ### Additional Structural Changes (v2.2.0) While not part of the initial 2.0 release, version 2.2.0 introduced a minor breaking change regarding how Inertia guidelines are organized [4][5]. The generic .ai/inertia-laravel/core.blade.php file was removed in favor of version-specific files (e.g., .ai/inertia-laravel/2/core.blade.php) to allow for better maintenance by package authors [4][5][6]. If you have custom overrides for these guidelines, you must update your file paths to match this new structure [4][7].
Citations:
- 1: https://github.com/laravel/boost/blob/5759fc7534d92d2dc6d7f672790a6c7a52d5448a/UPGRADE.md
- 2: https://github.com/laravel/boost/blob/f1f39e43b98453e04e1ecf073ac9c190a2b486c2/UPGRADE.md
- 3: laravel/boost@v2.0.0...v2.0.1
- 4: https://github.com/laravel/boost/releases/tag/v2.2.0
- 5: https://laravel-news.com/laravel-boost-2-2-0
- 6: https://laravel-news.com/index.php/inertia-2-3-16
- 7: Guidelines override with multiple in the same folder does not work laravel/boost#526
Review Laravel Boost v2.x breaking changes before upgrading.
laravel/boost v1.8.10 → v2.4.6 crosses a major version boundary with significant breaking changes. Key compatibility issues:
- Minimum Requirements: Requires PHP 8.2+ and Laravel 11.x+
- Terminology Refactor:
CodeEnvironment→Agent(affects configuration keys and method names) - Configuration Changes:
config/boost.phpkey renamed fromcode_environmenttoagents - Command Changes:
boost:installflags shifted from opt-out to opt-in format
Run php artisan boost:install during migration to auto-migrate configuration. Refer to the UPGRADE.md documentation for complete migration requirements.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@updated-packages.txt` at line 13, The dependency update from laravel/boost
v1.8.10 to v2.4.6 is a major upgrade with breaking changes: ensure the project
meets the new minimums (PHP 8.2+, Laravel 11+), rename any references of the old
CodeEnvironment symbol to Agent (including classes, type hints and method
names), update config/boost.php by replacing the code_environment key with
agents and adjust code that reads that config (e.g., calls to
config('boost.code_environment') -> config('boost.agents')), and run php artisan
boost:install to let the package auto-migrate configuration and adopt the new
opt-in command flags; consult UPGRADE.md for any additional changes and update
any uses of boost:install flags to the new format.
1 participant
Composer Dependency Update
This PR updates Composer dependencies.
Update Type:
Triggered by: schedule
Updated Packages
Checks Performed
Unit tests passed(commented out until further notice)Static analysis completed(commented out until further notice)Code formatting checked(commented out until further notice)Security Audit
Security vulnerabilities detected. Please review audit-report.json.
Review Checklist
This PR was automatically created by the Composer Update workflow.
Summary by CodeRabbit