Repository navigation
Test against patched Laravel versions so Composer 2.11 can install - #628
Merged
Merged
Conversation
Composer 2.11 refuses to install packages with open security advisories. The dev dependencies only allowed testbench 8, which means Laravel 10, and every Laravel 10 release has an unpatched advisory. So composer install failed in every CI job. This moves testbench to ^10|^11 and bumps the rest of the dev tooling to match: Larastan 3, Collision 8, Pest 3 and the PHPStan rules packages 2. It now resolves to Laravel 12.70 with no advisories. Pest stays on 3. Pest 4 brings PHPUnit 12, which ignores docblock annotations like @test and @dataProvider, and about 250 tests silently stopped running. Larastan 3 adds a rule against env() outside config files. The build and signing commands read credentials with env() on purpose, so the rule is off. Request::get() is deprecated in Laravel 12, so the event controller uses input() instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gwleuverink
added a commit
that referenced
this pull request
Nov 2, 2026
Covers mobile PRs #525, #527, #528, #560, #605, #608, #609, #611, #613, #614, #615, #616, #617, #619, #621, #622, #623, #624, #625, #626, #627, #628, #629, #632, #633, #634, #635 and #636, and the commits on main without a PR: 4082538 (bounded()'s docblock), 49528ba (the Android logging fix from a fork), b23aba9, 2a773cc and b9316b6 (security policy, issue template and README links). Main b107ed9..767a7c8, 33 commits, 4.6.1 among them. Ported to core on branch sync/mobile-main-2026-11-01, which this merge needs: #608 (scrollVirtualListTo()), #625 with 4082538 (snap points on a gesture area), #621 (:context-menu on a pressable, matched through core's ConvertsToElement as :menu is), #617's farewell frame through a hook, and #614's ValidatesInput and FieldErrors, which move to core. The old names of those two resolve to core's through the alias shim. Kept on this branch: #616 in full. EVENT_SYSTEM_BACK sits on NativeComponent next to EVENT_HOT_RELOAD and EVENT_SHUTDOWN, the router half is in NativeRouter, and InteractsWithAppShell's back button handler checks the constant, as main's runLoop() does. #617's element types: NativeComponent answers core's typesClosedInFarewellFrame() hook with bottom_sheet and modal. BroadcastsGlobally extends core's marker and #609's DispatchableFromNative. Removed again in the merge: HasVirtualListWindow, GestureArea and Pressable (main changed them, core has them), and ValidatesInput and FieldErrors (main added them, core has them). Main's import of the old dispatcher name came out of DispatchEventFromAppController, where it clashed with core's. Adapted for the extraction: BroadcastsGloballyNamesTest expects DispatchableFromNative among the old marker's interfaces, as #609 makes it. #609 is merged as main has it and is not ported. Needs NativePHP/core#18. Tests, all on PHP 8.4.27, with dev dependencies updated for #628 (Laravel 12.70.2, Pest 3.8.7): mobile on this merge against the core sync branch (445049b), 2,467 passed, 4 risky, 4 skipped. PHPStan clean. Mobile main (767a7c8), 2,412 passed, 4 risky, 4 skipped. Desktop main (fd40580) against the core sync branch, test:php 2,240 passed, as against core main. Desktop #57 (977a2af), 2,245 passed against the earlier core sync head (59c73fc), which differs only by the constant moved to mobile; not rerun.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Composer 2.11 came out today and refuses to install packages with open security advisories. Our dev dependencies only allowed
orchestra/testbench ^8.18, which means Laravel 10, and every Laravel 10 release has an unpatched advisory. Socomposer installfails in every CI job onmainand on every open PR.This bumps the dev tooling to versions that run on patched Laravel:
orchestra/testbench^10.0|^11.0larastan/larastan^3.0,nunomaduro/collision^8.0pestphp/pestand its arch and laravel plugins^3.0phpstan/phpstan-deprecation-rulesandphpstan/phpstan-phpunit^2.0It resolves to Laravel 12.70.2 and
composer auditcomes back clean. Locally the suite runs the same 2,396 passing tests as before, and PHPStan and Pint pass.Things to watch:
@testand@dataProvider. About 250 tests silently stopped running when I tried it. Moving to Pest 4 means converting those to attributes first.env()outside config files. The build and signing commands read credentials withenv()on purpose, so I've turned that rule off inphpstan.neonrather than touch 78 call sites.Request::get()is deprecated in Laravel 12, soDispatchEventFromAppControllerusesinput()now. That endpoint is covered byDispatchEventFromAppTest.requirestill allows Laravel 10 and 11. Only the test setup changes here.Once this is merged, #627 and the other open PRs need rebasing or rerunning to go green.
🤖 Generated with Claude Code