⬆️ Upgrade dependency laravel/framework to v13.30.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
laravel/framework (source)	13.26.1 → 13.30.0

---

Laravel: XSS in Debug Page Information

CVE-2026-102279 / GHSA-jh5r-qr3c-85q8

More information

Details

Impact

When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.

Patches

#​61381

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

References

• https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8
• https://nvd.nist.gov/vuln/detail/CVE-2026-102279
• https://github.com/laravel/framework/pull/61381
• https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
• https://github.com/laravel/framework
• https://github.com/laravel/framework/releases/tag/v12.69.0
• https://github.com/laravel/framework/releases/tag/v13.30.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

laravel/framework (laravel/framework)

v13.30.0

Compare Source

• [12.x] Backport #​60908: Avoid quadratic wildcard rule expansion by @​matteo-palazzo in #​61232
• Fix resource loading by @​taylorotwell in #​61323
• [13.x] Output the worker stop reason in queue:work by @​jackbayliss in #​61339
• Fix incorrect $startTime type in Worker::stopIfNecessary docblock by @​il-m-tomita in #​61347
• [13.x] Ability to opt out of vendor/default commands in DevCommands by @​jackbayliss in #​61344
• [13.x] Confine Storage::path() to the configured disk root by @​KIKOmanasijev in #​61343
• [13.x] Support Microsoft SQL Server DSN connection strings by @​HenkPoley in #​61341
• [13.x] Restore the facade application after route:cache boots a fresh application by @​reiarseni in #​61346
• [13.x] Gracefully handle missing param value or strings with request clamps by @​kylemilloy in #​61355
• [13.x] Restore default database connection when seeding fails by @​sayful1411 in #​61354
• [13.x] Cloud enhancements by @​timacdonald in #​61360
• [13.x] Allow retrieving command by name without resolving all commands by @​timacdonald in #​61361
• [13.x] Expose methods by @​timacdonald in #​61362
• [13.x] Add basic test for query explain by @​imanghafoori1 in #​61363
• [13.x] Add totalXSize methods to Cloud Queue by @​jackbayliss in #​61352
• [13.x] Add chunkBy to collections by @​JosephSilber in #​61357
• [13.x] spl_object_id over hash by @​jackbayliss in #​61372
• [13.x] Add createPayloadUsing directly to the queue manager by @​jackbayliss in #​61367
• [13.x] Set visibility on files that only exist on a read-through disk's fallback by @​sulimanbenhalim in #​61375
• [12.x] Disable html by default on Laravel exception page tooltip by @​crynobone in #​61381

v13.29.0

Compare Source

v13.28.0

Compare Source

v13.27.0

Compare Source

• [13.x] Prevent duplicate scoped instance registrations by @​jordanhavard in #​61251
• [13.x] Add refreshForUpdate() method to Eloquent models by @​stevebauman in #​61247
• [13.x] Fix PHPUnit and Mockery deprecations in tests by @​lucasmichot in #​61244
• [13.x] Throw on unsuccessful responses when creating images from URLs by @​Button99 in #​61254
• Apply fixes from StyleCI by @​taylorotwell in #​61256
• [13.x] Skip scheduled workflows on forks by @​MrPunyapal in #​61239
• [13.x] Consolidate tearDown boilerplate into AfterEachTestSubscriber by @​lucasmichot in #​61245
• [13.x] Pin rector version by @​lucasmichot in #​61257
• [13.x] Re-introduce orWhereKey() and orWhereKeyNot() without breaking Builder subclasses by @​kevariable in #​61242
• [13.x] Don't force release a unique lock the job never acquired by @​sulimanbenhalim in #​61234
• [13.x] Convert foreach-loop tests to data providers by @​lucasmichot in #​61258
• [13.x] Simplify testImageBmp by @​lucasmichot in #​61259
• [13.x] Add missing test coverage for Str and Stringable by @​lucasmichot in #​61260
• [13.x] Add Queue totalXSize methods by @​jackbayliss in #​61231
• Add MariaDB support for vector distance queries by @​Rhaima96 in #​61250
• [13.x] Add whereBinary() to the query builder by @​xiCO2k in #​61261
• [13.x] Fix quietly() making throw() unreachable on process results by @​xurshudyan in #​61227
• Revert "[13.x] Consolidate tearDown boilerplate into AfterEachTestSubscriber (#​61245)" by @​crynobone in #​61262
• Use nick-fields/retry to verify clustered redis ports are available by @​crynobone in #​61263
• [13.x] Guard against false returns in PhpRedisConnection::mget() and hmget() by @​matthewfarrugia in #​61267
• [13.x] Add stop() and ensureNotTimedOut() to FakeInvokedProcess by @​xurshudyan in #​61266
• [13.x] Make eager-load constraint closures static to break Builder reference cycle by @​mspasov in #​61264
• [13.x] Move and copy files that only exist on a read-through disk's fallback by @​sulimanbenhalim in #​61272
• [13.x] Adjust QueueTest by @​jackbayliss in #​61284
• [13.x] Introduce InteractsWithTestCaseLifecycle::flushState() by @​cosmastech in #​61288
• [13.x] Fix route name lost when RouteRegistrar action is not callable by @​KalimeroMK in #​61285
• [13.x] Start a new max wait window after a debounced job runs by @​sulimanbenhalim in #​61281
• [13.x] Fix nested includes not being limited when maxRelationshipDepth is zero by @​martinsoenen in #​61297
• [13.x] Give each Redis Cluster node its own data directory in CI by @​cyppe in #​61294
• [13.x] Ensure test namespaces are correct by @​jackbayliss in #​61304
• [13.x] Fix flaky memcached touch test by pinning time by @​mspasov in #​61301
• [13.x] Adjust database.yml timeout to 10 minutes by @​jackbayliss in #​61299
• [13.x] Add Postgres keepalive DSN options by @​tgivslife in #​61307
• [13.x] Introduce a Cloud facade by @​jackbayliss in #​61275
• Normalize test fixtures by @​jasonmccreary in #​61315
• [13.x] Treat asterisks as literal keys when merging request input by @​KIKOmanasijev in #​61309
• [13.x] Guard against non-string mac in maintenance bypass cookie by @​KIKOmanasijev in #​61314
• [13.x] Treat asterisks as literal keys when merging URI query parameters by @​KIKOmanasijev in #​61312
• [13.x] Prevent loose comparison bypass in in_array validation rule by @​KIKOmanasijev in #​61319
• [13.x] Prevent loose comparison bypass in contains validation rule by @​KIKOmanasijev in #​61320
• [13.x] Prevent loose comparisons in doesnt_contain validation rule by @​KIKOmanasijev in #​61318
• Fix resource loading by @​taylorotwell in #​61322
• [13.x] Treat literal dots in input keys correctly when rejecting unknown fields by @​KIKOmanasijev in #​61313
• Revert "[13.x] Prevent loose comparison bypass in contains validation rule" by @​taylorotwell in #​61330
• [13.x] Allow masking query bindings in exception messages by @​LauJosefsen in #​61326
• [13.x] Share cached AWS credentials across processes for SQS queue connections by @​DGarbs51 in #​61321
• [13.x] Fix images created from a stream failing on the second read by @​Chy-Zaber-Bin-Zahid in #​61305
• [13.x] Fix uncaught Brick MathException escaping the numeric comparison rules by @​gcotcheza in #​61332

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.