chore: release v13.39.2

.github/dependabot.yml

@@ -37,6 +37,10 @@ updates:
       interval: "weekly"
     open-pull-requests-limit: 10
     target-branch: "develop"
+    ignore:
+      # The CI and the E2E suite run on Node 22: the Node types follow it
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
     labels:
       - "dependencies"
       - "automerge"

CHANGELOG.md

@@ -5,7 +5,19 @@ All notable changes to the Pollora framework will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased](https://github.com/Pollora/framework/compare/v13.39.1...develop)
+## [Unreleased](https://github.com/Pollora/framework/compare/v13.39.2...develop)
+
+## [v13.39.2](https://github.com/Pollora/framework/compare/v13.39.1...v13.39.2) - 2026-10-30
+
+### Added
+- **`wordpress.sessions`**: `Route::wp()` routes no longer have to start a Laravel session. Routes declared in `routes/web.php` inherit the `web` group, so every anonymous request to a `Route::wp()` route started a session (a row in `sessions`, the `<app>_session` and `XSRF-TOKEN` cookies). With `'sessions' => false` in `config/wordpress.php`, those routes drop `StartSession`, `ShareErrorsFromSession` and the CSRF middleware (`PreventRequestForgery`, which `ValidateCsrfToken` extends), and `csrf_token()`, `old()` and flash data have nothing to read from there. The default is `true`: nothing changes for an existing site. Laravel-native routes keep the full `web` group, and the template hierarchy fallback is not affected
+
+### Changed
+- `pollora/entity` is required at `^2.0` (it was `^1.2`): entity 2.0 only raises its PHP requirement to 8.3, which the framework already requires
+- `nwidart/laravel-modules` is required at `^13.2` (it was `^13.0`). Its 13.2.0 release changes how a custom `stubs.path` is enabled and how a custom `paths.generator.*` entry without a `namespace` gets its namespace; a project on the default configuration needs no change
+- The development tooling moves up: `@commitlint/cli` and `@commitlint/config-conventional` 21 (they need Node 22.12 or later; the repository's rules still apply), `prettier` 3.9.10, and, for the end-to-end suite, `@playwright/test` 1.64.1 and `@wordpress/e2e-test-utils-playwright` 3.1.0, both pinned as before. `lint-staged` is removed, with its configuration: it was configured but no git hook ever ran it (the only hook is `commit-msg`)
+- Dependabot ignores the major versions of `@types/node` in `tests/e2e`: the suite runs on Node 22
+- The development dependency `pollora/harness` is required at `^0.1.13`
 
 ## [v13.39.1](https://github.com/Pollora/framework/compare/v13.39.0...v13.39.1) - 2026-10-28
 

api-surface.json

@@ -121,6 +121,7 @@
         "config:wordpress.plugin_conditions.woocommerce.is_product_tag": "key",
         "config:wordpress.plugin_conditions.woocommerce.is_shop": "key",
         "config:wordpress.plugin_conditions.woocommerce.is_wc_endpoint_url": "key",
+        "config:wordpress.sessions": "key",
         "hook:pollora/async/recover": "hook",
         "hook:pollora/login/credit": "hook",
         "hook:pollora/login/logo": "hook",

composer.json

@@ -35,7 +35,7 @@
         "pollora/attributes": "^0.1.1 || ^1.0",
         "pollora/block-bindings": "^0.2",
         "pollora/discovery": "^0.1 || ^1.0",
-        "pollora/entity": "^1.2",
+        "pollora/entity": "^2.0",
         "pollora/media": "^0.8",
         "pollora/meta": "^0.1",
         "pollora/hook": "^2.0.1",
@@ -52,7 +52,7 @@
         "pollora/query": "^2.0 || ^3.0",
         "spatie/php-structure-discoverer": "^2.4",
         "coduo/php-humanizer": "5.0.3",
-        "nwidart/laravel-modules": "^13.0",
+        "nwidart/laravel-modules": "^13.2",
         "symfony/process": "^7.4 || ^8.0",
         "illuminate/config": "^13.39",
         "laravel/prompts": "^0.3.26"
@@ -125,7 +125,7 @@
         "wp-cli/wp-cli": "^2.12",
         "larastan/larastan": "^3.13",
         "orchestra/testbench": "^11.3.0",
-        "pollora/harness": "^0.1.8"
+        "pollora/harness": "^0.1.13"
     },
     "autoload-dev": {
         "psr-4": {

config/wordpress.php

@@ -58,6 +58,17 @@
      */
     'enable_mail_handling' => true,
 
+    /**
+     * Laravel session on Route::wp() routes.
+     *
+     * Routes declared in routes/web.php inherit the `web` group, which starts a
+     * session (a row in the sessions table and two cookies) on every request.
+     * Set to false to leave the session, error-sharing and CSRF middleware off
+     * Route::wp() routes; Laravel-native routes are not affected.
+     * csrf_token(), old() and flash data then have nothing to read from.
+     */
+    'sessions' => true,
+
     // Kept so this release adds nothing to remove from your config: pollora/woocommerce sets the same
     // conditions itself, and these keys go with the next major release.
     'plugin_conditions' => [