Support Laravel 13 and firebase/php-jwt 7 - #13
Merged
Merged
Conversation
Dependency support: - laravel/framework ^12|^13 — Laravel 11 is dropped because every 11.x release is blocked by security advisories under Composer's default policy, so it cannot be installed anyway - firebase/php-jwt ^6.8|^7.0 — all 6.x releases are affected by CVE-2025-45769, so Composer cannot resolve a php-jwt 6 only constraint without an explicit advisory ignore in every consuming application. 6.8+ stays allowed so applications already locked on php-jwt 6 can adopt Laravel 13 without rotating signing keys first - orchestra/testbench ^10.0|^11.0, phpunit/phpunit ^11.3|^12.0 Guard registration on Laravel 13: Laravel 13 rebinds the AuthManager::extend() callback to the AuthManager instance (Illuminate\Support\RebindsCallbacksToSelf), which changes both $this and the closure scope. Calling $this->createStatelessGuard() therefore resolves against the AuthManager and every request through either guard fails with a 500. Guard creation now goes through first-class callables, which keep their own $this and scope on Laravel 12 and 13 alike. PHP 8.4: - explicit nullable types for $previous and $timebox, which were implicitly nullable Static analysis: - phpstan/phpstan ^2.2. PHPStan 1.12 has been EOL since July 2025 and reported Command::SUCCESS as undefined on Laravel 13 (symfony/console 8 declares it just fine) while missing the actual AuthManager problem above - checkGenericClassInNonGenericObjectType was removed in PHPStan 2, so Payload declares its Arrayable generics instead Tests and CI: - GuardTest covers guard resolution, both drivers over HTTP, token blacklisting on logout and password-change invalidation. The suite previously only covered JwtDecoder, which is why broken guards passed CI - tests and PHPStan now run against a Laravel 12/13 x php-jwt 6/7 matrix Docs: - document supported versions and the minimum signing key size that firebase/php-jwt 7 enforces for HMAC algorithms Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
underwear
force-pushed
the
codex/laravel-13-firebase-jwt-7
branch
from
August 20, 2026 13:44
66ce3ed to
c078a81
Compare
underwear
marked this pull request as ready for review
August 20, 2026 16:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
composer validate --strict --no-check-publish./vendor/bin/phpunit— 8 tests, 14 assertions