This security patch requires Laravel 12.72.0 or later in 12.x, or 13.41.0 or later in 13.x. Update your application lockfile and run Composer audit when upgrading Workflow.
These minimums include fixes for Concurrency process task-output injection, temporary signed URL expiration bypass, and temporary signed URL expiration bypass through unencoded numeric-keyed route parameters.
Workflow runtime behavior and schema are unchanged from 2.28.0. Current example and qualification lockfiles are refreshed, with the HTTP example preserving its declared PHP 8.3 support. See #1133 and #1141.