Indigo (the default), Blue, Teal, Green, Amber, Rose and Violet in the
Vibrant style and Graphite in the Neutral style are generated from
config into the stylesheet. Admin settings opens with a colour profile
card: a swatch previews the profile on the page, and Save Settings
stores it as color_profile, which AppServiceProvider hands to the
package's resolver, so every page, mail and error page wears it. An
unknown profile is refused, and a saved one that disappears falls back
to indigo.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9NnLxnPp8vaaurb3Z1MFy
Replaces maryUI and daisyUI with nonameweb/livewire-material: the Vibrant
indigo scheme, a system/light/dark theme under sealshare-theme, one top
app bar with the account menu, the upload drop zone and link-ready
moments, M3 fields, dialogs instead of wire:confirm, snackbars instead of
flashed messages, a sortable admin table, and the starter-kit cleanup.
Docker builds assets after Composer; CI drops the Flux step.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9NnLxnPp8vaaurb3Z1MFy
Livewire's temporary upload rule was hard-coded to max:4194304 (4 GB),
so /livewire/upload-file rejected any larger file no matter how high
PHP_UPLOAD_MAX_FILESIZE or the admin's max file size were set.
_uploadErrored() then replaced Livewire's actual message with "file
exceeds the maximum size of N MB", quoting the admin limit the file was
under.
The cap is removed: PHP's upload_max_filesize is the hard limit and the
admin setting is still enforced in updatedFiles() and createShare(). A
rejected upload now logs the real validation errors and tells the user
the server could not accept the file.
max_upload_time is configurable via LIVEWIRE_MAX_UPLOAD_TIME, and the
README documents every limit large uploads depend on.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017XYnWFt9pJEwvAmNFN38XD
The Laravel 13 upgrade pulled Pint 1.27.1 to 1.29.3, which changed the
laravel preset's default rules. composer lint and the CI lint job fail
without this, so it is required rather than cosmetic.
Formatting only, applied by `vendor/bin/pint`. The rules that fired were
fully_qualified_strict_types, ordered_imports, single_blank_line_at_eof,
unary_operator_spaces, not_operator_with_successor_space, braces_position,
single_line_empty_body, single_line_after_imports and no_extra_blank_lines.
Kept separate from the upgrade commit to keep that diff reviewable.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump laravel/framework to ^13.0 and laravel/tinker to ^3.0 per the 12.x
to 13.0 upgrade guide. php ^8.5 already satisfied the new minimum.
Transitively picks up Fortify 1.37.3, Octane 2.18.0, Livewire 4.3.3,
Mary 2.9.7 and Pest 4.7.5, all of which already declare ^13.0 support.
Add 'serializable_classes' => false to config/cache.php. When the key is
absent it defaults to null, which leaves unserialize() unrestricted; false
blocks object deserialization so a leaked APP_KEY cannot be used to drive a
gadget chain through the cache. Safe here as no app code uses the cache.
Audited every breaking change in the guide against the codebase with no
hits: VerifyCsrfToken/ValidateCsrfToken (now PreventRequestForgery),
JobAttempted->exceptionOccurred, QueueBusy->$connection, pagination::default,
Js::from and array_first/array_last. config/cache.php and config/database.php
already used the new hyphenated prefixes, so cache keys and session cookies
are unchanged and nothing invalidates on deploy.
Verified: 123 tests pass (306 assertions), migrations apply cleanly, and
/up, /login and the Livewire asset all serve 200 over HTTP.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
