Upgrade to Laravel 13 - #3877
Draft
rathorevaibhav wants to merge 24 commits into
Draft
Conversation
BookServices::getISBN() used jordikroon/google-vision (latest 1.8.2, 2019, abandoned, pinned to PHP ^5.6|^7.0) which blocks the PHP 8 upgrade and drags in abandoned zendframework/* packages. Replaced the OCR call with a direct POST to the Google Vision REST API (images:annotate / TEXT_DETECTION) via Laravel's Http client, reusing the existing GOOGLE_VISION_API_KEY. The ISBN-extraction logic is unchanged. Added tests/Unit/BookServicesTest.php (TDD) covering ISBN extraction and the request shape. Full suite green: 116 tests, 191 assertions on PHP 8.2. jordikroon/google-vision is intentionally left in composer.json for now: removing it triggers Composer 2.9's block-insecure solver filtering, which excludes vulnerable locked versions and fails any re-resolve on this Laravel 8 graph. The package is now dead code and will be dropped from composer.json/lock during Phase 1, alongside the advisory-blocking decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Convert the legacy $factory->define() factories in database/factories to
Laravel 8 class-based factories, the last old-style factories in the repo
(module factories were already class-based).
- Convert + wire HasFactory: App\Models\Setting, App\Models\Client (top-level,
convention-resolved) and App\Models\KnowledgeCafe\Library\Book +
BookCategory (sub-namespaced, via an explicit newFactory()). BookFactory
previously defined two models; BookCategory now has its own factory file.
- Delete 3 dead factories (ApplicantFactory, JobFactory, RoundFactory): they
targeted App\Models\HR\{Applicant,Job,Round}, which no longer exist (moved to
Modules\HR\Entities\* with their own factories). They had zero callers.
- Add tests/Unit/RootFactoriesTest.php (TDD) asserting each factory persists a
valid model. Definitions are byte-for-byte preserved.
Full suite green: 120 tests, 199 assertions on PHP 8.2. No old-style
$factory->define() remain.
The laravel/legacy-factories package itself is left installed for now: removing
it is a composer operation, blocked by Composer 2.9 block-insecure on this
graph (see prior commit). It is now dormant (nothing left for it to load) and
will be dropped in Phase 1 with the other composer cleanup.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Bump actions/checkout v2 → v4 across all three workflows - Bump codecov/codecov-action v3 → v4 in unit-testing - Fix integration-testing MySQL credentials: homestead/secret → mysql_test_user/root/portal_test (matches .env.testing) - Add --env=testing to integration-testing migrate/seed commands - Add --no-interaction to bare composer install calls - Remove deprecated --no-suggest flag from coding-standards composer install Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add .nvmrc pinning Node 24 (Active LTS) - Add actions/setup-node@v4 step reading .nvmrc in unit-testing, integration-testing, and coding-standards workflows so CI and local dev use the same Node version instead of relying on ubuntu-latest default Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…s (Phase 0) corcel has no Laravel 13 release, making it a hard blocker for the upgrade. All 4 call sites are decoupled from the package by introducing plain Eloquent models for the WordPress DB tables (app/Models/WordPress/Wp*.php), each using the existing 'wordpress' connection (which already carries the wp_ prefix). - WpPost / WpPostMeta: replaces Corcel\Model\Post; adds saveMeta() and hasMeta() scope to preserve JobObserver behaviour - WpUser / WpUserMeta: replaces Corcel\Model\User and AuthUserProvider; eager-loads meta so WebsiteUserService/HasWebsiteUser keep working - WpOption: replaces Corcel\Model\Option with a static get() helper - WpTerm / WpTermRelationship: replaces Corcel\Model\Term/TermRelationship WORDPRESS_ENABLED gate and try/catch guards are preserved throughout. The corcel package declaration in composer.json is removed separately once the Composer advisory-block decision is made. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- SalaryAccessTest: guest redirect, permission gate (403 without employee_salary.view, 200 with it) — mirrors InvoiceAccessTest pattern - TaskTest: guest redirect, authenticated list view, task store via JSON Brings test count from 130 to 136 (221 → 230 assertions). