moonshine-software/moonshine 4.21.0

v4.21.0

on GitHub

MoonShine 4.21.0 brings safer resource operations and more predictable async interactions, with fixes for list updates, forms, notifications, and polymorphic relations.

Safer resource operations

• CSRF protection for async methods. Apply the configured Laravel CSRF protection to every HTTP verb, including GET, HEAD, and OPTIONS, while preserving configured exclusions. #2098
• Scoped and authorized mass deletion. Respect model global scopes and the resource's item query, and check delete authorization for every matched record before deleting any of them. Hooks receive only IDs matched by that query. #2099
• Safer parent relation resolution. Validate relation names before invoking model methods, return 404 for unknown relations, and support typed, union-typed, and field-declared relations. #2095

A smoother async UI

• Keep the latest list request in control: rapid filtering, sorting, or pagination can no longer let an older response overwrite the current results. #2090
• Restore form controls after a network failure without a server response, so the user can retry. #2091
• Ignore repeated clicks on an async action while its request is in progress. #2092
• Keep notifications independent: closing a toast no longer lets its timer remove another toast, and notifications created in the same millisecond keep distinct IDs. #2093
• Restore native required validation for MorphTo after switching types, preventing an empty target from being submitted. Includes coverage for optional selects and creating MorphTo relations. #2107

This release also corrects generic type annotations reported by PHPStan.

Upgrading

No database migrations are required. After updating, publish the refreshed UI assets and clear cached views and configuration:

php artisan vendor:publish --tag=moonshine-assets --force
php artisan optimize:clear

If custom JavaScript calls MoonShine async methods, include a valid CSRF token even for GET requests when CSRF protection is configured. Operation authorization remains the responsibility of your custom handler.

Thanks to @ifteakhor and @lee-to for the contributions and regression coverage.

Full changelog: 4.20.1 → 4.21.0