A follow-up to 1.5.4 closing gaps that release left behind, including one regression it introduced. There are no new features.
1.5.4 redacted password and password_confirmation, but not current_password. That is the field Laravel Breeze's password-update form submits, so a password-change route still wrote the user's existing password into access_logs in plaintext.
current_password, new_password, new_password_confirmation, api_key, and client_secret are now excluded by default.
Request::except() only strips top-level keys, so a nested user[password] survived redaction unless the exclusion list happened to name user.password. Matching now applies at any depth, and is case-insensitive in both the body and the query string.
Dot-notation entries still work when you want to target one specific nested key rather than every key of that name. See Access Log Middleware.
A regression introduced in 1.5.4. Rewriting a unique rule on update rebuilt the segment from the table and column alone, discarding anything after the ignore-id slot:
before: required|unique:users,email,NULL,id,tenant_id,7
1.5.4: required|unique:users,email,5
1.5.5: required|unique:users,email,5,id,tenant_id,7Per-tenant uniqueness silently became global uniqueness. Only the ignore-id slot is replaced now.
getSetting() and setSetting() both accept dotted keys, but forgetSetting() used unset($settings['mail.from']), which cannot reach a nested key and silently did nothing. It now uses Arr::forget().
Without --model, the prune command only scans app/Models, so a model living in vendor/ is never discovered. The 1.5.4 documentation said access logs were pruned by php artisan model:prune, which was not true. The correct schedule is now documented:
Schedule::command('model:prune', [
'--model' => [\LaraUtilX\Models\AccessLog::class],
])->daily();--model limits that run to the models you list, so keep it separate from any prune schedule you already run for your own models.
Publishing a package class kept its LaraUtilX namespace while landing in app/, where Composer's PSR-4 mapping expects App\. The published copy was never autoloaded, so editing it had no effect and every call still resolved to the package.
Rather than ship parallel App\-namespaced stubs that would drift from the real classes, class publishing has been removed. Extend or wrap instead. Configuration, migrations, and the CRUD generator stubs remain publishable, since those are data rather than autoloaded classes.
Event::isDue() asks whether a cron expression matches the current minute, so the method reported "due now", not "overdue". An everyMinute() task made it true almost constantly. hasOverdueTasks() still works and delegates to the new name, but it is deprecated.
The Schedule bound in the container is only populated once the console kernel has booted, so calling SchedulerUtil from a web route returns an empty schedule rather than an error. This has always been true, on every supported Laravel version, and is now stated plainly in Scheduler.
The suite now runs in GitHub Actions on every push and pull request, across the full support matrix:
| Laravel | PHP |
|---|---|
| 10 | 8.1 |
| 11 | 8.2 |
| 12 | 8.3 |
| 13 | 8.4 |
Laravel 10 runs on PHP 8.1 so the package's declared floor is exercised rather than assumed. Each row runs the suite twice, once in declaration order and once in random order, to catch order-dependent tests.
lara-util-x-models, lara-util-x-api-response-trait, lara-util-x-validation-rules, and the per-utility tags. They produced copies that were never loaded, so removing them changes no runtime behaviour. lara-util-x-config, lara-util-x-feature-toggles, lara-util-x-migrations, and lara-util-x-stubs are unaffected.hasOverdueTasks() is deprecated in favour of hasDueTasks().AccessLogMiddleware on a password-change route, treat previously logged rows as containing live credentials.