ancongui · Oct 21, 2026 · Oct 21, 2026
diff --git a/.github/actions/build-docs/action.yml b/.github/actions/build-docs/action.yml
@@ -8,7 +8,7 @@ runs:
         python-version: '3.12'
     - uses: shivammathur/setup-php@v2
       with:
-        php-version: '8.4'
+        php-version: '8.5.12'
         coverage: none
     - name: Install rendering dependencies
       shell: bash

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php: [ '8.3', '8.4', '8.5' ]
+        php: [ '8.5.12' ]
     steps:
       - uses: actions/checkout@v4
       - name: Setup PHP
@@ -50,7 +50,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: '8.5.12'
           coverage: none
           tools: composer:v2
       - name: Install dependencies
@@ -141,7 +141,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: '8.5.12'
           coverage: none
           tools: composer:v2
           extensions: ${{ matrix.extensions }}
@@ -215,7 +215,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: '8.5.12'
           coverage: none
           tools: composer:v2
           extensions: rdkafka

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php: [ '8.3', '8.4', '8.5' ]
+        php: [ '8.5.12' ]
     steps:
       - uses: actions/checkout@v4
       - uses: shivammathur/setup-php@v2
@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: '8.5.12'
           coverage: none
           tools: composer:v2
       - run: composer install --no-interaction --prefer-dist

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,21 @@ All notable changes to LaraFly are documented here. This project uses CalVer (`Y
 
 ## [Unreleased]
 
+## [26.10.4] - 2026-10-21
+
+### Security
+
+- **PHP 8.5.12 is the required runtime.** The constraint moves from `^8.3` to `^8.5.12`, and CI runs on that
+  release. PHP 8.5.12 is the latest release that fixes CVE-2026-109618 and CVE-2026-109619 (PHP2Shell,
+  unauthenticated remote code execution). Advisories: https://www.php.net/archive/2026.php and
+  https://calif.io/php2shell/.
+
+### Changed
+
+- **Laravel 13.38 is the minimum.** `illuminate/*` and the skeleton's `laravel/framework` move from `^13.0`
+  to `^13.38`. Larastan moves from `~3.11.0` to `^3.13.0`, Orchestra Testbench from `^11.1` to `^11.3`,
+  Laravel Octane from `^2.0` to `^2.22`, and Laravel Pint from `^1.30` to `^1.32`.
+
 ## [26.10.3] - 2026-10-13
 
 ### Changed

diff --git a/README.md b/README.md
@@ -11,10 +11,10 @@
 <p align="center">
   <a href="https://github.com/fireflyframework/fireflyframework-php/actions/workflows/ci.yml"><img src="https://github.com/fireflyframework/fireflyframework-php/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
   <a href="https://github.com/fireflyframework"><img src="https://img.shields.io/badge/Firefly_Framework-official-ff6600" alt="Firefly Framework"></a>
-  <a href="docs/installation.md#requirements"><img src="https://img.shields.io/badge/php-8.3%2B-blue?logo=php&logoColor=white" alt="PHP 8.3+"></a>
+  <a href="docs/installation.md#requirements"><img src="https://img.shields.io/badge/php-8.5.12%2B-blue?logo=php&logoColor=white" alt="PHP 8.5.12+"></a>
   <a href="docs/laravel-comparison.md"><img src="https://img.shields.io/badge/Laravel-13-FF2D20?logo=laravel&logoColor=white" alt="Laravel 13"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-green" alt="License: Apache 2.0"></a>
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/version-26.10.3-brightgreen" alt="Version: 26.10.3"></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/version-26.10.4-brightgreen" alt="Version: 26.10.4"></a>
   <a href="docs/contributing.md#conventions"><img src="https://img.shields.io/badge/PHPStan-max-8A2BE2" alt="PHPStan: max"></a>
   <a href="pint.json"><img src="https://img.shields.io/badge/code%20style-Pint-F55247" alt="Code Style: Pint"></a>
 </p>
@@ -1011,7 +1011,7 @@ set, no CDN request, no npm step, and it still renders in an air-gapped or stric
 
 ## Installation
 
-**Requirements:** PHP 8.3+ (8.4 recommended), Composer 2, and an existing (or new) Laravel 13 application —
+**Requirements:** PHP 8.5.12+, Composer 2, and an existing (or new) Laravel 13.38 application —
 LaraFly layers onto Laravel, it is not a standalone runtime. Full details in
 [Installation](docs/installation.md).
 
@@ -1216,9 +1216,9 @@ model across every runtime:
 
 | Requirement | Version |
 |---|---|
-| PHP | 8.3+ (8.4 recommended) |
+| PHP | 8.5.12+ |
 | Composer | 2.x |
-| Laravel | 13 |
+| Laravel | 13.38+ |
 | Git | for cloning and for `firefly new`'s optional `git init` |
 
 ---

diff --git a/book/src-es/00-front/00-copyright.md b/book/src-es/00-front/00-copyright.md
@@ -8,7 +8,7 @@ Salvo que lo exija la ley aplicable o se acuerde por escrito, el software y la d
 
 **Primera edición.**
 
-Cada listado de código de este libro procede del propio código fuente del framework LaraFly o de `samples/lumen`, la aplicación de monedero digital y libro mayor que se distribuye junto al monorepo del framework como acompañante, y se ha verificado que compila de forma limpia con un compilador PHP 8.3+ real: nada aquí es pseudocódigo ilustrativo.
+Cada listado de código de este libro procede del propio código fuente del framework LaraFly o de `samples/lumen`, la aplicación de monedero digital y libro mayor que se distribuye junto al monorepo del framework como acompañante, y se ha verificado que compila de forma limpia con un compilador PHP 8.5.12+ real: nada aquí es pseudocódigo ilustrativo.
 
 "LaraFly" es el nombre de trabajo del port a PHP-sobre-Laravel del Firefly Framework. "Laravel" es una marca registrada de Taylor Otwell; esta es una obra independiente y no está afiliada ni respaldada por el proyecto Laravel.
 

diff --git a/book/src-es/00-front/00-preface.md b/book/src-es/00-front/00-preface.md
@@ -2,7 +2,7 @@
 
 El PHP empresarial ha significado durante mucho tiempo ensamblar un contenedor de servicios de un paquete, un enrutador de otro, un validador de un tercero y un despachador de eventos de un cuarto — cada uno con su propio idioma de configuración, sus propias convenciones, su propia manera de decir "inyecta esto". Laravel resolvió gran parte de esa fragmentación para las aplicaciones web, pero el PHP hexagonal y orientado a servicios — inyección de dependencias basada en atributos, transacciones declarativas, CQRS, arquitectura orientada a eventos, seguridad a nivel de método, observabilidad de producción — ha seguido siendo cuestión de gustos, convenciones de nombres de carpetas y pegamento hecho a mano.
 
-**LaraFly** cambia eso. Lleva a PHP 8.3+ y Laravel 13 la experiencia cohesionada de convención sobre configuración que Spring Boot dio al mundo Java, construida *sobre* Laravel en lugar de en su lugar: el mismo Eloquent, el mismo contenedor de servicios, el mismo `artisan`, ahora organizados mediante atributos de PHP 8 en componentes con estereotipo, un grafo de dependencias compilado y una tubería de arranque determinista.
+**LaraFly** cambia eso. Lleva a PHP 8.5.12+ y Laravel 13.38 la experiencia cohesionada de convención sobre configuración que Spring Boot dio al mundo Java, construida *sobre* Laravel en lugar de en su lugar: el mismo Eloquent, el mismo contenedor de servicios, el mismo `artisan`, ahora organizados mediante atributos de PHP 8 en componentes con estereotipo, un grafo de dependencias compilado y una tubería de arranque determinista.
 
 Este libro enseña LaraFly **con ejemplos**. Cada listado de estas páginas no es pseudocódigo ilustrativo: está tomado del propio código fuente distribuido del framework o de `samples/lumen`, una aplicación real y en funcionamiento de monedero digital y libro mayor que se distribuye en el monorepo del framework, que compila, arranca y supera su propia batería de pruebas. Lo que lees es lo que realmente funciona.
 

diff --git a/book/src-es/00-quickstart.md b/book/src-es/00-quickstart.md
@@ -15,7 +15,7 @@ Esto es un *recorrido*, no la inmersión profunda. El Capítulo 1 argumenta el e
 
 LaraFly es un framework PHP construido sobre Laravel 13. Necesitas:
 
-* **PHP 8.3 o más reciente**, con las extensiones que el propio Laravel requiere (`mbstring`, `openssl`, `pdo`, `tokenizer`, `xml`, `ctype`, `json`).
+* **PHP 8.5.12 o más reciente**, con las extensiones que el propio Laravel requiere (`mbstring`, `openssl`, `pdo`, `tokenizer`, `xml`, `ctype`, `json`).
 * **Composer 2**, el gestor de dependencias de PHP.
 
 Confirma que ambos están disponibles:
@@ -59,10 +59,10 @@ El `composer.json` del andamiaje requiere la biblioteca principal y declara un r
 
 ```json
 "require": {
-    "php": "^8.3",
+    "php": "^8.5.12",
     "firefly/cli": "*@dev",
     "fireflyframework/larafly": "*@dev",
-    "laravel/framework": "^13.0"
+    "laravel/framework": "^13.38"
 }
 ```
 

diff --git a/book/src/00-front/00-copyright.md b/book/src/00-front/00-copyright.md
@@ -8,7 +8,7 @@ Unless required by applicable law or agreed to in writing, software and document
 
 **First edition.**
 
-Every code listing in this book is drawn from the LaraFly framework's own source or from `samples/lumen`, the companion digital-wallet-and-ledger application shipped in the framework's monorepo, and is verified to lint cleanly against a real PHP 8.3+ toolchain — nothing here is illustrative pseudocode.
+Every code listing in this book is drawn from the LaraFly framework's own source or from `samples/lumen`, the companion digital-wallet-and-ledger application shipped in the framework's monorepo, and is verified to lint cleanly against a real PHP 8.5.12+ toolchain — nothing here is illustrative pseudocode.
 
 "LaraFly" is the working name for the Firefly Framework's PHP-on-Laravel port. "Laravel" is a trademark of Taylor Otwell; this is an independent work and is not affiliated with or endorsed by the Laravel project.
 

diff --git a/book/src/00-front/00-preface.md b/book/src/00-front/00-preface.md
@@ -2,7 +2,7 @@
 
 Enterprise PHP has long meant assembling a service container from one package, a router from another, a validator from a third, and an event dispatcher from a fourth — each with its own configuration idiom, its own conventions, its own way of saying "inject this." Laravel solved a great deal of that fragmentation for web applications, but hexagonal, service-oriented PHP — attribute-driven dependency injection, declarative transactions, CQRS, event-driven architecture, method-level security, production observability — has stayed a matter of taste, folder-naming conventions, and hand-rolled glue.
 
-**LaraFly** changes that. It brings the cohesive, convention-over-configuration experience Spring Boot gave the Java world to PHP 8.3+ and Laravel 13, built *on* Laravel rather than instead of it: the same Eloquent, the same service container, the same `artisan`, now organized by PHP 8 attributes into stereotyped components, a compiled dependency graph, and a deterministic boot pipeline.
+**LaraFly** changes that. It brings the cohesive, convention-over-configuration experience Spring Boot gave the Java world to PHP 8.5.12+ and Laravel 13.38, built *on* Laravel rather than instead of it: the same Eloquent, the same service container, the same `artisan`, now organized by PHP 8 attributes into stereotyped components, a compiled dependency graph, and a deterministic boot pipeline.
 
 This book teaches LaraFly **by example**. Every listing in these pages is not illustrative pseudocode — it is lifted from the framework's own shipped source or from `samples/lumen`, a real, running digital-wallet-and-ledger application that ships in the framework's monorepo, compiles, boots, and passes its own test suite. What you read is what actually works.
 

diff --git a/book/src/00-quickstart.md b/book/src/00-quickstart.md
@@ -15,7 +15,7 @@ This is a *tour*, not the deep dive. Chapter 1 makes the case for the whole appr
 
 LaraFly is a PHP framework built on Laravel 13. You need:
 
-* **PHP 8.3 or newer**, with the extensions Laravel itself requires (`mbstring`, `openssl`, `pdo`, `tokenizer`, `xml`, `ctype`, `json`).
+* **PHP 8.5.12 or newer**, with the extensions Laravel itself requires (`mbstring`, `openssl`, `pdo`, `tokenizer`, `xml`, `ctype`, `json`).
 * **Composer 2**, PHP's dependency manager.
 
 Confirm both are available:
@@ -59,10 +59,10 @@ The skeleton's `composer.json` requires the root library and records a CLI compo
 
 ```json
 "require": {
-    "php": "^8.3",
+    "php": "^8.5.12",
     "firefly/cli": "*@dev",
     "fireflyframework/larafly": "*@dev",
-    "laravel/framework": "^13.0"
+    "laravel/framework": "^13.38"
 }
 ```
 

diff --git a/composer.json b/composer.json
@@ -4,28 +4,28 @@
     "type": "library",
     "license": "Apache-2.0",
     "require": {
-        "php": "^8.3",
+        "php": "^8.5.12",
         "ext-openssl": "*",
         "firebase/php-jwt": "^7.0",
         "guzzlehttp/promises": "^2.0 || ^3.0",
-        "illuminate/auth": "^13.0",
-        "illuminate/bus": "^13.0",
-        "illuminate/cache": "^13.0",
-        "illuminate/config": "^13.0",
-        "illuminate/console": "^13.0",
-        "illuminate/container": "^13.0",
-        "illuminate/contracts": "^13.0",
-        "illuminate/cookie": "^13.0",
-        "illuminate/database": "^13.0",
-        "illuminate/events": "^13.0",
-        "illuminate/http": "^13.0",
-        "illuminate/log": "^13.0",
-        "illuminate/queue": "^13.0",
-        "illuminate/routing": "^13.0",
-        "illuminate/session": "^13.0",
-        "illuminate/support": "^13.0",
-        "illuminate/translation": "^13.0",
-        "illuminate/validation": "^13.0",
+        "illuminate/auth": "^13.38",
+        "illuminate/bus": "^13.38",
+        "illuminate/cache": "^13.38",
+        "illuminate/config": "^13.38",
+        "illuminate/console": "^13.38",
+        "illuminate/container": "^13.38",
+        "illuminate/contracts": "^13.38",
+        "illuminate/cookie": "^13.38",
+        "illuminate/database": "^13.38",
+        "illuminate/events": "^13.38",
+        "illuminate/http": "^13.38",
+        "illuminate/log": "^13.38",
+        "illuminate/queue": "^13.38",
+        "illuminate/routing": "^13.38",
+        "illuminate/session": "^13.38",
+        "illuminate/support": "^13.38",
+        "illuminate/translation": "^13.38",
+        "illuminate/validation": "^13.38",
         "monolog/monolog": "^3.0",
         "open-feature/sdk": "^2.3",
         "php-amqplib/php-amqplib": "^3.7",
@@ -40,13 +40,13 @@
     "require-dev": {
         "deptrac/deptrac": "^4.6",
         "kwn/php-rdkafka-stubs": "^2.2",
-        "larastan/larastan": "~3.11.0",
-        "laravel/octane": "^2.0",
-        "laravel/pint": "^1.30",
+        "larastan/larastan": "^3.13.0",
+        "laravel/octane": "^2.22",
+        "laravel/pint": "^1.32",
         "open-telemetry/api": "^1.3",
         "open-telemetry/exporter-otlp": "^1.3",
         "open-telemetry/sdk": "^1.6",
-        "orchestra/testbench": "^11.1",
+        "orchestra/testbench": "^11.3",
         "pestphp/pest": "^4.5",
         "pestphp/pest-plugin-browser": "^4.3",
         "phpstan/phpstan": "^2.1",
@@ -228,12 +228,12 @@
     "suggest": {
         "ext-pdo_pgsql": "Required to use the PostgreSQL event transport (firefly.eda.provider=postgres).",
         "ext-rdkafka": "Required ONLY to activate the Kafka adapter (firefly.eda.provider=kafka). Needs librdkafka >= 1.5.3. Absent = the adapter is inert; the default gate + non-Kafka consumers never need it.",
-        "illuminate/testing": "^13.0 for the Firefly testing helpers; install with --dev.",
+        "illuminate/testing": "^13.38 for the Firefly testing helpers; install with --dev.",
         "open-telemetry/api": "The OpenTelemetry API — required with open-telemetry/sdk for the OpenTelemetryTracer adapter (firefly.observability.tracing.enabled).",
         "open-telemetry/exporter-otlp": "OTLP span export over http/protobuf or http/json (firefly.observability.tracing.exporter=otlp).",
         "open-telemetry/sdk": "The OpenTelemetry SDK (TracerProvider, samplers, console exporter) behind OpenTelemetryTracer.",
         "open-telemetry/transport-grpc": "OTLP export over gRPC (firefly.observability.tracing.otlp.protocol=grpc; needs ext-grpc).",
-        "orchestra/testbench": "^11.1 for FireflyTestCase and Laravel test applications; install with --dev.",
+        "orchestra/testbench": "^11.3 for FireflyTestCase and Laravel test applications; install with --dev.",
         "symfony/var-dumper": "What dd() and dump() are built on; the package registers a caster so a dumped ClientRegistration shows its client secret masked (laravel/framework already requires it).",
         "testcontainers/testcontainers": "Ephemeral Docker backends for @group integration tests (fireflyConfigFor())."
     },

diff --git a/docs/architecture.md b/docs/architecture.md
@@ -53,7 +53,7 @@ table, your own bean wins regardless of which provider Laravel instantiated firs
   `tests/VersionConsistencyTest.php` checks it against the CHANGELOG's latest heading and the README's
   version badge, so the three cannot drift apart.
 
-Its `composer.json` requires nothing but `php: ^8.3`, and no file under `packages/kernel/src` imports
+Its `composer.json` requires nothing but `php: ^8.5.12`, and no file under `packages/kernel/src` imports
 `Illuminate\*` or `Symfony\*`. That is what makes it safe for a domain package to reuse the exception
 taxonomy without acquiring a framework dependency — and it is the reason `deptrac.yaml` can write the
 `Kernel` layer's rule as `~`.

diff --git a/docs/getting-started.md b/docs/getting-started.md
@@ -59,16 +59,16 @@ php artisan firefly:serve
 ## The library and component requirement
 
 `firefly/skeleton` is itself a `type: project` create-project template rather than something you require, and
-its `composer.json` asks for the library and a CLI component requirement beside `php: ^8.3` and `laravel/framework: ^13.0`:
+its `composer.json` asks for the library and a CLI component requirement beside `php: ^8.5.12` and `laravel/framework: ^13.38`:
 
 <!-- source: skeleton/composer.json -->
 
 ```json
 "require": {
-    "php": "^8.3",
+    "php": "^8.5.12",
     "firefly/cli": "*@dev",
     "fireflyframework/larafly": "*@dev",
-    "laravel/framework": "^13.0"
+    "laravel/framework": "^13.38"
 },
 ```
 

diff --git a/docs/installation.md b/docs/installation.md
@@ -2,9 +2,9 @@
 
 ## Requirements
 
-- **PHP 8.3+** (8.4 recommended).
+- **PHP 8.5.12+**.
 - **Composer 2.**
-- **Laravel 13** — LaraFly is a Composer library that layers onto a Laravel application; it is not a
+- **Laravel 13.38+** — LaraFly is a Composer library that layers onto a Laravel application; it is not a
   standalone runtime.
 
 ## Quick install

diff --git a/docs/publishing.md b/docs/publishing.md
@@ -55,7 +55,7 @@ application, requires every component name, boots and compiles a real route, run
 installs the Lumen consumer through a copied root path repository, and rejects an incompatible component
 version. Its package repositories exclude `firefly/*` from Packagist so a mirror cannot mask a missing
 replacement. The consumer directories are retained under the system temporary directory for inspection.
-CI runs these package checks on PHP 8.3, 8.4 and 8.5 for PRs to `main` and pushes to `main`.
+CI runs these package checks on PHP 8.5.12 for PRs to `main` and pushes to `main`.
 
 ## First publication and later releases
 
@@ -67,7 +67,7 @@ CI runs these package checks on PHP 8.3, 8.4 and 8.5 for PRs to `main` and pushe
    `https://github.com/fireflyframework/fireflyframework-php` and enable the repository webhook. This is a
    one-time publisher action; subsequent releases use tags from this same repository.
 5. Push the new release tag. **Release (single package)** validates the tagged distribution on PHP
-   8.3, 8.4 and 8.5, waits for Packagist's Composer metadata (`repo.packagist.org/p2/…`) to list that exact
+   8.5.12, waits for Packagist's Composer metadata (`repo.packagist.org/p2/…`) to list that exact
    commit for the tag, then installs it in a fresh stable
    consumer without custom repositories and exercises the bundled installer. Only after those checks
    pass does its final job build both books and create the GitHub release from the changelog with the
@@ -81,7 +81,7 @@ CI runs these package checks on PHP 8.3, 8.4 and 8.5 for PRs to `main` and pushe
 To repeat the public install check locally:
 
 ```bash
-RELEASE_TAG=v26.10.3 RELEASE_SHA="$(git rev-parse 'v26.10.3^{commit}')" php scripts/check-package-install.php --published
+RELEASE_TAG=v26.10.4 RELEASE_SHA="$(git rev-parse 'v26.10.4^{commit}')" php scripts/check-package-install.php --published
 ```
 
 An unmerged branch or a local consumer check is not a published release.