build: Bump laravel/passport from 12.4.2 to 13.1.0

[dependabot]

Bumps laravel/passport from 12.4.2 to 13.1.0.

Release notes

Sourced from laravel/passport's releases.

v13.1.0

• [13.x] Add an option to disable device code grant by @​hafezdivandari in laravel/passport#1842
• [13.x] Add an upgrade guide entry for key file permissions by @​hafezdivandari in laravel/passport#1841
• [13.x] Fallback to list of auth user providers if no auth guard for Passport is defined by @​hafezdivandari in laravel/passport#1840
• [13.x] Add an optional migration for oauth_clients table to the upgrade guide by @​hafezdivandari in laravel/passport#1843
• Fix viewPrefix Method to Match Documentation Example by @​trippo in laravel/passport#1844

v13.0.6

• [13.x] Fix broken token relation when auth identifier is not PK by @​axlon in laravel/passport#1835

v13.0.5

• [13.x] Fix Exception Caused by Missing AccessToken Attributes by @​hafezdivandari in laravel/passport#1829

v13.0.4

• [13.x] Fix skipping authorization consent when no scopes are requested by @​hafezdivandari in laravel/passport#1825
• [13.x] Document changes to oauth_clients table in upgrade guide by @​gdebrauwer in laravel/passport#1823

v13.0.3

• [13.x] Fix object returned by mocked validateAuthenticatedRequest() method in Passport::actingAsClient() method by @​gdebrauwer in laravel/passport#1822

v13.0.2

• Changed getTokenFromRequest method to handle null value and prevent type error by @​eldair in laravel/passport#1819
• fix: possible php error if redirect column is an empty string by @​Tofandel in laravel/passport#1821

v13.0.1

• [13.x] Fix access to undefined route by @​axlon in laravel/passport#1812
• [13.x] Fix access to uninitialised typed static property by @​owenvoke in laravel/passport#1811
• Use isset to check for initialisation by @​patrickomeara in laravel/passport#1813
• [13.x] Fix middleware type error by @​axlon in laravel/passport#1815

v13.0.0

• [13.x] Support OAuth2 Server v9 by @​hafezdivandari in laravel/passport#1734
• [13.x] Always hash client secret by @​hafezdivandari in laravel/passport#1745
• [13.x] Remove redundant PAT client table and model by @​hafezdivandari in laravel/passport#1749
• [13.x] Fix determining revoked records by @​hafezdivandari in laravel/passport#1751
• [13.x] Use the oauth_scopes property of the bearer token on TokenGuard by @​hafezdivandari in laravel/passport#1755
• [13.x] Refactor migrations by @​hafezdivandari in laravel/passport#1759
• [13.x] Cleanup by @​hafezdivandari in laravel/passport#1758
• [13.x] Use unique IDs on client model by @​hafezdivandari in laravel/passport#1757
• [13.x] Force confidential PAT client by @​hafezdivandari in laravel/passport#1761
• [13.x] Fix register a custom rendering closure for OAuthServerException by @​hafezdivandari in laravel/passport#1763
• [13.x] Use UUID to identify clients by default by @​hafezdivandari in laravel/passport#1764
• [13.x] Disable PAT requests by @​hafezdivandari in laravel/passport#1766
• [13.x] Cleanup and add feature tests by @​hafezdivandari in laravel/passport#1767
• [13.x] Always validate auth token by @​hafezdivandari in laravel/passport#1769
• [13.x] Configure the user provider for PAT by @​hafezdivandari in laravel/passport#1768
• [13.x] Fix user-token relations by @​hafezdivandari in laravel/passport#1773
• [13.x] Make client RFC compatible by @​hafezdivandari in laravel/passport#1744
• [13.x] Fix skipping consent prompt by @​hafezdivandari in laravel/passport#1777
• [13.x] Improve issuing PATs by @​hafezdivandari in laravel/passport#1780

... (truncated)

Changelog

Sourced from laravel/passport's changelog.

v13.1.0 - 2025-08-07

• [13.x] Add an option to disable device code grant by @​hafezdivandari in laravel/passport#1842
• [13.x] Add an upgrade guide entry for key file permissions by @​hafezdivandari in laravel/passport#1841
• [13.x] Fallback to list of auth user providers if no auth guard for Passport is defined by @​hafezdivandari in laravel/passport#1840
• [13.x] Add an optional migration for oauth_clients table to the upgrade guide by @​hafezdivandari in laravel/passport#1843
• Fix viewPrefix Method to Match Documentation Example by @​trippo in laravel/passport#1844

v13.0.6 - 2025-07-10

• [13.x] Fix broken token relation when auth identifier is not PK by @​axlon in laravel/passport#1835

v13.0.5 - 2025-06-12

• [13.x] Fix Exception Caused by Missing AccessToken Attributes by @​hafezdivandari in laravel/passport#1829

