S3M Laravel Package

Product Decisions This Supports

• Platform support matrix and upgrade timing: v3.0.0 sets a clear support boundary — Laravel 12/13 only, PHP 8.3+. This directly informs roadmap decisions about when the product must move off Laravel 11 and PHP 8.2.
• Security and compliance posture: The release drops Laravel 11 because every 11.x release is affected by CVE-2026-48019 (CRLF injection in the default email rule) with no patched 11.x version. This supports a decision to treat Laravel 11 as unsupported in our dependency policy rather than carrying an exception.
• Build vs. buy for S3-backed media/file handling: Assuming the package provides S3 storage/media management for Laravel, v3.0.0 keeps it aligned with the current Laravel release cadence, reducing the case for replacing it with in-house storage code.
• Maintenance and upgrade planning: The release is primarily a compatibility and toolchain upgrade — Laravel 13 support, Pest 4, Larastan 3.10, Testbench 10/11 — not a feature release. Roadmap impact is low for teams already on Laravel 12/13, but it is a required upgrade for teams that want Laravel 13 support.
• Dependency policy: Composer security-advisory blocking remains enabled; CI resolves to non-advisory releases of Laravel 12 and 13. This supports keeping security-advisory blocking on in our own pipelines rather than bypassing it.

When to Consider This Package

Consider v3.0.0 when:

• The product is on Laravel 12 or 13 and PHP 8.3 or 8.4.
• You need Laravel 13 compatibility and want a package that is actively verified against 13.10.0 and 13.15.0.
• You want S3-backed file/media handling without maintaining custom storage integration code.
• You value a package with an explicit supported-version policy and CI coverage across current Laravel and PHP lines.

Do not adopt v3.0.0, or plan an upgrade first, when:

• The product is still on Laravel 11 or PHP 8.2. Stay on the 2.x line short-term, but treat that as technical debt because Laravel 11 is past its security-support window and affected by CVE-2026-48019.
• You cannot upgrade PHP to 8.3+ in the near term. The v3 line will not install.
• You need long-term support for older Laravel versions; this package follows the current framework support window rather than extending it.

Look elsewhere only if the package's S3/media scope does not match your use case or if you require a vendor with a formal long-term-support commitment beyond Laravel's own support windows. The release notes do not indicate any functional regression or API-breaking change beyond the platform requirements, so replacement is not warranted on compatibility grounds alone.

How to Pitch It (Stakeholders)

For executives: This is a security-driven maintenance release, not a feature release. The package now supports Laravel 12 and 13 and requires PHP 8.3+. It deliberately drops Laravel 11 because Laravel 11 is past security support and every 11.x release is affected by CVE-2026-48019 with no patch available. Staying on the 2.x line is possible short-term, but the supported and secure path is to upgrade the platform and adopt v3.0.0. The business impact is reduced security exposure and continued vendor alignment with the current Laravel release cycle.

For engineering: v3.0.0 is a major-version bump driven by platform requirements: illuminate/contracts is now ^12.0|^13.0, PHP is ^8.3, and the test toolchain has moved to Pest 4, Larastan ^3.10, Collision ^8.8, and Testbench ^10.0|^11.0. CI covers Laravel 12 and 13 on PHP 8.3 and 8.4, with Composer security-advisory blocking enabled. There are no documented feature additions or API changes beyond Laravel 13 support. Teams on Laravel 11/PHP 8.2 should pin 2.x and schedule a platform upgrade; teams already on Laravel 12/PHP 8.3+ can upgrade with low functional risk and should validate in staging.