Laravel Livewire Wizard Laravel Package

Fix

CI run-tests was failing on every push since the initial release: the htmlContent() test macro (tests/TestSupport/TestCase.php) hardcoded a \n → \r\n replace on rendered HTML before comparing against snapshot fixtures, which are stored with LF line endings. This always mismatched on Linux CI runners.

Removed the forced CRLF conversion — DOMDocument::saveHTML() already emits LF consistently, matching the committed fixtures.

Security fix

allStepsState, allStepNames, wizardClassName, stateClassName (StepComponent) and allStepState, currentStepName (WizardComponent) were public Livewire properties without #[Locked]. A client could rewrite other steps' committed data (e.g. via $wire.set('allStepsState.step.field', value)) before final submission, bypassing per-step validation.

Fixed by adding #[Locked] to these properties, blocking client-side writes while preserving normal server-side mount/hydrate behavior.

CI hardening: pin all GitHub Actions to commit SHA instead of mutable version tags, to prevent supply-chain attacks from a re-pointed tag.

Initial release: maintained fork of spatie/laravel-livewire-wizard (based on v2.4.3), kept compatible with Livewire 3 and Laravel 11/12/13.

Full Changelog: https://github.com/jeffersongoncalves/laravel-livewire-wizard/commits/1.0.0