build: Bump laravel/passport from 12.4.2 to 13.0.6

[dependabot]

Bumps laravel/passport from 12.4.2 to 13.0.6.

Release notes

Sourced from laravel/passport's releases.

v13.0.6

• [13.x] Fix broken token relation when auth identifier is not PK by @​axlon in laravel/passport#1835

v13.0.5

• [13.x] Fix Exception Caused by Missing AccessToken Attributes by @​hafezdivandari in laravel/passport#1829

v13.0.4

• [13.x] Fix skipping authorization consent when no scopes are requested by @​hafezdivandari in laravel/passport#1825
• [13.x] Document changes to oauth_clients table in upgrade guide by @​gdebrauwer in laravel/passport#1823

v13.0.3

• [13.x] Fix object returned by mocked validateAuthenticatedRequest() method in Passport::actingAsClient() method by @​gdebrauwer in laravel/passport#1822

v13.0.2

• Changed getTokenFromRequest method to handle null value and prevent type error by @​eldair in laravel/passport#1819
• fix: possible php error if redirect column is an empty string by @​Tofandel in laravel/passport#1821

v13.0.1

• [13.x] Fix access to undefined route by @​axlon in laravel/passport#1812
• [13.x] Fix access to uninitialised typed static property by @​owenvoke in laravel/passport#1811
• Use isset to check for initialisation by @​patrickomeara in laravel/passport#1813
• [13.x] Fix middleware type error by @​axlon in laravel/passport#1815

v13.0.0

• [13.x] Support OAuth2 Server v9 by @​hafezdivandari in laravel/passport#1734
• [13.x] Always hash client secret by @​hafezdivandari in laravel/passport#1745
• [13.x] Remove redundant PAT client table and model by @​hafezdivandari in laravel/passport#1749
• [13.x] Fix determining revoked records by @​hafezdivandari in laravel/passport#1751
• [13.x] Use the oauth_scopes property of the bearer token on TokenGuard by @​hafezdivandari in laravel/passport#1755
• [13.x] Refactor migrations by @​hafezdivandari in laravel/passport#1759
• [13.x] Cleanup by @​hafezdivandari in laravel/passport#1758
• [13.x] Use unique IDs on client model by @​hafezdivandari in laravel/passport#1757
• [13.x] Force confidential PAT client by @​hafezdivandari in laravel/passport#1761
• [13.x] Fix register a custom rendering closure for OAuthServerException by @​hafezdivandari in laravel/passport#1763
• [13.x] Use UUID to identify clients by default by @​hafezdivandari in laravel/passport#1764
• [13.x] Disable PAT requests by @​hafezdivandari in laravel/passport#1766
• [13.x] Cleanup and add feature tests by @​hafezdivandari in laravel/passport#1767
• [13.x] Always validate auth token by @​hafezdivandari in laravel/passport#1769
• [13.x] Configure the user provider for PAT by @​hafezdivandari in laravel/passport#1768
• [13.x] Fix user-token relations by @​hafezdivandari in laravel/passport#1773
• [13.x] Make client RFC compatible by @​hafezdivandari in laravel/passport#1744
• [13.x] Fix skipping consent prompt by @​hafezdivandari in laravel/passport#1777
• [13.x] Improve issuing PATs by @​hafezdivandari in laravel/passport#1780
• [13.x] Fix clients confidentiality by @​hafezdivandari in laravel/passport#1782
• [13.x] Make Passport headless (Support Laravel Jetstream and Breeze) by @​hafezdivandari in laravel/passport#1771
• [13.x] Improve performance, fix minor bugs, and add tests by @​hafezdivandari in laravel/passport#1783
• bug: mockery not setup correctly by @​JimTools in laravel/passport#1785
• [13.x] Cleanup, improve types and tests by @​hafezdivandari in laravel/passport#1788
• [13.x] Enhance error responses by @​hafezdivandari in laravel/passport#1791
• [13.x] Rename CheckClientCredentials middleware by @​hafezdivandari in laravel/passport#1792

... (truncated)

Changelog

Sourced from laravel/passport's changelog.

v13.0.6 - 2025-07-10

• [13.x] Fix broken token relation when auth identifier is not PK by @​axlon in laravel/passport#1835

v13.0.5 - 2025-06-12

• [13.x] Fix Exception Caused by Missing AccessToken Attributes by @​hafezdivandari in laravel/passport#1829

v13.0.4 - 2025-06-06

• [13.x] Fix skipping authorization consent when no scopes are requested by @​hafezdivandari in laravel/passport#1825
• [13.x] Document changes to oauth_clients table in upgrade guide by @​gdebrauwer in laravel/passport#1823

v13.0.3 - 2025-06-02

• [13.x] Fix object returned by mocked validateAuthenticatedRequest() method in Passport::actingAsClient() method by @​gdebrauwer in laravel/passport#1822

