Bump laravel/framework to ^13.0 and laravel/tinker to ^3.0 per the 12.x
to 13.0 upgrade guide. php ^8.5 already satisfied the new minimum.
Transitively picks up Fortify 1.37.3, Octane 2.18.0, Livewire 4.3.3,
Mary 2.9.7 and Pest 4.7.5, all of which already declare ^13.0 support.
Add 'serializable_classes' => false to config/cache.php. When the key is
absent it defaults to null, which leaves unserialize() unrestricted; false
blocks object deserialization so a leaked APP_KEY cannot be used to drive a
gadget chain through the cache. Safe here as no app code uses the cache.
Audited every breaking change in the guide against the codebase with no
hits: VerifyCsrfToken/ValidateCsrfToken (now PreventRequestForgery),
JobAttempted->exceptionOccurred, QueueBusy->$connection, pagination::default,
Js::from and array_first/array_last. config/cache.php and config/database.php
already used the new hyphenated prefixes, so cache keys and session cookies
are unchanged and nothing invalidates on deploy.
Verified: 123 tests pass (306 assertions), migrations apply cleanly, and
/up, /login and the Livewire asset all serve 200 over HTTP.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Move form wrapper outside x-card so the submit button renders inside
the form DOM, and add w-full to all share page action buttons for
consistent full-width styling.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add php zip extension to Dockerfile (required by ZipArchive)
- Remove bootstrap/cache/*.php during build to prevent stale
dev-only service providers (e.g. BoostServiceProvider) from loading
- Default DB_DATABASE to /app/database/database.sqlite in
docker-compose.yml so env() fallback works correctly
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ZipStream writes via fwrite(php://output) which FrankenPHP silently
drops, resulting in 0-byte ZIP downloads. Switch to ZipArchive to build
the ZIP as a temp file on disk, then serve with response()->download().
- Rewrite download() to use ZipArchive + BinaryFileResponse
- Remove decryptFileToCallback() from FileEncryptionService
- Update tests for BinaryFileResponse instead of StreamedResponse
- Remove maennchen/zipstream-php dependency
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
