laravel/passport

• [13.x] Clarify grant_types migration is required for integer-based cl… by @jaapredeker in #1913
• Pin GitHub Actions to commit SHAs and add Dependabot config by @joetannenbaum in #1915
• Bump shivammathur/setup-php from 2.37.0 to 2.37.1 in the github-actions group by @dependabot[bot] in #1921
• Add Dependabot cooldown of 5 days by @nunomaduro in #1922
• Enable Dependabot auto-merge by @nunomaduro in #1928
• Bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions group by @dependabot[bot] in #1931
• Bump shivammathur/setup-php from 2.37.1 to 2.37.2 in the github-actions group by @dependabot[bot] in #1933
• Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @dependabot[bot] in #1935
• Fix enum support for database connection name by @rickgoemans in #1936
• Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group by @dependabot[bot] in #1937

• [13.x] Clarify grant_types migration is required for integer-based cl… by @jaapredeker in https://github.com/laravel/passport/pull/1913
• Pin GitHub Actions to commit SHAs and add Dependabot config by @joetannenbaum in https://github.com/laravel/passport/pull/1915
• Bump shivammathur/setup-php from 2.37.0 to 2.37.1 in the github-actions group by @dependabot[bot] in https://github.com/laravel/passport/pull/1921
• Add Dependabot cooldown of 5 days by @nunomaduro in https://github.com/laravel/passport/pull/1922
• Enable Dependabot auto-merge by @nunomaduro in https://github.com/laravel/passport/pull/1928
• Bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions group by @dependabot[bot] in https://github.com/laravel/passport/pull/1931
• Bump shivammathur/setup-php from 2.37.1 to 2.37.2 in the github-actions group by @dependabot[bot] in https://github.com/laravel/passport/pull/1933
• Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @dependabot[bot] in https://github.com/laravel/passport/pull/1935
• Fix enum support for database connection name by @rickgoemans in https://github.com/laravel/passport/pull/1936
• Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group by @dependabot[bot] in https://github.com/laravel/passport/pull/1937

• Add notice of invalid tokens when user and client id match by @Levivb in #1910
• Clarify that running passport:hash is not optional by @bram-pkg in #1911

• Add notice of invalid tokens when user and client id match by @Levivb in https://github.com/laravel/passport/pull/1910
• Clarify that running passport:hash is not optional by @bram-pkg in https://github.com/laravel/passport/pull/1911

• [13.x] Support space-delimited prompt parameter by @hafezdivandari in #1906

• [13.x] Support space-delimited prompt parameter by @hafezdivandari in https://github.com/laravel/passport/pull/1906

• [13.x] Fix session JSON serialization by @hafezdivandari in #1905

• [13.x] Fix session JSON serialization by @hafezdivandari in https://github.com/laravel/passport/pull/1905

• [13.X] fix: resolve user as null when user ID matches client ID on integer key setups by @Can-Kar in #1902

• [13.X] fix: resolve user as null when user ID matches client ID on integer key setups by @Can-Kar in https://github.com/laravel/passport/pull/1902

This change permanently invalidates client credential tokens for any user whose user ID happens to match the client ID of the token issuer.

• Prevent user impersonation via client credentials token by @pushpak1300 in #1901

• Prevent user impersonation via client credentials token by @pushpak1300 in https://github.com/laravel/passport/pull/1901

• [13.x] Add middleware attribute by @axlon in #1897

• [13.x] Add middleware attribute by @axlon in https://github.com/laravel/passport/pull/1897

• Add Boost skill for Passport development by @pushpak1300 in #1893

• Add Boost skill for Passport development by @pushpak1300 in https://github.com/laravel/passport/pull/1893

• Add mixin annotation for Token model in AccessToken by @fjkorf in #1886
• Add dedicated token lifetime for client credentials grant by @sajanp in #1880
• Add missing OAuthenticatable interface step to upgrade guide by @FeBe95 in #1887
• Improve code syntax highlighting in upgrade guide by @FeBe95 in #1890
• Allow custom middleware to be registered by @timacdonald in #1892
• Update UPGRADE.md by @siarheipashkevich in #1891

• Add mixin annotation for Token model in AccessToken by @fjkorf in https://github.com/laravel/passport/pull/1886
• Add dedicated token lifetime for client credentials grant by @sajanp in https://github.com/laravel/passport/pull/1880
• Add missing OAuthenticatable interface step to upgrade guide by @FeBe95 in https://github.com/laravel/passport/pull/1887
• Improve code syntax highlighting in upgrade guide by @FeBe95 in https://github.com/laravel/passport/pull/1890
• Allow custom middleware to be registered by @timacdonald in https://github.com/laravel/passport/pull/1892
• Update UPGRADE.md by @siarheipashkevich in https://github.com/laravel/passport/pull/1891

