Merge remote-tracking branch 'statamic/5.x' into feature/view-other-authors-entries

Author: aerni

.babelrc

@@ -8,6 +8,56 @@ jobs:
   pr-title:
     runs-on: ubuntu-latest
     steps:
-      - uses: deepakputhraya/action-pr-title@master
-        with:
-          regex: '^\[\d+\.x\]\s'
+      - name: Validate PR title matches target branch
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          BASE_BRANCH: ${{ github.event.pull_request.base.ref }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          # Validates PR title against target branch
+          # Returns error message if invalid, empty string if valid
+          validate_pr_title() {
+            local target_branch="$1"
+            local pr_title="$2"
+            local default_branch="$3"
+
+            # Check if target branch is a version branch (e.g., 5.x, 4.x)
+            if [[ $target_branch =~ ^([0-9]+)\.x$ ]]; then
+              local version="${BASH_REMATCH[1]}"
+              if [[ ! $pr_title =~ ^\[$version\.x\][[:space:]] ]]; then
+                echo "PR targeting '$target_branch' must have title starting with '[$version.x] '"
+                return
+              fi
+
+            # Check if target branch is master (next major version)
+            elif [[ $target_branch == "master" ]]; then
+              local current_version="${default_branch//\.x/}"
+              local next_version=$((current_version + 1))
+              if [[ ! $pr_title =~ ^\[$next_version\.x\][[:space:]] ]]; then
+                echo "PR targeting 'master' must have title starting with '[$next_version.x] '"
+                return
+              fi
+
+            # For other branches, just enforce that there's a version prefix
+            else
+              if [[ ! $pr_title =~ ^\[[0-9]+\.x\][[:space:]] ]]; then
+                echo "PR title must start with a version prefix like '[5.x] '"
+                return
+              fi
+            fi
+
+            echo ""
+          }
+
+          echo "PR Title: $PR_TITLE"
+          echo "Base Branch: $BASE_BRANCH"
+          echo "Default Branch: $DEFAULT_BRANCH"
+
+          ERROR=$(validate_pr_title "$BASE_BRANCH" "$PR_TITLE" "$DEFAULT_BRANCH")
+
+          if [[ -n $ERROR ]]; then
+            echo $ERROR
+            exit 1
+          fi
+
+          echo "PR title validation passed"

.github/workflows/pr-title.yml

@@ -16,7 +16,7 @@ jobs:
 
     strategy:
       matrix:
-        php: [8.1, 8.2, 8.3, 8.4]
+        php: [8.1, 8.2, 8.3, 8.4, 8.5]
         laravel: [10.*, 11.*, 12.*]
         stability: [prefer-lowest, prefer-stable]
         os: [ubuntu-latest]
@@ -36,6 +36,10 @@ jobs:
             laravel: 12.*
           - php: 8.4
             laravel: 10.*
+          - php: 8.5
+            laravel: 10.*
+          - php: 8.5
+            laravel: 11.*
 
     name: P${{ matrix.php }} - L${{ matrix.laravel }} - ${{ matrix.stability }} - ${{ matrix.os }}
 

.github/workflows/tests.yml

@@ -3,7 +3,7 @@ If you discover a security vulnerability in Statamic, please review the followin
 ## Guidelines
 While working to identify potential security vulnerabilities in Statamic, we ask that you:
 
-- **Privately** share any issues that you discover with us via statamic.com/support as soon as possible.
+- **Privately** share any issues that you discover with us via support@statamic.com as soon as possible.
 - Give us a reasonable amount of time to address any reported issues before publicizing them.
 - Only report issues that are in scope.
 - Provide a quality report with precise explanations and concrete attack scenarios.

