Skip to content

chore: release v13.39.2 - #566

Merged
ogorzalka merged 11 commits into
mainfrom
develop
Oct 30, 2026
Merged

ogorzalka merged 11 commits into
mainfrom
develop

Conversation

@ogorzalka

@ogorzalka ogorzalka commented Oct 30, 2026 •

Copy link
Copy Markdown
Member

Publishes v13.39.2 on main: wordpress.sessions for Route::wp() routes, pollora/entity ^2.0, nwidart/laravel-modules ^13.2, and the development tooling. See the CHANGELOG.

pollora/wp-rest 2.0 is not accepted by this release: it refuses a REST route that declares no permission, and composer update would have installed it on every site. It will ship in a release of its own.

Tag and release only after this is merged, and with the owner's go-ahead.

dependabot Bot and others added 11 commits October 29, 2026 08:27
Updates the requirements on [pollora/harness](https://github.com/Pollora/harness) to permit the latest version.
- [Release notes](https://github.com/Pollora/harness/releases)
- [Changelog](https://github.com/Pollora/harness/blob/main/CHANGELOG.md)
- [Commits](Pollora/harness@v0.1.8...v0.1.13)

---
updated-dependencies:
- dependency-name: pollora/harness
  dependency-version: 0.1.13
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Updates the requirements on [nwidart/laravel-modules](https://github.com/nWidart/laravel-modules) to permit the latest version.
- [Release notes](https://github.com/nWidart/laravel-modules/releases)
- [Changelog](https://github.com/nWidart/laravel-modules/blob/master/CHANGELOG.md)
- [Commits](nWidart/laravel-modules@v13.0.0...v13.2.0)

---
updated-dependencies:
- dependency-name: nwidart/laravel-modules
  dependency-version: 13.2.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Entity 2.0 only raises its PHP requirement to 8.3, which the framework already requires. The old ^1.2 is dropped later.
It was configured but no git hook ever ran it: the only hook is commit-msg (commitlint). Drops the dependency, its configuration and 72 transitive packages from the lock file.
* chore(deps): accept pollora/wp-rest 2.0

wp-rest 2.0 refuses a REST route that declares no permission. The framework still accepts the 0.x and 1.x versions.

* test(e2e): declare the public fixture routes, and check a route without a permission is refused

wp-rest 2.0 refuses a route that declares no permission. The public and translations fixtures declare Everyone; a new undeclared route checks the refusal.
)

* feat(route): let Route::wp() routes opt out of the Laravel session stack

Routes declared in routes/web.php inherit the web group, so every anonymous
request starts a session and sends two cookies. wordpress.sessions (default
true, no behaviour change) removes StartSession, ShareErrorsFromSession and
ValidateCsrfToken from Route::wp() routes only.

Refs #559

* fix(route): also drop PreventRequestForgery, the Laravel 13 CSRF middleware

Refs #559

* fix(route): stop referencing the deprecated ValidateCsrfToken

PreventRequestForgery is the Laravel 13 CSRF middleware the web group lists.
Refs #559

* chore: record wordpress.sessions in the public surface

Refs #559
Entity 2.0 only raises its PHP requirement to 8.3, which the framework already requires, so nothing changes for a project that already runs it. The wp-rest constraint is left as it is: dropping 0.x and 1.x would impose the private-by-default routes of wp-rest 2.0 on every site that updates.
Dates the CHANGELOG for v13.39.2. Laravel is still at 13.39 (the latest published is v13.39.0), so the framework goes up by a patch.
wp-rest 2.0 refuses a REST route that declares no permission, and composer update takes the newest version a constraint accepts: every site that updated would have its undeclared routes refused. The constraint goes back to ^0.1 || ^0.2 || ^1.0. The E2E route that checked the refusal is removed (it needs wp-rest 2); the fixtures that declare Everyone stay, which wp-rest 0.2 supports.
@ogorzalka
ogorzalka merged commit 9552e8a into main Oct 30, 2026
40 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant