chore(deps): update dependency laravel/framework to v13.30.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
laravel/framework (source)	13.29.0 → 13.30.0

---

Laravel: XSS in Debug Page Information

CVE-2026-102279 / GHSA-jh5r-qr3c-85q8

More information

Details

Impact

When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.

Patches

#​61381

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

References

• https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8
• https://nvd.nist.gov/vuln/detail/CVE-2026-102279
• https://github.com/laravel/framework/pull/61381
• https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
• https://github.com/laravel/framework/releases/tag/v12.69.0
• https://github.com/laravel/framework/releases/tag/v13.30.0
• https://github.com/advisories/GHSA-jh5r-qr3c-85q8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

laravel/framework (laravel/framework)

v13.30.0

Compare Source

• [12.x] Backport #​60908: Avoid quadratic wildcard rule expansion by @​matteo-palazzo in #​61232
• Fix resource loading by @​taylorotwell in #​61323
• [13.x] Output the worker stop reason in queue:work by @​jackbayliss in #​61339
• Fix incorrect $startTime type in Worker::stopIfNecessary docblock by @​il-m-tomita in #​61347
• [13.x] Ability to opt out of vendor/default commands in DevCommands by @​jackbayliss in #​61344
• [13.x] Confine Storage::path() to the configured disk root by @​KIKOmanasijev in #​61343
• [13.x] Support Microsoft SQL Server DSN connection strings by @​HenkPoley in #​61341
• [13.x] Restore the facade application after route:cache boots a fresh application by @​reiarseni in #​61346
• [13.x] Gracefully handle missing param value or strings with request clamps by @​kylemilloy in #​61355
• [13.x] Restore default database connection when seeding fails by @​sayful1411 in #​61354
• [13.x] Cloud enhancements by @​timacdonald in #​61360
• [13.x] Allow retrieving command by name without resolving all commands by @​timacdonald in #​61361
• [13.x] Expose methods by @​timacdonald in #​61362
• [13.x] Add basic test for query explain by @​imanghafoori1 in #​61363
• [13.x] Add totalXSize methods to Cloud Queue by @​jackbayliss in #​61352
• [13.x] Add chunkBy to collections by @​JosephSilber in #​61357
• [13.x] spl_object_id over hash by @​jackbayliss in #​61372
• [13.x] Add createPayloadUsing directly to the queue manager by @​jackbayliss in #​61367
• [13.x] Set visibility on files that only exist on a read-through disk's fallback by @​sulimanbenhalim in #​61375
• [12.x] Disable html by default on Laravel exception page tooltip by @​crynobone in #​61381

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.