• [13.x] Supports Laravel 13 by @crynobone in https://github.com/laravel/passport/pull/1885
• [13.x] Add can and cant methods to Token model by @hafezdivandari in https://github.com/laravel/passport/pull/1882

• [13.x] Allow firebase/php-jwt v7 by @hafezdivandari in https://github.com/laravel/passport/pull/1879

• [13.x] PHP 8.5 Compatibility by @crynobone in https://github.com/laravel/passport/pull/1869
• Remove the usage of deprecated $request->get() by @hivokas in https://github.com/laravel/passport/pull/1873
• [13.x] Allow setting the client with Passport::actingAs() by @axlon in https://github.com/laravel/passport/pull/1876

• [13.x] Fix possible 500 error when retrieving user on token guard by @hafezdivandari in https://github.com/laravel/passport/pull/1871

• [13.x] Add static setter for authorizationServerResponseType by @RSpeekenbrink in https://github.com/laravel/passport/pull/1867

• chore(UPGRADE): v13, update oauth_clients table schema changes by @maximepvrt in https://github.com/laravel/passport/pull/1865
• feat: Allow findForPassport to optionally receive the OAuth client by @maximepvrt in https://github.com/laravel/passport/pull/1866

• Fix »OAuth Client Table Changes« migration snippet in the upgrade guide by @hettiger in https://github.com/laravel/passport/pull/1859
• [13.x] Fix accessing the plain secret after creating a new confidential client via deprecated ClientController::store by @hafezdivandari in https://github.com/laravel/passport/pull/1861

• [13.x] add trailing commas in multiline constructor signatures by @browner12 in https://github.com/laravel/passport/pull/1848
• Update Client Model by @samsin33 in https://github.com/laravel/passport/pull/1850
• [13.x] Test Improvements by @hafezdivandari in https://github.com/laravel/passport/pull/1853
• [13.x] Fix issuing PAT with configured trusted hosts by @hafezdivandari in https://github.com/laravel/passport/pull/1852

• [13.x] Added device code grant exception to purge command by @SuperDJ in https://github.com/laravel/passport/pull/1846

• [13.x] Add an option to disable device code grant by @hafezdivandari in https://github.com/laravel/passport/pull/1842
• [13.x] Add an upgrade guide entry for key file permissions by @hafezdivandari in https://github.com/laravel/passport/pull/1841
• [13.x] Fallback to list of auth user providers if no auth guard for Passport is defined by @hafezdivandari in https://github.com/laravel/passport/pull/1840
• [13.x] Add an optional migration for oauth_clients table to the upgrade guide by @hafezdivandari in https://github.com/laravel/passport/pull/1843
• Fix viewPrefix Method to Match Documentation Example by @trippo in https://github.com/laravel/passport/pull/1844

• [13.x] Fix broken token relation when auth identifier is not PK by @axlon in https://github.com/laravel/passport/pull/1835

• [13.x] Fix Exception Caused by Missing AccessToken Attributes by @hafezdivandari in https://github.com/laravel/passport/pull/1829

• [13.x] Fix skipping authorization consent when no scopes are requested by @hafezdivandari in https://github.com/laravel/passport/pull/1825
• [13.x] Document changes to oauth_clients table in upgrade guide by @gdebrauwer in https://github.com/laravel/passport/pull/1823

• [13.x] Fix object returned by mocked validateAuthenticatedRequest() method in Passport::actingAsClient() method by @gdebrauwer in https://github.com/laravel/passport/pull/1822

• Changed getTokenFromRequest method to handle null value and prevent type error by @eldair in https://github.com/laravel/passport/pull/1819
• fix: possible php error if redirect column is an empty string by @Tofandel in https://github.com/laravel/passport/pull/1821

• [13.x] Fix access to undefined route by @axlon in https://github.com/laravel/passport/pull/1812
• [13.x] Fix access to uninitialised typed static property by @owenvoke in https://github.com/laravel/passport/pull/1811
• Use isset to check for initialisation by @patrickomeara in https://github.com/laravel/passport/pull/1813
• [13.x] Fix middleware type error by @axlon in https://github.com/laravel/passport/pull/1815

