php-laravel-framework 13.31.0+dfsg-1

Package Information

Description	web application framework for PHP Laravel is a web application framework with expressive, elegant syntax. It attempts to take the pain out of development by easing common tasks used in the majority of web projects, such as: * Simple, fast routing engine * Powerful dependency injection container * Multiple back-ends for session and cache storage * Database agnostic schema migrations * Robust background job processing * Real-time event broadcasting Laravel is accessible, yet powerful, providing tools needed for large, robust applications. A superb combination of simplicity, elegance, and innovation gives you a complete toolset required to build any application with which you are tasked.
Maintainer	Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed By	Robin Gustafsson <rgson@debian.org>
Sponsor	rgson@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/php-team/pear/php-laravel-framework.git -b debian/latest (browse)
Closes	#1139631, #1145435, #1150001
Popcon Installs	36
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/php-laravel-framework
Uploaded	2 hours ago

New Package Report

.changes◂

Version	13.31.0+dfsg-1
Changed-By	Robin Gustafsson <rgson@debian.org>
Architecture	source all
Distribution	unstable
Date	Wed, 21 Oct 2026 22:56:38 +0200
Source	php-laravel-framework

Changelog◂

php-laravel-framework (13.31.0+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 13.31.0+dfsg (Closes: #1145435)
     - Fix security issue: CRLF injection (CVE-2026-48019, Closes: #1139631)
     - Fix security issue: XSS injection (CVE-2026-102279, Closes: #1150001)
   * Add packages for new components in Laravel 13
   * Update Standards-Version
   * Exclude a .gitignore file from the package
   * Fix PHP dependency autoloader paths
   * Avoid php-symfony-polyfill-php84

.dsc◂

Priority	optional
Component	main
Package-List	php-illuminate-auth deb php optional arch=all php-illuminate-broadcasting deb php optional arch=all php-illuminate-bus deb php optional arch=all php-illuminate-cache deb php optional arch=all php-illuminate-collections deb php optional arch=all php-illuminate-concurrency deb php optional arch=all php-illuminate-conditionable deb php optional arch=all php-illuminate-config deb php optional arch=all php-illuminate-console deb php optional arch=all php-illuminate-container deb php optional arch=all php-illuminate-contracts deb php optional arch=all php-illuminate-cookie deb php optional arch=all php-illuminate-database deb php optional arch=all php-illuminate-encryption deb php optional arch=all php-illuminate-events deb php optional arch=all php-illuminate-filesystem deb php optional arch=all php-illuminate-hashing deb php optional arch=all php-illuminate-http deb php optional arch=all php-illuminate-image deb php optional arch=all php-illuminate-json-schema deb php optional arch=all php-illuminate-log deb php optional arch=all php-illuminate-macroable deb php optional arch=all php-illuminate-mail deb php optional arch=all php-illuminate-notifications deb php optional arch=all php-illuminate-pagination deb php optional arch=all php-illuminate-pipeline deb php optional arch=all php-illuminate-process deb php optional arch=all php-illuminate-queue deb php optional arch=all php-illuminate-redis deb php optional arch=all php-illuminate-reflection deb php optional arch=all php-illuminate-routing deb php optional arch=all php-illuminate-session deb php optional arch=all php-illuminate-support deb php optional arch=all php-illuminate-testing deb php optional arch=all php-illuminate-translation deb php optional arch=all php-illuminate-validation deb php optional arch=all php-illuminate-view deb php optional arch=all php-laravel-framework deb php optional arch=all
Section	php

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/laravel/framework
Upstream-Name: Laravel
Upstream-Contact: Taylor Otwell <taylorotwell@gmail.com>
Files-Excluded: bin/splitsh-lite

Files: *
Copyright: Taylor Otwell <taylor@laravel.com>
License: Expat

Files: debian/*
Copyright: 2020-2025 Robin Gustafsson <robin@rgson.se>
License: Expat

Files: src/Illuminate/Foundation/Exceptions/Renderer/Mappers/BladeMapper.php
Copyright: Spatie <info@spatie.be>
License: Expat

Files: src/Illuminate/Mail/Transport/ResendTransport.php
Copyright: 2023 Jayan Ratna
License: Expat

Files: src/Illuminate/Translation/MessageSelector.php
Copyright: 2005-2010 Zend Technologies USA Inc.
License: BSD-3-clause
Comment:
 This exception applies to only a part of the file's content.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 Redistributions of source code must retain the above copyright notice, this
 list of conditions and the following disclaimer.
 .
 Redistributions in binary form must reproduce the above copyright notice, this
 list of conditions and the following disclaimer in the documentation and/or
 other materials provided with the distribution.
 .
 Neither the name of Zend or Rogue Wave Software, nor the names of its
 contributors may be used to endorse or promote products derived from this
 software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
 ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
 ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for php-laravel-framework version 13.31.0+dfsg-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 2 minor
debian/watch: old format (version 4)
debian/copyright: machine-readable
Scan before the review: 5 found

