Everything stays within its existing constraint: Laravel 13.32, Livewire
4.4.5, Livewire Material 2.1.0, Pest 5.2, Boost 2.9, Pint 1.32.1, Vite
8.3 and autoprefixer 10.6. Boost's copy of the guidelines and skills
follows Livewire Material 2.1, which is plain CSS without utilities.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Livewire Material 2.0.0 aligns every component with Material 3
Expressive and carries no Tailwind anywhere, so SealShare drops
tailwindcss and its Vite plugin and writes its views in the package's
vocabulary: layout components (<x-pane>, <x-stack>, <x-row>, <x-grid>,
<x-form>) with M3's spacing tokens, the md-type-*/md-ink-* text classes,
and --md-sys-* tokens in its own small stylesheet.
- resources/css/app.css opens with the package's layer order, imports
foundation.css and the stylesheet of each component the views render,
then the scheme, regenerated with the 2025 colour rules at M3's three
contrast levels. The app's own rules follow, one section per view,
on tokens and on M3's breakpoints (600/840/1200/1600px) only.
- Every view is rewritten in that vocabulary while SealShare keeps the
shape it had: the admin table, the admin settings, the recovery codes,
the share options and the download page are cards, and their fields
fill them rather than stopping at the 40rem bound a card already
bounds. The user settings pages became cards too, to match the
admin's, each with the sections that stand apart from its one subject
— deleting the account, the recovery codes — in a card beside it.
Material 3 decides how a component behaves, not whether a container
survives: buttons keep their label's width, a form's actions end it,
and each heading level keeps one type role.
- The layouts clear the floating toolbar by the --material-bottom-toolbar
the package publishes, and the snackbar clears it by itself.
- The two-factor setup QR code comes from QrCodeService, so it keeps a
white field and quiet zone in the dark theme and still scans.
- Browse Files is a real button that opens the file input, reachable
and visibly focused from the keyboard.
- Tests: the design test scans views, JS, CSS and app/ and checks the
CSS entry both ways (no missing, no unused import). New Chromium
suites cover the frame, settings and admin, the share flow, and every
page at M3's breakpoint edges (599/600, 839/840, 1199/1200, 1600px).
The package's renamed data-md-* hooks replace the 1.x ones.
- Boost's update brings the material-3 guideline and skill and drops
the Tailwind skill.
composer.json requires nonameweb/livewire-material ^2.0 from the Gitea
repository, resolved at the 2.0.0 tag. The CHANGELOG records the move as
2.1.0.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replaces maryUI and daisyUI with nonameweb/livewire-material: the Vibrant
indigo scheme, a system/light/dark theme under sealshare-theme, one top
app bar with the account menu, the upload drop zone and link-ready
moments, M3 fields, dialogs instead of wire:confirm, snackbars instead of
flashed messages, a sortable admin table, and the starter-kit cleanup.
Docker builds assets after Composer; CI drops the Flux step.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9NnLxnPp8vaaurb3Z1MFy
Clears the last outstanding advisory (GHSA-395f-4hp3-45gv, quadratic
complexity DoS in shell-quote's parse()). npm audit now reports 0
vulnerabilities, down from 3 before this branch.
concurrently pins "shell-quote": "1.8.4" exactly, and the maintainers
patched only the 9.x line (9.2.4 ships shell-quote 1.9.0) while 10.x still
carries 1.8.4. npm's only offered remedy was therefore a downgrade to
concurrently@9.2.4. The override keeps concurrently at 10.0.3 and resolves
shell-quote to 1.10.0 instead.
Overriding a deliberate exact pin warrants checking concurrently still
works, so this was verified functionally in node:24-alpine rather than
assumed: quoted and escaped arguments parse correctly (the shell-quote
code path), named prefixes render, and --kill-others-on-fail still
propagates a non-zero exit. npm install, npm ci and npm run build all
succeed, build hashes are unchanged, and the PHP suite passes 123 tests.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump Vite 7 to 8 and laravel-vite-plugin 2 to 3. These are coupled:
laravel-vite-plugin@3.1.3 peer-requires vite ^8.0.0, so neither moves alone.
Also concurrently 9 to 10, tailwindcss and @tailwindcss/vite to 4.3.3,
daisyui to 5.7.0, alpinejs to 3.15.12 and autoprefixer to 10.5.4.
Drop axios. It had zero imports anywhere in resources/ or vite.config.js,
and Laravel 13 removed it from the skeleton along with resources/js/bootstrap.js.
Drop the @rollup/rollup-linux-x64-gnu optional dependency. Vite 8 builds with
rolldown instead of rollup, so the pin no longer refers to anything in the
build, and it was stuck at an exact 4.9.5 against a rollup that had since
reached 4.62.x. The oxide and lightningcss optional pins are kept, as those
native binaries are still used by tailwind and vite.
vite.config.js needed no changes: it sets no rollupOptions, esbuild or
manualChunks, so nothing hit the vite 8 config renames. Node engines
(^20.19 || >=22.12) are satisfied by the node:24-alpine build stage, the
dev container's Node 24.17 and CI's Node 24.
Verified in a node:24-alpine container matching the Dockerfile assets stage:
npm install, npm run build (vite 8.1.5, 3 modules, deterministic hashes) and
npm ci all succeed. The rendered /upload page references the new build hashes,
and the PHP suite still passes 123 tests.
npm audit fix patched a pre-existing picomatch advisory reached via
laravel-vite-plugin's vite-plugin-full-reload, with no downgrades. A
shell-quote advisory via concurrently remains and is also pre-existing;
concurrently is a local dev orchestration tool only and is not shipped
to browsers.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