• [13.x] Support OAuth2 Server v9 by @hafezdivandari in https://github.com/laravel/passport/pull/1734
• [13.x] Always hash client secret by @hafezdivandari in https://github.com/laravel/passport/pull/1745
• [13.x] Remove redundant PAT client table and model by @hafezdivandari in https://github.com/laravel/passport/pull/1749
• [13.x] Fix determining revoked records by @hafezdivandari in https://github.com/laravel/passport/pull/1751
• [13.x] Use the oauth_scopes property of the bearer token on TokenGuard by @hafezdivandari in https://github.com/laravel/passport/pull/1755
• [13.x] Refactor migrations by @hafezdivandari in https://github.com/laravel/passport/pull/1759
• [13.x] Cleanup by @hafezdivandari in https://github.com/laravel/passport/pull/1758
• [13.x] Use unique IDs on client model by @hafezdivandari in https://github.com/laravel/passport/pull/1757
• [13.x] Force confidential PAT client by @hafezdivandari in https://github.com/laravel/passport/pull/1761
• [13.x] Fix register a custom rendering closure for OAuthServerException by @hafezdivandari in https://github.com/laravel/passport/pull/1763
• [13.x] Use UUID to identify clients by default by @hafezdivandari in https://github.com/laravel/passport/pull/1764
• [13.x] Disable PAT requests by @hafezdivandari in https://github.com/laravel/passport/pull/1766
• [13.x] Cleanup and add feature tests by @hafezdivandari in https://github.com/laravel/passport/pull/1767
• [13.x] Always validate auth token by @hafezdivandari in https://github.com/laravel/passport/pull/1769
• [13.x] Configure the user provider for PAT by @hafezdivandari in https://github.com/laravel/passport/pull/1768
• [13.x] Fix user-token relations by @hafezdivandari in https://github.com/laravel/passport/pull/1773
• [13.x] Make client RFC compatible by @hafezdivandari in https://github.com/laravel/passport/pull/1744
• [13.x] Fix skipping consent prompt by @hafezdivandari in https://github.com/laravel/passport/pull/1777
• [13.x] Improve issuing PATs by @hafezdivandari in https://github.com/laravel/passport/pull/1780
• [13.x] Fix clients confidentiality by @hafezdivandari in https://github.com/laravel/passport/pull/1782
• [13.x] Make Passport headless (Support Laravel Jetstream and Breeze) by @hafezdivandari in https://github.com/laravel/passport/pull/1771
• [13.x] Improve performance, fix minor bugs, and add tests by @hafezdivandari in https://github.com/laravel/passport/pull/1783
• bug: mockery not setup correctly by @JimTools in https://github.com/laravel/passport/pull/1785
• [13.x] Cleanup, improve types and tests by @hafezdivandari in https://github.com/laravel/passport/pull/1788
• [13.x] Enhance error responses by @hafezdivandari in https://github.com/laravel/passport/pull/1791
• [13.x] Rename CheckClientCredentials middleware by @hafezdivandari in https://github.com/laravel/passport/pull/1792
• [13.x] Improve resolving and converting PSR responses by @hafezdivandari in https://github.com/laravel/passport/pull/1793
• [13.x] Deprecate JSON API by @hafezdivandari in https://github.com/laravel/passport/pull/1778
• [13.x] Add new EnsureClientIsResourceOwner middleware by @hafezdivandari in https://github.com/laravel/passport/pull/1794
• [13.x] Make revoking refresh tokens optional by @hafezdivandari in https://github.com/laravel/passport/pull/1790
• [13.x] Validate key files' permissions by @hafezdivandari in https://github.com/laravel/passport/pull/1789
• [13.x] Determine if the client handles the specified grant by @hafezdivandari in https://github.com/laravel/passport/pull/1762
• [13.x] Device Authorization Grant RFC8628 by @hafezdivandari in https://github.com/laravel/passport/pull/1750
• [13.x] Release Passport 13.x by @hafezdivandari in https://github.com/laravel/passport/pull/1797

• Fix firebase/php jwt vuln by @jszoja in #1889

• [12.x] Update property annotation for $userId to match constructor type by @ukkok in https://github.com/laravel/passport/pull/1805

• Supports Laravel 12 by @crynobone in https://github.com/laravel/passport/pull/1803

• [12.x] Supports PHP 8.4 by @crynobone in https://github.com/laravel/passport/pull/1799

• Update logo to support dark/light theme by @milewski in https://github.com/laravel/passport/pull/1787
• Fix repeated word "the" in upgrade guide by @caendesilva in https://github.com/laravel/passport/pull/1798

• [12.x] Add access token revoked event by @axlon in https://github.com/laravel/passport/pull/1776

• [12.x] Fix purge command by @hafezdivandari in https://github.com/laravel/passport/pull/1772

• [12.x] Add refreshToken relation to Token model by @gdebrauwer in https://github.com/laravel/passport/pull/1739

• [12.x] Make Passport's database connection configurable by @axlon in https://github.com/laravel/passport/pull/1738

• Adjust newFactory method visibility by @brandonfarber in https://github.com/laravel/passport/pull/1735

• [12.x] Make commands lazy by @timacdonald in https://github.com/laravel/passport/pull/1731
• [12.x] Allow token "expires in" to be defined as date interval by @jacobmllr95 in https://github.com/laravel/passport/pull/1733

• [12.x] Cast session lifetime to int by @kindslayer in https://github.com/laravel/passport/pull/1727
• [12.x] Fixes used version of L9 by @nunomaduro in https://github.com/laravel/passport/pull/1730

