LaraUtilX v1.5.4 Release Notes

A correctness and security release. Several utilities were unusable in a real application, and three components either wrote credentials to storage or crashed on first contact with production data. There are no new features.

Security

Access logs no longer store passwords

AccessLogMiddleware recorded json_encode($request->all()), so placing it on a login route wrote plaintext passwords into access_logs. This is the same defect fixed in the Auditable trait in 1.5.2, left unfixed in the middleware.

Credentials are now redacted from both the request body and the query string, which fullUrl() had been persisting verbatim. See Access Log Middleware for the exclusion list and how to configure it.

Access logs are pruned

The table grew without bound. php artisan model:prune now removes rows older than lara-util-x.access_log.retention_days, 30 by default.

Uploaded files no longer reuse the client filename

FileProcessingTrait::uploadFile() kept the client-supplied name. Only the extension is retained now, and the stored name is random.

Fixed

Component Defect
SchedulerUtil Threw on any app with a scheduled task, calling getNextRunDate() and isRunning(), which do not exist on Laravel's Event. It also dumped every event through print_r into the log, exhausting memory once real events were registered.
SchedulerUtil hasOverdueTasks() could never return true, comparing nextRunDate(), always in the future, against now.
LoggingUtil Threw a TypeError whenever a channel was passed, because getLogger() declared a Monolog return type while Log::channel() returns an Illuminate logger.
ConfigUtil Non-functional. getSetting() always returned null, and setSetting() wrote to a path it could never read back.
FeatureToggleUtil Wrote into the host application's config/ at runtime, and threw when a feature was declared as an array of overrides.
FilteringUtil ends_with was wrong for repeated substrings. "Smith Smith" did not match "Smith".
CachingUtil Wrote tagged entries but read and forgot them untagged, so every read missed on a taggable store with default_tags set.
CrudController ?per_page was uncapped, and unique-rule rewriting broke when unique: was not the last rule or named no column.
OpenAI provider The default provider failed with a bare class-not-found on a fresh install.
Claude provider Defaulted to a model retired in October 2025, and sent system as a message role, which Anthropic rejects.
Publishing A backslash path that broke on Linux, a reference to a file that does not exist, and the provider publishing itself into app/Providers.
XHelper strSlugify() returned an empty string for any non-Latin input, including Arabic.
FileProcessingTrait getFile() returned the literal "File not found", indistinguishable from a file containing that text.
PHP 8.4 Implicit-nullable parameters in CachingUtil and ConfigUtil.

Added

  • access_log and config configuration blocks.
  • CrudController::$maxPerPage, and --max-per-page on make:crud.
  • ConfigUtil::forgetSetting().
  • SchedulerUtil::isDue() and isRunning() as public methods.

Upgrade Notes

Behaviour changes that may affect existing code:

  • FileProcessingTrait::getFile() returns null instead of "File not found".
  • FileProcessingTrait::uploadFile() returns a random name. Code relying on the original filename appearing in the stored name needs updating.
  • ConfigUtil::getAllSettings() no longer takes a second $key argument, and settings now live at config/settings.json on the default disk. Earlier releases never successfully persisted anything, so there is nothing to migrate.
  • ?per_page is capped at 100. Raise $maxPerPage if you need more.
  • The service provider is no longer publishable. Package auto-discovery already registers it.

If you have been running AccessLogMiddleware on authentication routes, treat the existing access_logs contents as compromised credentials and purge them. This release stops new passwords being written, but does not clean up what is already stored.

Tests

The suite grew from 179 to 234 tests.

XHelper, AccessLogMiddleware, and the Claude provider had no coverage at all. The CachingUtil, ConfigUtil, and SchedulerUtil suites were rewritten to exercise real stores, a real Storage::fake(), and a real Schedule, rather than mocks that could not disagree with the implementation. The previous ConfigUtil tests mocked Storage::put and asserted that nothing threw; the previous SchedulerUtil tests all used an empty schedule, which is the one case that never triggered the bug.

cd packages/omarchouman/lara-util-x
./vendor/bin/phpunit