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The Cypress e2e workflow copies .env.example to .env which uses the homestead/secret/homestead credentials. Changing the MySQL service to portal_test/mysql_test_user caused all 4 Cypress login tests to fail (app couldn't connect to DB → no seeded users → login impossible). Unit-testing and integration-testing intentionally use different DBs: unit-testing uses .env.testing (portal_test), Cypress uses the default .env (homestead). Reverted MySQL service credentials and removed the --env=testing flags that don't belong in the e2e context. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…dels - WpUser: hide user_pass, user_activation_key, and meta from JSON output to prevent password hashes and session tokens leaking via the websiteUser accessor appended to every User response - WpPostMeta: add \$fillable so updateOrCreate() in WpPost::saveMeta() does not throw MassAssignmentException (matches old corcel fillable) - WebsiteUserService: guard with auth()->check() before reading email, safe in artisan commands and queue workers - BookServices: add 5s timeout and log Vision API errors instead of silently returning empty string - JobObserver: add ?? 'draft' fallback for status mapping; return early when savedPost lookup returns null after post save - WpTermRelationship: document composite PK caveat for future readers - WpOption: document potential serialization caveat for future readers Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…pect Google OAuth login, Invoice access control, and Prospect CRUD tests were written but accidentally left untracked. Adding them completes the Phase 0 test safety net as defined in docs/upgrade_plan.md. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Both packages are dead code — all call sites were replaced in a prior commit. corcel has no Laravel 13 release (hard blocker for Phase 6); google-vision is abandoned and PHP-7-only (blocks PHP 8 upgrade). Removal also drops 3 transitive dependencies: thunderer/shortcode, zendframework/zend-hydrator, zendframework/zend-stdlib Delete config/corcel.php — no longer needed. Unblocked by temporarily setting config.audit.block-insecure=false, which was reverted after the removal. The existing advisories on laravel/framework, phpunit, and others are pre-existing and unrelated to this change. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…mapping created() already had the guard; updated() was missing it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Phase 0: upgrade safety baseline
… triggers - All three workflows: add upgrade/laravel-13 to push/pull_request branch triggers so CI runs on every phase PR going forward - unit-testing + coding-standards: PHP 7.4 → 8.1 - integration-testing: PHP 8.2 → 8.1 (unified on 8.1 across all workflows) - unit-testing + integration-testing: MySQL 5.7 → 8.0 - composer.json config.platform.php: 7.4 → 8.1 PHP 8.1 and MySQL 8.0 are the Phase 1 runtime targets per docs/upgrade_plan.md. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Update require.php from ^7.4 to ^8.0 (needed for composer to resolve against config.platform.php = 8.1; ^7.4 means <8.0 so it blocked the resolve) - Replace fzaninotto/faker with fakerphp/faker (fzaninotto requires php ^7.0, incompatible with PHP 8.1 platform — fakerphp is the maintained drop-in) - Add audit.block-insecure: false to allow lock update against packages with security advisories that will be resolved in later upgrade phases - Regenerate composer.lock against PHP 8.1 platform pin (clears the "lock file not up to date" CI warning flagged in review) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add public visibility to bare `const` declarations in ProjectDatabaseSeeder and public/lib/fullcalendar utils.php (PHP CS Fixer modifier_keywords rule) - Replace deprecated visibility_required rule with modifier_keywords in .php-cs-fixer.php (would become an error in next CS Fixer major version) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add public visibility to bare `const` declarations in ProjectDatabaseSeeder and public/lib/fullcalendar utils.php (PHP CS Fixer modifier_keywords rule) - Replace deprecated visibility_required rule with modifier_keywords in .php-cs-fixer.php (would become an error in next CS Fixer major version) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The previous lock sync ran a full `composer update`, bumping 111 packages (guzzle 6->7, psr/log 1->2, psr/cache 1->3, symfony 5.4->6.4 components, firebase/php-jwt 