• [12.x] Adds Laravel 11 support by @nunomaduro in https://github.com/laravel/passport/pull/1702
• [12.x] Disable password grant by default by @hafezdivandari in https://github.com/laravel/passport/pull/1715
• [12.x] Make Client::$plainSecret public by @axlon in https://github.com/laravel/passport/pull/1719
• [12.x] Use more secure key permissions by @axlon in https://github.com/laravel/passport/pull/1721
• [12.x] Enhance console commands by @hafezdivandari in https://github.com/laravel/passport/pull/1724

• Check that properties grant_types and scopes exist by @uintaam in https://github.com/laravel/passport/pull/1722

• [11.x] Fix getting/setting client scopes and grant types by @axlon in https://github.com/laravel/passport/pull/1717

• Consistently retrieve client uuids value from Passport by @rojtjo in https://github.com/laravel/passport/pull/1711
• [11.x] Allow developers to disable the password grant type by @axlon in https://github.com/laravel/passport/pull/1712

• Add getScopesAttribute and getScopesAttribute methods by @uintaam in https://github.com/laravel/passport/pull/1709

• [11.x] Allow unsetting a user's access token by @axlon in https://github.com/laravel/passport/pull/1698
• [11.x] Add getGrantTypesAttribute method to fix Eloquent strict mode error by @gdebrauwer in https://github.com/laravel/passport/pull/1705

• [11.x] Named static methods for middleware by @michaelnabil230 in https://github.com/laravel/passport/pull/1695
• Simplify Conditional Statement by @michaelnabil230 in https://github.com/laravel/passport/pull/1696

• Add return to revokeRefreshTokensByAccessTokenId method by @aminkhoshzahmat in https://github.com/laravel/passport/pull/1693

• [11.x] Allow scope repository to be constructed without parameters by @axlon in https://github.com/laravel/passport/pull/1686

• [11.x] Add the ability to limit scopes by client by @axlon in https://github.com/laravel/passport/pull/1682
• [11.x] Add support for inherited scopes when limiting scopes on clients by @axlon in https://github.com/laravel/passport/pull/1683

• Add generics to client factory by @axlon in https://github.com/laravel/passport/pull/1669
• Update composer.json by @Smoggert in https://github.com/laravel/passport/pull/1674
• Update composer.json by @drhoussem in https://github.com/laravel/passport/pull/1677

• Revert "[11.x] Add Provider Guard to ClientRepository for Personal Access Clients" by @driesvints in https://github.com/laravel/passport/pull/1658

• Add Provider Guard to ClientRepository for Personal Access Clients by @michaelnabil230 in https://github.com/laravel/passport/pull/1655

• Allow lcobucci/jwt v5 and cleaned up version constraints by @GrahamCampbell in https://github.com/laravel/passport/pull/1649
• Pass user identifier through to finalize scopes in personal access grant by @GrahamCampbell in https://github.com/laravel/passport/pull/1650

• Removed deprecated dates property from RefreshToken model by @siarheipashkevich in https://github.com/laravel/passport/pull/1645
• Removed deprecated dates property from AuthCode model by @siarheipashkevich in https://github.com/laravel/passport/pull/1644
• Fix doc block types by @hafezdivandari in https://github.com/laravel/passport/pull/1647

• Allow overriding the AccessToken class by @hafezdivandari in https://github.com/laravel/passport/pull/1638
• Make $userId nullable in ClientRepository->createPersonalAccessClient by @bram-pkg in https://github.com/laravel/passport/pull/1642

• Re-apply "Added AuthenticationException to extend the behaviour of Laravel's default exception handler" by @driesvints in https://github.com/laravel/passport/commit/67c3e336af163f6eba5dbca8e5db46275ff0e433

• Revert "Move AuthenticationException into the scope of Laravel Passport" by @driesvints in https://github.com/laravel/passport/commit/db543b0cc13ed3f56f1bffda04707fbe2a8c7ab5

• Move AuthenticationException into the scope of Laravel Passport by @chrispage1 in https://github.com/laravel/passport/pull/1633
• Custom authorization view response by @JonErickson in https://github.com/laravel/passport/pull/1629
• Fix deprecated $dates property by @TonyWong9527 in https://github.com/laravel/passport/pull/1636

Added

• Add support for EncryptCookies middleware by @axlon in https://github.com/laravel/passport/pull/1628

Changed

• Indicate current token can be TransientToken by @axlon in https://github.com/laravel/passport/pull/1627

Changed

• Update ClientCommand.php's user_id description by @Smoggert in https://github.com/laravel/passport/pull/1619
• Get model PK instead of forcibly id column by @lucaspanik in https://github.com/laravel/passport/pull/1626

Fixed

• Fix doc block for withAccessToken() by @axlon in https://github.com/laravel/passport/pull/1620