CHANGELOG.md

@@ -14,7 +14,7 @@
         "composer/semver": "^3.4",
         "guzzlehttp/guzzle": "^6.3 || ^7.0",
         "james-heinrich/getid3": "^1.9.21",
-        "laravel/framework": "^10.40 || ^11.34 || ^12.0",
+        "laravel/framework": "^10.48.29 || ^11.44.1 || ^12.40.0",
         "laravel/prompts": "^0.1.16 || ^0.2.0 || ^0.3.0",
         "league/commonmark": "^2.2",
         "league/csv": "^9.0",
@@ -24,27 +24,30 @@
         "nesbot/carbon": "^2.62.1 || ^3.0",
         "pixelfear/composer-dist-plugin": "^0.1.4",
         "rebing/graphql-laravel": "^9.8",
-        "rhukster/dom-sanitizer": "^1.0.6",
+        "rhukster/dom-sanitizer": "^1.0.7",
         "spatie/blink": "^1.3",
-        "spatie/ignition": "^1.15.1",
+        "spatie/error-solutions": "^1.0 || ^2.0",
         "statamic/stringy": "^3.1.2",
         "stillat/blade-parser": "^1.10.1 || ^2.0",
         "symfony/lock": "^6.4",
         "symfony/var-exporter": "^6.0",
         "symfony/yaml": "^6.0 || ^7.0",
         "ueberdosis/tiptap-php": "^1.4",
         "voku/portable-ascii": "^2.0.2",
-        "wilderborn/partyline": "^1.0"
+        "wilderborn/partyline": "^1.0",
+        "symfony/http-foundation": "^6.4.29 || ^7.3.7",
+        "symfony/process": "^6.4.14 || ^7.1.7"
     },
     "require-dev": {
         "doctrine/dbal": "^3.6",
         "fakerphp/faker": "~1.10",
         "google/cloud-translate": "^1.6",
         "laravel/pint": "1.16.0",
         "mockery/mockery": "^1.6.10",
-        "orchestra/testbench": "^8.14 || ^9.2 || ^10.0",
+        "orchestra/testbench": "^8.36 || ^9.15 || ^10.8",
         "phpunit/phpunit": "^10.5.35 || ^11.5.3",
-        "spatie/laravel-ray": "^1.37"
+        "sebastian/recursion-context": "^5.0.1 || ^6.0.3",
+        "spatie/laravel-ray": "^1.42"
     },
     "config": {
         "optimize-autoloader": true,
@@ -83,6 +86,13 @@
             "src/helpers.php",
             "src/namespaced_helpers.php",
             "src/View/Blade/helpers.php"
+        ],
+        "exclude-from-classmap": [
+            "tests/Auth/Eloquent/__migrations__/**",
+            "tests/StarterKits/__fixtures__/**",
+            "tests/Translator/__fixtures__/**",
+            "tests/Console/Kernel.php",
+            "src/Console/Please/app-kernel.php"
         ]
     },
     "autoload-dev": {

SECURITY.md

@@ -76,7 +76,7 @@
         |--------------------------------------------------------------------------
         |
         | You may define global defaults for all manipulation parameters, such as
-        | quality, format, and sharpness. These can and will be be overwritten
+        | quality, format, and sharpness. These can and will be overwritten
         | on the tag parameter level as well as the preset level.
         |
         */
@@ -223,4 +223,16 @@
 
     'svg_sanitization_on_upload' => true,
 
+    /*
+    |--------------------------------------------------------------------------
+    | Use V6 Permissions
+    |--------------------------------------------------------------------------
+    |
+    | This allows you to opt in to the asset permissions that will become the
+    | default behavior in Statamic 6. This will be removed in Statamic 6.
+    |
+    */
+
+    'v6_permissions' => false,
+
 ];

composer.json

@@ -42,6 +42,20 @@
         //
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Mutations
+    |--------------------------------------------------------------------------
+    |
+    | Here you may list mutations to be added to the Statamic schema.
+    |
+    | https://statamic.dev/graphql#custom-mutations
+    */
+
+    'mutations' => [
+        //
+    ],
+
     /*
     |--------------------------------------------------------------------------
     | Middleware

config/assets.php

@@ -140,4 +140,27 @@
         'timeout' => 30,
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Warming Optimization
+    |--------------------------------------------------------------------------
+    |
+    | These options control performance optimizations during Stache warming.
+    |
+    */
+
+    'warming' => [
+        // Enable parallel store processing for faster warming on multi-core systems
+        'parallel_processing' => env('STATAMIC_STACHE_PARALLEL_WARMING', false),
+
+        // Maximum number of parallel processes (0 = auto-detect CPU cores)
+        'max_processes' => env('STATAMIC_STACHE_MAX_PROCESSES', 0),
+
+        // Minimum number of stores required to enable parallel processing
+        'min_stores_for_parallel' => env('STATAMIC_STACHE_MIN_STORES_PARALLEL', 3),
+
+        // Concurrency driver: 'process', 'fork', or 'sync'
+        'concurrency_driver' => env('STATAMIC_STACHE_CONCURRENCY_DRIVER', 'process'),
+    ],
+
 ];

config/graphql.php

@@ -150,14 +150,17 @@
     |--------------------------------------------------------------------------
     |
     | Here you may define the queue name and connection
-    | that will be used when warming the static cache.
+    | that will be used when warming the static cache and
+    | optionally set the "--insecure" flag by default.
     |
     */
 
     'warm_queue' => env('STATAMIC_STATIC_WARM_QUEUE'),
 
     'warm_queue_connection' => env('STATAMIC_STATIC_WARM_QUEUE_CONNECTION'),
 
+    'warm_insecure' => env('STATAMIC_STATIC_WARM_INSECURE', false),
+
     /*
     |--------------------------------------------------------------------------
     | Shared Error Pages