LaraUtilX v1.5.2 Release Notes

Version 1.5.2 is a patch release focused on making the package safe to install and closing two data-exposure defects. There are no new features.

• Security
• Packaging
• Bug Fixes
• Upgrade Notes
• Tests
• Files Added / Modified

Security

Sensitive attributes no longer reach the audit trail

The Auditable trait previously recorded every attribute verbatim. Applying it to a model holding credentials, such as User, wrote password hashes and tokens into model_audits in readable form.

Passwords, tokens, and secrets are now excluded by default, on both the old and new value sides. The list is configurable through lara-util-x.audit.excluded_attributes, and a model can add its own by overriding auditExcludedAttributes().

See the Auditable trait documentation for details.

CrudController sorting is restricted to declared columns

The abstract CrudController passed ?sort_by straight to orderBy(), so a caller could order results by any column on the table, including ones they could not read, and infer values from the row order.

Sorting now requires the column to appear in $sortableFields:

class PostController extends CrudController
{
    protected array $sortableFields = ['title', 'created_at'];
}

A value outside the list is ignored rather than rejected. When the list is empty, no sorting is applied.

This covers the abstract base class. Controllers produced by make:crud still apply ?sort_by without restriction, so add an allow-list to generated controllers whose tables hold sensitive columns.

Packaging

composer.json previously declared no dependencies at all, not even a php constraint, so Composer would install the package into any project and let it fail later at runtime. It now declares them properly:

minimum-stability: dev was also removed, since it pushed dev-stability resolution onto every consumer.

The previously documented support range of Laravel 8.0+ and PHP 8.0+ was never accurate. RejectCommonPasswords implements Illuminate\Contracts\Validation\ValidationRule, which exists only in Laravel 10 and later, and the LLM response objects use readonly properties, which require PHP 8.1.

Bug Fixes

Upgrade Notes

Two behaviour changes may affect existing code:

• Sorting. If you relied on sorting a CrudController by an arbitrary column, declare those columns in $sortableFields.
• Delete status. deleteRecord() returns 200 instead of 204. Clients that special-cased the empty-body status need updating.

If you adopted Auditable before this release, existing rows still hold whatever was captured at the time. This release changes what is written going forward but does not rewrite history, so review and purge any sensitive values already stored.

Tests

The suite grew from 162 to 175 tests, with new coverage for CrudController and the Auditable trait.

It was verified against every supported version:

cd packages/omarchouman/lara-util-x
./vendor/bin/phpunit

Files Added / Modified