A security maintenance release. No code or API changes: run composer install and npm ci after pulling.
PHP dependencies
- Laravel 13.38.0 (from 13.26.1): fixes an XSS in the debug error page.
- league/commonmark 2.10.4: fixes a quadratic-time denial of service and a bypass of the raw-HTML filter.
- phpseclib 3.0.57: fixes X25519 private-key recovery.
- symfony/http-foundation 8.1.9: fixes a regular-expression denial of service through request headers.
composer audit reports nothing.
Browser bundle
Vue 3.5.44, the Unovis chart library 1.7.1 (which pulls in maplibre-gl 6, past its XSS advisories), axios, DOMPurify, qs and follow-redirects, plus Vite for the build. npm audit reports nothing.
Production installs
spatie/laravel-ignition is now a dev dependency, so composer install --no-dev leaves it out. Laravel's own error page covers local debugging.
Before you deploy
- PHP itself: today's PHP releases fix two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619). Run this on PHP 8.4.27 or 8.5.12 or later. 8.3.36 is fixed too, but the lockfile's Symfony 8.1 packages need PHP 8.4.1+, as they did in 3.4.0.
195 PHP tests and 72 JavaScript tests.
Full Changelog: v3.4.0...v3.4.1