v13.0.4 - 2025-06-06

• [13.x] Fix skipping authorization consent when no scopes are requested by @​hafezdivandari in laravel/passport#1825
• [13.x] Document changes to oauth_clients table in upgrade guide by @​gdebrauwer in laravel/passport#1823

v13.0.3 - 2025-06-02

• [13.x] Fix object returned by mocked validateAuthenticatedRequest() method in Passport::actingAsClient() method by @​gdebrauwer in laravel/passport#1822

v13.0.2 - 2025-05-27

• Changed getTokenFromRequest method to handle null value and prevent type error by @​eldair in laravel/passport#1819
• fix: possible php error if redirect column is an empty string by @​Tofandel in laravel/passport#1821

v13.0.1 - 2025-05-07

• [13.x] Fix access to undefined route by @​axlon in laravel/passport#1812
• [13.x] Fix access to uninitialised typed static property by @​owenvoke in laravel/passport#1811
• Use isset to check for initialisation by @​patrickomeara in laravel/passport#1813
• [13.x] Fix middleware type error by @​axlon in laravel/passport#1815

v13.0.0 - 2025-04-25

• [13.x] Support OAuth2 Server v9 by @​hafezdivandari in laravel/passport#1734
• [13.x] Always hash client secret by @​hafezdivandari in laravel/passport#1745
• [13.x] Remove redundant PAT client table and model by @​hafezdivandari in laravel/passport#1749
• [13.x] Fix determining revoked records by @​hafezdivandari in laravel/passport#1751
• [13.x] Use the oauth_scopes property of the bearer token on TokenGuard by @​hafezdivandari in laravel/passport#1755
• [13.x] Refactor migrations by @​hafezdivandari in laravel/passport#1759
• [13.x] Cleanup by @​hafezdivandari in laravel/passport#1758
• [13.x] Use unique IDs on client model by @​hafezdivandari in laravel/passport#1757
• [13.x] Force confidential PAT client by @​hafezdivandari in laravel/passport#1761
• [13.x] Fix register a custom rendering closure for OAuthServerException by @​hafezdivandari in laravel/passport#1763
• [13.x] Use UUID to identify clients by default by @​hafezdivandari in laravel/passport#1764

... (truncated)

Upgrade guide

Sourced from laravel/passport's upgrade guide.

Upgrade Guide

General Notes

Upgrading To 13.0 From 12.x

Minimum PHP Version

PR: laravel/passport#1734, laravel/passport#1783

PHP 8.2 is now the minimum required version.

Minimum Laravel Version

PR: laravel/passport#1757, laravel/passport#1783, laravel/passport#1797

Laravel 11.35 is now the minimum required version.

OAuth2 Server

PR: laravel/passport#1734

The league/oauth2-server Composer package which is utilized internally by Passport has been updated to 9.0, which adds additional types to method signatures. To ensure your application is compatible, you should review this package's complete changelog.

Headless

PR: laravel/passport#1771

Passport's views were not rendering properly for several release cycles. Passport is now a headless OAuth2 library. If you would like a frontend implementation of Laravel Passport's OAuth features that are already completed for you, you should use an application starter kit.

All the authorization view's rendering logic may be customized using the appropriate methods available via the Laravel\Passport\Passport class. Typically, you should call these methods within the boot method of your application's App\Providers\AppServiceProvider class. Passport will take care of defining the routes that return these views:

public function boot(): void
{
    // By providing the view names...
    Passport::authorizationView('auth.oauth.authorize');
    Passport::deviceUserCodeView('auth.oauth.device.user-code');
    Passport::deviceAuthorizationView('auth.oauth.device.authorize');
// Or using conventional names under the given prefix...
Passport::viewPrefix('auth.oauth');

}

Identify Clients by UUIDs

PR: laravel/passport#1764

By default, Passport now uses UUIDs to identify clients. You may keep using incremental integer IDs by setting Passport::$clientUuids to false within the boot method of your application's App\Providers\AppServiceProvider class:

public function boot(): void

... (truncated)

Commits

• 7e99ca9 Fix viewPrefix Method to Match Documentation Example (#1844)
• d1c21a2 [13.x] Add an optional migration for oauth_clients table to the upgrade gui...
• 15b8de5 [13.x] Fallback to list of auth user providers if no auth guard for Passport ...
• 1caca2c [13.x] Add an upgrade guide entry for key file permissions (#1841)
• 1507155 [13.x] Add an option to disable device code grant (#1842)
• f0877ac Update CHANGELOG
• c5bf6c5 Fix broken token relation when auth identifier is not PK (#1835)
• 951fe86 Update CHANGELOG
• 9a3b47b [13.x] Fix Exception Caused by Missing AccessToken Attributes (#1829)
• 524a4ff Update CHANGELOG
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

A newer version of laravel/passport exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.