illuminate/console, illuminate/http, illuminate/support now accept ^12.0; orchestra/testbench dev dependency now accepts ^10.0). composer create-project laravel/laravel has defaulted to Laravel 12 since its release, so composer require jmrashed/laravel-installer into any new Laravel app was failing to resolve entirely until this fix — this affected every new install, not just CIlaravel: 12.* to the CI test matrix (excluding php: 8.1 + laravel: 12.*, since Laravel 12 requires PHP ^8.2), and fixed the CI integration job, which creates a real laravel/laravel project and installs this package into it — it had been failing since Laravel 12's releaseDependencyController::installPackage() now validates the package name against a strict allow-list pattern and shells out via an argument-array Process instead of an interpolated shell stringSecurityMiddleware, PerformanceMiddleware, ProgressMiddleware, DependencyMiddleware, ExceptionHandlerMiddleware) on the install/update route groups — they were fully implemented but never wired into the service provider, so the advertised rate limiting, security headers, suspicious-content filtering, and audit logging were not actually active in any v2.0.x release before this onePurchaseController::validatePurchase() no longer unconditionally bypasses license validation — it returned before running any of its own logic, so a purchase code was never actually checked. Now gated by installer.purchase_validation.enabled (defaults to false, preserving prior default behavior for consumers who don't sell through Envato; real validation runs when enabled)installer.security.allowed_ips, installer.security.access_token) — previously the only gate was a storage/installed lock file that doesn't exist until installation is complete, leaving every route (including database migrate/rollback and dependency-install) reachable by anyone who got there first.env writes in CacheQueueManager::updateEnvFile() to strip control characters, closing an env-line-injection path for the Redis queue-setup form (EnvironmentManager already had this protection; CacheQueueManager didn't)DatabaseBackupManager::restoreBackup() now validates the backup identifier format before building a filesystem path from itmysqldump/mysql/pg_dump/psql now receive database credentials via MYSQL_PWD/PGPASSWORD environment variables instead of a --password= CLI flag, so they're no longer visible in ps aux for the life of the process0700/0600 permissions instead of world-readable defaultsaudit.sensitive_fields redaction in LogManager — passwords/secrets are now stripped before any operation is written to the audit logEnvironmentController::checkDatabaseConnection() mutating the application's ambient config('database') state during a connection test, which could leak the installer's test credentials into the rest of the request lifecyclelayouts/master.blade.php referencing nonexistent route names (LaravelInstaller::environment/LaravelInstaller::requirements), which threw a RouteNotFoundException whenever an error page (or the resume-installation page) tried to rendercreatePostgresBackup/restorePostgresBackup implementations — the driver switch in DatabaseBackupManager referenced them, but they didn't exist, so any PostgreSQL install would fatally error on backupDatabaseOptimizer::optimizeMemoryUsage() — memory-limit recommendations were based on the current process's own memory usage rather than the configured memory_limit, and a MySQL-only PDO attribute was being set unconditionally on all drivers (would warn/fail on PostgreSQL/SQLite, both advertised as supported)Dockerfile/docker-compose.yml/package.json chain: docker-compose.yml mounted a nonexistent docker/nginx/default.conf, Dockerfile ran npm run build against a package.json with no build script, and the asset paths in package.json pointed at the wrong directory — docker-compose up and a from-scratch npm run build both failed before this releasetest-installer.php / test-package.php from the repo root (not wired into CI, and test-package.php referenced a controller class that no longer exists)sass//scss/ source trees, an unreferenced style-prev.css, and unused CSS source maps — none of it was reachable from the actual Tailwind build script or any viewCODE_OF_CONDUCT.md (referenced by CONTRIBUTING.md since it was written, but never existed)SECURITY.md, which was an unmodified template: a fake supported-versions table (5.x/4.x for a package that has never shipped past 2.0.x) and a security@example.com placeholder contactLICENSE.md; the file is LICENSE)composer.json) and softened the "18+ languages supported" claim to reflect that most locales are partialCONTRIBUTING.md if you'd like to help translateHow can I help you explore Laravel packages today?