From 45af4f43bf21fb052395bd0f359508fde45bf269 Mon Sep 17 00:00:00 2001 From: Kevin Ullyott Date: Mon, 7 Sep 2026 14:57:54 -0400 Subject: [PATCH] Drop Laravel 10/11 support, pin GitHub Actions to SHAs, add Dependabot Laravel 10 and 11 are end of life and no longer receive security fixes. composer.json now requires Laravel 12 or 13 and PHP 8.3+, with the dev-* branch aliases removed and minimum-stability set to stable. The internachi/modular dev dependency is pinned to ^3.0 so stable Laravel 13 resolves. Because modular 3 requires modularize ^1.1, a dev-main => 1.x-dev branch alias is added so this package satisfies that constraint during development and in CI. The PHPUnit matrix now covers Laravel 12/13 on PHP 8.3/8.4/8.5. All GitHub Actions are referenced by commit SHA with a version comment, and a Dependabot config keeps those pins current. --- .github/dependabot.yml | 8 ++++++++ .github/workflows/php-cs-fixer.yml | 6 +++--- .github/workflows/phpunit.yml | 10 +++++----- .github/workflows/update-changelog.yml | 6 +++--- CHANGELOG.md | 8 ++++++++ composer.json | 17 +++++++++++------ 6 files changed, 38 insertions(+), 17 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..6cc0071 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,8 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/php-cs-fixer.yml b/.github/workflows/php-cs-fixer.yml index d72cd8b..0fcd812 100644 --- a/.github/workflows/php-cs-fixer.yml +++ b/.github/workflows/php-cs-fixer.yml @@ -14,10 +14,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 with: php-version: 8.3 extensions: dom, curl, libxml, mbstring, zip, pcntl, bcmath, intl, iconv @@ -29,7 +29,7 @@ jobs: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT - name: Cache dependencies - uses: actions/cache@v5 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ steps.composer-cache.outputs.dir }} key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }} diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml index 034dfce..d8ce724 100644 --- a/.github/workflows/phpunit.yml +++ b/.github/workflows/phpunit.yml @@ -15,8 +15,8 @@ jobs: matrix: dependency-version: [ stable, lowest ] os: [ ubuntu, windows ] - laravel: [ 11.*, 12.*, 13.* ] - php: [ 8.3, 8.4 ] + laravel: [ 12.*, 13.* ] + php: [ 8.3, 8.4, 8.5 ] runs-on: "${{ matrix.os }}-latest" timeout-minutes: 10 @@ -25,10 +25,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 with: php-version: ${{ matrix.php }} extensions: dom, curl, libxml, mbstring, zip, pcntl, bcmath, intl, iconv, fileinfo @@ -40,7 +40,7 @@ jobs: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT - name: Cache dependencies - uses: actions/cache@v5 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: ${{ steps.composer-cache.outputs.dir != '' }} with: path: ${{ steps.composer-cache.outputs.dir }} diff --git a/.github/workflows/update-changelog.yml b/.github/workflows/update-changelog.yml index ff4def3..4f8bf9a 100644 --- a/.github/workflows/update-changelog.yml +++ b/.github/workflows/update-changelog.yml @@ -8,18 +8,18 @@ jobs: update-publish: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ${{ github.event.repository.full_name }} ref: 'main' - name: Update changelog - uses: thomaseizinger/keep-a-changelog-new-release@v3 + uses: thomaseizinger/keep-a-changelog-new-release@f62c3c390716df5af712ba5d94f4f4a8efc1306d # v3.1.0 with: version: ${{ github.event.release.tag_name }} - name: Commit changelog back to repo - uses: EndBug/add-and-commit@v9 + uses: EndBug/add-and-commit@cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8 # v11.1.1 with: add: 'CHANGELOG.md' message: ${{ github.event.release.tag_name }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 18b0168..48da9c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,14 @@ format. This project adheres to [Semantic Versioning](https://semver.org/spec/v2 ## [Unreleased] +### Removed + +- Dropped support for Laravel 10 and 11 (both are end-of-life). Laravel 12+ and PHP 8.3+ are now required. + +### Security + +- GitHub Actions are now pinned to commit SHAs, with Dependabot keeping them up to date. + ## [1.1.1] - 2026-03-23 ## [1.1.0] - 2026-01-31 diff --git a/composer.json b/composer.json index fd2c6e6..262c32a 100755 --- a/composer.json +++ b/composer.json @@ -15,14 +15,15 @@ "type": "library", "license": "MIT", "require": { - "illuminate/support": "^10|^11|^12|^13|dev-main|dev-master", + "php": ">=8.3", + "illuminate/support": "^12|^13", "ext-json": "*" }, "require-dev": { - "orchestra/testbench": "^8.34.0|^9.12.0|^10.1.0|^11.0.0|12.x-dev|dev-main|dev-master", - "internachi/modular": "*", + "orchestra/testbench": "^10.1.0|^11.0.0", + "internachi/modular": "^3.0", "friendsofphp/php-cs-fixer": "^3.71", - "phpunit/phpunit": "^10.5|^11.5|^12.5" + "phpunit/phpunit": "^11.5|^12.5|^13.0" }, "autoload": { "psr-4": { @@ -41,6 +42,10 @@ "fix-style": "vendor/bin/php-cs-fixer fix", "check-style": "vendor/bin/php-cs-fixer fix --diff --dry-run" }, - "minimum-stability": "dev", - "prefer-stable": true + "extra": { + "branch-alias": { + "dev-main": "1.x-dev" + } + }, + "minimum-stability": "stable" }