Licensing

The whole tree is MIT (Expat) (Copyright Taylor Otwell) per LICENSE.md, with three documented exceptions: BladeMapper.php (parts of spatie/laravel-ignition, Spatie, MIT), ResendTransport.php (Jayan Ratna, MIT), and MessageSelector.php (Zend Framework plural rules, Zend Technologies USA, new BSD / BSD-3-clause), each with its own Files: stanza and full licence text. Files-Excluded bin/splitsh-lite is indeed absent from the tree (bin/ holds only release.sh, split.sh, test.sh). The minified dist/scripts.js and dist/styles.css flagged by the scan exist only under .pc/ (quilt's record); patch 0004 deletes them and disables the debug-mode exception renderer, so they are not shipped. All other scan hits (laravel.txt.gz, blank_document.pdf, database-journal-mode-wal.sqlite, plus images) are test fixtures under tests/, MIT-licensed, and not installed into any binary. No non-free clauses were found. Every copyright holder found by the author scan is named in debian/copyright. The file is DEP-5 (Format 1.0) and accurate.

Packaging

Clean, conventional pkg-php-tools packaging: debhelper-compat 13 with dh $@, dh-sequence-phpcomposer, buildvars-derived per-package install/autoload/docs targets, dh_missing --fail-missing, generated autoloaders, a comprehensive set of superficial tests/control autopkgtests covering every binary, sources format 3.0 (quilt), Standards-Version 4.7.4 (current is 4.7.4.1), DEP-14 branches via gbp.conf, changelog with correct closure, and Rules-Requires-Root: no. Patches are small, well-described, with DEP-3 headers and justified Forwarded: not-needed. All packages carry ${misc:Depends}. One minor point: the whole src/Illuminate/Foundation directory (including the debug exception renderer's Node build files package.json, package-lock.json, vite.config.js and the unminified source assets) is installed into php-laravel-framework even though patch 0004 disables that renderer, so those files are dead weight in the binary.

Issues

1. [minor] [packaging] Disabled exception renderer's Node assets are still installed

Files: php-laravel-framework.install, src/Illuminate/Foundation/resources/exceptions/renderer/package.json, src/Illuminate/Foundation/resources/exceptions/renderer/package-lock.json, src/Illuminate/Foundation/resources/exceptions/renderer/vite.config.js
Basis: checked, in the package or with a reference tool
Evidence: php-laravel-framework.install ships src/Illuminate/Foundation usr/share/php/Illuminate; patch 0004 deletes only dist/scripts.js and dist/styles.css and disables the renderer in FoundationServiceProvider, while package.json, package-lock.json, vite.config.js and the unminified scripts.js/styles.css/blade views in resources/exceptions/renderer/ remain on disk and are installed.
Problem: The debug-mode exception renderer the maintainers chose not to ship is carried whole into the binary despite being inert, along with frontend build tooling (package.json/package-lock/vite config) irrelevant to a PHP library. Minor bloat/cleanliness, not a policy violation.
Fix: Exclude these files in override_dh_install (e.g. -Xresources/exceptions/renderer) or have patch 0004 remove the whole renderer directory, matching the intent already stated in the patch's commit message.

2. [minor] [packaging] debian/watch is in the old version 4 format

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

debian/copyright is DEP-5 (Format 1.0), all five copyright holders named (Taylor Otwell, Spatie, Jayan Ratna, Zend Technologies, Debian maintainer Robin Gustafsson).
Main code is MIT (Expat); LICENSE.md and per-component LICENSE.md files all name Taylor Otwell. Standalone Expat text reproduced in copyright.
MessageSelector.php carries Zend's new-BSD notice (2005-2010 Zend Technologies USA Inc.); copyright has the full BSD-3-clause text.
The minified dist/scripts.js/styles.css from the prescan exist only under .pc/0004-.../ (quilt record) and are deleted in the working tree by patch 0004, which also disables the renderer; they are not shipped.
Files-Excluded bin/splitsh-lite is not in the tree; bin/ holds only shell scripts.
Test fixtures laravel.txt.gz, blank_document.pdf, database-journal-mode-wal.sqlite, empty_image.jpg, StardewTaylor.png are tests-only data, covered by Files: *, not installed.
debian/rules uses dh_missing --fail-missing with -X.gitattributes -X.github -X.gitignore -X.md -Xcomposer.json; generated autoloaders/buildvars/docs/install files are cleaned in debian/clean.
tests/control provides a superficial require autoloader test for every binary package in control.
All Build-Depends (debhelper-compat 13, dh-sequence-phpcomposer, jq, php-cli, phpab, pkg-php-tools) are Debian packages; Standards-Version 4.7.4 vs current 4.7.4.1 is fine.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 13.38.0, packaged 13.31.0+dfsg), which is not a fault of the package.

Not confirmed

None.

Proposed: debian/watch in version 5 format

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Source: https://github.com/laravel/framework.git
Matching-Pattern: refs/tags/v?([\d\.]+)
Dversionmangle: s/@DEB_EXT@//
Gitexport: all
Gitmode: full
Mode: git
Pgpmode: none
Repacksuffix: +dfsg
Update-Script: uupdate

Uploader's response to the LLM review

The uploader was emailed about the review 0 hours ago.

Back to Dashboard | View all reviews for this package