Biostate/filament-menu-builder v5.2.0 on GitHub

Existing Laravel 11 installs stay on v5.1.0 and do not receive the security fixes below.

Laravel 11 support. Every Laravel 11 release is affected by unpatched security advisories (including the critical TokenGuard authentication bypass, PKSA-b41t-wbzk-9q51), so Composer refuses to install it by default. The package now requires illuminate/contracts ^12.0|^13.0, and CI no longer tests Laravel 11.

Menu builder actions (edit, delete, duplicate, create sub-item) now only resolve menu items that belong to the menu being edited; previously a crafted menuItemId could modify or delete items of any menu.
menuId on the menu-builder and menu-item-form Livewire components is now #[Locked], and both components (and the "Configure Menu" page) check the menu resource's canEdit policy on every request.
Saving the menu tree only accepts id/children for items of the current menu. Previously the payload was passed straight to rebuildTree(), which mass-assigns extra keys and creates new items for entries without an id.
The "create menu item" form saves validated form state instead of the raw Livewire data property, so extra attributes (e.g. id) can no longer be injected.
Link URLs using the javascript:, data: or vbscript: scheme are rejected by the form and rendered as #, preventing stored XSS in front-end menus and the admin "Go to link" action.
Menuable::scopeFilamentSearch() binds the translation locale as a query parameter instead of interpolating it into raw SQL.
The menuable record select only queries classes registered in the models config instead of any class name sent by the client.

Update npm dev dependencies, including esbuild 0.28.1 and shell-quote 1.12.0, to resolve all open Dependabot alerts. The built assets in resources/dist are unchanged.
Remove the unused @tailwindcss/typography dev dependency.

Full Changelog: v5.1.0...v5.2.0