6->7, php-cs-fixer 3.65->3.95, ...) and regressing symfony/http-client from the patched 5.4.49 to the CVE-2024-50342-affected, end-of-line 6.2.13. That front-loads the Phase 2+ dependency cascade into a CI-baseline PR and is not exercised by the test suite. Regenerate the lock against the 8.1 platform pin with a targeted update so only the changes PHP 8.1 actually forces land: - Remove fzaninotto/faker (php ^5.3.3||^7.0, can't resolve on 8.1); add the maintained drop-in fakerphp/faker (same Faker\ namespace, used by 12 files) - symfony/deprecation-contracts 2.5.4 -> 3.7.0 (faker's only transitive dep; v3 is the 8.1-era line, API-identical) - require.php ^8.0 -> ^8.1 to match the platform pin - Drop the inert `audit.block-insecure` config (not a key composer 2.2 reads) All other 108 packages stay at their base versions. Also revert the php-cs-fixer 3.95 cascade (modifier_keywords rule + const edits) since 3.65 does not define that rule; base style (visibility_required) is restored and verified clean. Net vs base: 3 CI workflows + composer.json + a 3-package composer.lock delta. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…line feat(phase-1): CI baseline — PHP 8.1 + MySQL 8.0
- Bump laravel/framework to ^9.0, laravel/ui to ^4.0, nwidart/laravel-modules to ^9.0 - Update spatie/laravel-permission to ^5.0, doctrine/dbal to ^3.0 - Replace fzaninotto/faker with fakerphp/faker, nunomaduro/larastan with larastan/larastan ^2.0 - Update laravel-notification-channels/google-chat to ^3.0, nunomaduro/collision to ^6.0 - Swap spatie/laravel-ignition to ^1.0, remove facade/ignition and fideloper/proxy - Move lang files from resources/lang/ to root lang/ (L9 convention) - Rewrite config/mail.php for L9 mailer structure (MAIL_DRIVER → MAIL_MAILER) - Update config/filesystems.php (FILESYSTEM_DRIVER → FILESYSTEM_DISK) - Fix TrustProxies: use L9 framework base class and individual header constants - Update .env.example and .env.testing for renamed env vars - Regenerate composer.lock against PHP 8.1 platform pin All 136 tests passing. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- php constraint: ^8.0 → ^8.1 (align with platform pin) - require-dev: keep larastan/larastan ^2.0, drop duplicate fakerphp/faker entry Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add FILESYSTEM_DRIVER fallback in filesystems.php for servers not yet updated to L9 env key - Add MAIL_DRIVER fallback in mail.php for same reason - Exclude public/lib/ from PHP CS Fixer to avoid modifying vendored files - Revert utils.php to its original vendored state Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Update phpstan.neon to reference larastan/larastan extension path (was nunomaduro/larastan) - Generate phpstan-baseline.neon to record pre-existing errors from larastan 0.7→2.0 strictness jump - Remove stale @phpstan-ignore-next-line in Applicant.php (no longer triggers an error in larastan 2.x) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…LESYSTEM_DISK
Addresses code-review findings on the Laravel 9 upgrade:
- Regenerate config/permission.php from spatie/laravel-permission v5.11.1
defaults (the app uses all package defaults — no custom models/tables).
Replaces the legacy flat `cache_expiration_time` key with the v5 nested
`cache` array, and adds the new `column_names`, `register_permission_check_method`,
`teams`, `display_role_in_exception`, and `enable_wildcard_permission` keys.
The permission-cache TTL is now a true 24h DateInterval (matching the file's
own documented intent) instead of the integer 60*24, which Laravel's cache
layer interprets as 1440 seconds (~24 min). `model_morph_key => 'model_id'`
matches the existing morphs('model') pivot schema.
- Add FILESYSTEM_DISK=local to .env.example now that config/filesystems.php
reads FILESYSTEM_DISK first (the renamed L9 key was previously undocumented).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat(phase-2): upgrade to Laravel 9
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Employee portal
 |
||||||||||||||||||||||||||||
| Project |
Employee portal
|
| Branch Review |
refs/pull/3877/merge
|
| Run status |
|
| Run duration | 00m 24s |
| Commit |
|
| Committer | Vaibhav Rathore |
| View all properties for this run ↗︎ | |
| Test results | |
|---|---|
 |
0
|
 |
0
|
 |
0
|
 |
0
|
 |
4
|
| View all changes introduced in this branch ↗︎ | |
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details to be updated