v13.0.2 - 2025-05-27

• Changed getTokenFromRequest method to handle null value and prevent type error by @​eldair in laravel/passport#1819
• fix: possible php error if redirect column is an empty string by @​Tofandel in laravel/passport#1821

v13.0.1 - 2025-05-07

• [13.x] Fix access to undefined route by @​axlon in laravel/passport#1812
• [13.x] Fix access to uninitialised typed static property by @​owenvoke in laravel/passport#1811
• Use isset to check for initialisation by @​patrickomeara in laravel/passport#1813
• [13.x] Fix middleware type error by @​axlon in laravel/passport#1815

v13.0.0 - 2025-04-25

• [13.x] Support OAuth2 Server v9 by @​hafezdivandari in laravel/passport#1734
• [13.x] Always hash client secret by @​hafezdivandari in laravel/passport#1745
• [13.x] Remove redundant PAT client table and model by @​hafezdivandari in laravel/passport#1749
• [13.x] Fix determining revoked records by @​hafezdivandari in laravel/passport#1751
• [13.x] Use the oauth_scopes property of the bearer token on TokenGuard by @​hafezdivandari in laravel/passport#1755
• [13.x] Refactor migrations by @​hafezdivandari in laravel/passport#1759
• [13.x] Cleanup by @​hafezdivandari in laravel/passport#1758
• [13.x] Use unique IDs on client model by @​hafezdivandari in laravel/passport#1757
• [13.x] Force confidential PAT client by @​hafezdivandari in laravel/passport#1761
• [13.x] Fix register a custom rendering closure for OAuthServerException by @​hafezdivandari in laravel/passport#1763
• [13.x] Use UUID to identify clients by default by @​hafezdivandari in laravel/passport#1764
• [13.x] Disable PAT requests by @​hafezdivandari in laravel/passport#1766
• [13.x] Cleanup and add feature tests by @​hafezdivandari in laravel/passport#1767
• [13.x] Always validate auth token by @​hafezdivandari in laravel/passport#1769
• [13.x] Configure the user provider for PAT by @​hafezdivandari in laravel/passport#1768
• [13.x] Fix user-token relations by @​hafezdivandari in laravel/passport#1773
• [13.x] Make client RFC compatible by @​hafezdivandari in laravel/passport#1744
• [13.x] Fix skipping consent prompt by @​hafezdivandari in laravel/passport#1777
• [13.x] Improve issuing PATs by @​hafezdivandari in laravel/passport#1780

... (truncated)

Upgrade guide

Sourced from laravel/passport's upgrade guide.

Upgrade Guide

General Notes

Upgrading To 13.0 From 12.x

Minimum PHP Version

PR: laravel/passport#1734, laravel/passport#1783

PHP 8.2 is now the minimum required version.

Minimum Laravel Version

PR: laravel/passport#1757, laravel/passport#1783, laravel/passport#1797

Laravel 11.35 is now the minimum required version.

OAuth2 Server

PR: laravel/passport#1734

The league/oauth2-server Composer package which is utilized internally by Passport has been updated to 9.0, which adds additional types to method signatures. To ensure your application is compatible, you should review this package's complete changelog.

Headless

PR: laravel/passport#1771

Passport's views were not rendering properly for several release cycles. Passport is now a headless OAuth2 library. If you would like a frontend implementation of Laravel Passport's OAuth features that are already completed for you, you should use an application starter kit.

All the authorization view's rendering logic may be customized using the appropriate methods available via the Laravel\Passport\Passport class. Typically, you should call these methods within the boot method of your application's App\Providers\AppServiceProvider class. Passport will take care of defining the routes that return these views:

public function boot(): void
{
    Passport::authorizationView('auth.oauth.authorize');
}

Identify Clients by UUIDs

PR: laravel/passport#1764

By default, Passport now uses UUIDs to identify clients. You may keep using incremental integer IDs by setting Passport::$clientUuids to false within the boot method of your application's App\Providers\AppServiceProvider class:

public function boot(): void
{
    Passport::$clientUuids = false;
}

As a consequence of this change, the 'passport.client_uuids' configuration property has been removed, as well as the Passport::clientUuids() and Passport::setClientUuids() methods.

... (truncated)

Commits

• c5bf6c5 Fix broken token relation when auth identifier is not PK (#1835)
• 951fe86 Update CHANGELOG
• 9a3b47b [13.x] Fix Exception Caused by Missing AccessToken Attributes (#1829)
• 524a4ff Update CHANGELOG
• cc80677 [13.x] Document changes to oauth_clients table in upgrade guide (#1823)
• 3a3401f [13.x] Fix skipping authorization consent when no scopes are requested (#1825)
• 988779d Update CHANGELOG
• d9a994d Fix mock in 'actingAsClient‘ method (#1822)
• db70cb1 Update CHANGELOG
• 01aaf7d fix: possible php error if redirect column is an empty string (#1821)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #4251.