Livewire's temporary upload rule was hard-coded to max:4194304 (4 GB),
so /livewire/upload-file rejected any larger file no matter how high
PHP_UPLOAD_MAX_FILESIZE or the admin's max file size were set.
_uploadErrored() then replaced Livewire's actual message with "file
exceeds the maximum size of N MB", quoting the admin limit the file was
under.
The cap is removed: PHP's upload_max_filesize is the hard limit and the
admin setting is still enforced in updatedFiles() and createShare(). A
rejected upload now logs the real validation errors and tells the user
the server could not accept the file.
max_upload_time is configurable via LIVEWIRE_MAX_UPLOAD_TIME, and the
README documents every limit large uploads depend on.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017XYnWFt9pJEwvAmNFN38XD
Documents 1.0.0, 1.0.1 and the upcoming 1.1.0 in Keep a Changelog format.
The tech stack table still claimed Laravel 12 and listed
maennchen/zipstream-php, which was dropped in 1.0.1 when ZIP downloads
moved to native ZipArchive.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The `uploading` flag was only cleared by `x-init="uploading = false"` on the
file list, which Alpine runs when the element is initialized. Adding a second
batch of files to the same share only patches that existing element, so the
flag stayed true forever: the spinner never went away, the drop zone stayed
disabled and the submit button stayed disabled, making the share impossible
to create.
`updatedFiles()` now dispatches `files-processed`, which runs for every batch,
and the form resets its upload state on that event instead.
Also fixes two adjacent bugs in the drag & drop path: `uploadMultiple()` was
called without callbacks so dropped files showed no progress at all, and
`relativePaths` was replaced instead of appended, shifting every earlier
file's path onto the wrong file on a second drop.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Clears the last outstanding advisory (GHSA-395f-4hp3-45gv, quadratic
complexity DoS in shell-quote's parse()). npm audit now reports 0
vulnerabilities, down from 3 before this branch.
concurrently pins "shell-quote": "1.8.4" exactly, and the maintainers
patched only the 9.x line (9.2.4 ships shell-quote 1.9.0) while 10.x still
carries 1.8.4. npm's only offered remedy was therefore a downgrade to
concurrently@9.2.4. The override keeps concurrently at 10.0.3 and resolves
shell-quote to 1.10.0 instead.
Overriding a deliberate exact pin warrants checking concurrently still
works, so this was verified functionally in node:24-alpine rather than
assumed: quoted and escaped arguments parse correctly (the shell-quote
code path), named prefixes render, and --kill-others-on-fail still
propagates a non-zero exit. npm install, npm ci and npm run build all
succeed, build hashes are unchanged, and the PHP suite passes 123 tests.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump Vite 7 to 8 and laravel-vite-plugin 2 to 3. These are coupled:
laravel-vite-plugin@3.1.3 peer-requires vite ^8.0.0, so neither moves alone.
Also concurrently 9 to 10, tailwindcss and @tailwindcss/vite to 4.3.3,
daisyui to 5.7.0, alpinejs to 3.15.12 and autoprefixer to 10.5.4.
Drop axios. It had zero imports anywhere in resources/ or vite.config.js,
and Laravel 13 removed it from the skeleton along with resources/js/bootstrap.js.
Drop the @rollup/rollup-linux-x64-gnu optional dependency. Vite 8 builds with
rolldown instead of rollup, so the pin no longer refers to anything in the
build, and it was stuck at an exact 4.9.5 against a rollup that had since
reached 4.62.x. The oxide and lightningcss optional pins are kept, as those
native binaries are still used by tailwind and vite.
vite.config.js needed no changes: it sets no rollupOptions, esbuild or
manualChunks, so nothing hit the vite 8 config renames. Node engines
(^20.19 || >=22.12) are satisfied by the node:24-alpine build stage, the
dev container's Node 24.17 and CI's Node 24.
Verified in a node:24-alpine container matching the Dockerfile assets stage:
npm install, npm run build (vite 8.1.5, 3 modules, deterministic hashes) and
npm ci all succeed. The rendered /upload page references the new build hashes,
and the PHP suite still passes 123 tests.
npm audit fix patched a pre-existing picomatch advisory reached via
laravel-vite-plugin's vite-plugin-full-reload, with no downgrades. A
shell-quote advisory via concurrently remains and is also pre-existing;
concurrently is a local dev orchestration tool only and is not shipped
to browsers.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Byproduct of the Laravel 13 upgrade: composer's post-update-cmd runs
`artisan boost:update`, and Boost went 2.1.3 to 2.4.x with the update.
Refreshes CLAUDE.md and boost.json for the Laravel 13 / Livewire 4 stack,
updates the livewire, pest and tailwindcss skills, replaces the
developing-with-fortify skill with fortify-development, and adds new
laravel-best-practices and octane-development skills.
Generated output, not hand-edited.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Laravel 13 upgrade pulled Pint 1.27.1 to 1.29.3, which changed the
laravel preset's default rules. composer lint and the CI lint job fail
without this, so it is required rather than cosmetic.
Formatting only, applied by `vendor/bin/pint`. The rules that fired were
fully_qualified_strict_types, ordered_imports, single_blank_line_at_eof,
unary_operator_spaces, not_operator_with_successor_space, braces_position,
single_line_empty_body, single_line_after_imports and no_extra_blank_lines.
Kept separate from the upgrade commit to keep that diff reviewable.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump laravel/framework to ^13.0 and laravel/tinker to ^3.0 per the 12.x
to 13.0 upgrade guide. php ^8.5 already satisfied the new minimum.
Transitively picks up Fortify 1.37.3, Octane 2.18.0, Livewire 4.3.3,
Mary 2.9.7 and Pest 4.7.5, all of which already declare ^13.0 support.
Add 'serializable_classes' => false to config/cache.php. When the key is
absent it defaults to null, which leaves unserialize() unrestricted; false
blocks object deserialization so a leaked APP_KEY cannot be used to drive a
gadget chain through the cache. Safe here as no app code uses the cache.
Audited every breaking change in the guide against the codebase with no
hits: VerifyCsrfToken/ValidateCsrfToken (now PreventRequestForgery),
JobAttempted->exceptionOccurred, QueueBusy->$connection, pagination::default,
Js::from and array_first/array_last. config/cache.php and config/database.php
already used the new hyphenated prefixes, so cache keys and session cookies
are unchanged and nothing invalidates on deploy.
Verified: 123 tests pass (306 assertions), migrations apply cleanly, and
/up, /login and the Livewire asset all serve 200 over HTTP.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
