* fix: respect table prefixes in query builder relationship aggregates
* fix: preserve one-of-many relationship semantics in query builder aggregates
* fix: respect relationship method constraints in query builder aggregates
Aggregate subqueries were built from a fresh query on the related model,
so constraints defined inside the relationship method itself were never
applied. An aggregate over a relationship such as
`hasMany(Post::class)->where('is_published', true)` silently aggregated
every related row, and `wherePivot()` on a `BelongsToMany` was ignored
in the same way.
Merge the relationship's own query into the subquery with
`mergeConstraintsFrom()`, matching how Laravel builds its own
`withAggregate()` subqueries.
---------
Co-authored-by: Dan Harrin <git@danharrin.com>
UiAvatarsProvider::get() takes the first character of each
space-separated word in the user's name with no filtering, so a name
starting with a bracket (a common convention for marking service or
system accounts, e.g. "[SYSTEM] Admin") leaks that bracket into the
initials: "[A" instead of "SA".
Fixes#20384
`ReflectionMethod::setAccessible()` is deprecated as of PHP 8.5, and has had no
effect since PHP 8.1 - reflection ignores visibility on its own, so `invoke()`
still reaches the protected methods of a mixin. Calling it only raised a
deprecation notice on 8.5, so the call is removed.
Claude-Session: https://claude.ai/code/session_015vxpe34oAqmDtzZxC8HSV2
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix: Cache used MFA codes using hash of secret rather than secret and code
* support non-locking drivers
* consistency
* fix: return an array from `SpatieTagsEntry`/`SpatieTagsColumn` `getState()` when state is not a Collection or array
The early-return branch returned the raw state from a method typed `array`,
which threw a `TypeError` for any truthy scalar state. PHPStan 2.2.8 narrows
`mixed` more precisely and surfaced this, failing CI on every branch.
The early-return branch returned the raw state from a method typed `array`,
which threw a `TypeError` for any truthy scalar state. PHPStan 2.2.8 narrows
`mixed` more precisely and surfaced this, failing CI on every branch.
* fix: derive per-key state path when unsetting missing array keys in tests
`unsetMissingNumericArrayKeys()` appended `.{$key}` to `$currentStatePath`
inside its `foreach`, so each sibling key inherited the preceding keys'
segments instead of deriving `parent.key` per key.
Walking `$this->mountedActions`, the entry's keys are ordered `name`,
`arguments`, `context`, `data`, so by the time the loop reaches `data` the
path has become:
mountedActions.0.name.arguments.context.data
The `startsWith($schemaStatePath)` guard then never matches
`mountedActions.0.data`, which leaves the `unset()` for stale numeric keys
unreachable. In a test, filling a mounted action's form with a shorter list
silently keeps the removed items:
// CheckboxList::make('roles'), mounted state ['viewer', 'creator']
->fillForm(['roles' => ['viewer']])
// state is still ['viewer', 'creator']
`callAction(..., data: [...])` and `setActionData()` route through
`fillForm()`, so they are affected too. Growing the list works, and clearing
it to `[]` works because an empty array stays a leaf for `Arr::dot()` and
`data_set()` replaces the whole value. Only a partial shrink breaks, and it
breaks silently: the assertion after it passes against state that was never
changed.
Page-level forms were unaffected, because their state path is the single
segment `data` and every corrupted path still starts with it.
* Update InteractsWithSchemasTest.php
---------
Co-authored-by: Dan Harrin <git@danharrin.com>
* fix: preserve configuration context when mounting navigation
* test: cover navigation mounting with active configurations
* consistency and more tests
---------
Co-authored-by: Dan Harrin <git@danharrin.com>
* fix: Name CheckboxList search input and announce no-results to screen readers
* fix: Announce ColorPicker popover and dialog to screen readers
* fix: Expose RichEditor toolbar and toggle-button state to screen readers
* fix: Give KeyValue inputs and action columns accessible names
* fix: Toggle reports correct and always-valid `aria-checked` state
* fix: Convey unread database notification state to screen readers
* fix: Stop toast live region re-announcing the whole stack
* fix: Make database notification header actions keyboard-reachable
* fix: Announce danger notifications assertively to screen readers
* fix: Mark active panel navigation items with `aria-current="page"`
* fix: Add a skip-to-content link to the panel layout
* fix: Name collapsed-sidebar icon-only controls for assistive tech
* fix: Group the theme switcher and announce the active theme
* fix: Include user name in sidebar user-menu trigger accessible name
* fix: Announce unread notification count in the notifications trigger name
* fix: Label panel navigation landmarks for assistive tech
* fix: Mark active item with `aria-current` in dropdown navigation menus
* fix: Expose Icon tooltip text as an accessible name
* fix: Expose FusedGroup as a labelled group and associate its validation error
* fix: Make copyable Text keyboard-operable
* fix: Honor prefers-reduced-motion for framework animations
* fix: Always render an `alt` attribute on the base avatar image
* fix: Expose current page in breadcrumbs and pagination for assistive tech
* fix: Keep modal close button focusable when Escape close is disabled
* fix: Add `aria-current` to active page sub-navigation tab links
* fix: Add visible focus rings to table controls and a boundary to color swatches
* fix: Give inline-editable table column controls an accessible name
* fix: Make ToggleColumn keyboard-operable and focusable
* fix: Add a boundary to infolist color swatches and focus rings to copyable entries
* fix: Render hidden infolist entry labels as screen-reader-only, not display:none
* fix: Give infolist ColorEntry swatches an accessible name
* fix: Mark KeyValueEntry key cells as row headers
* fix: Add `scope="col"` to RepeatableEntry table headers
* fix: Make TextEntry expand/collapse list controls keyboard-operable buttons
* fix: Add a visible focus ring to the clickable stats-overview stat card
* fix: Add an accessible name to the chart widget inline filter select
* refactor: Bind Blade component attributes with a colon instead of interpolation
* fix: Honor prefers-reduced-motion for the notification reposition animation
* fix: Bind aria-current on dropdown nav items so the Blade component compiles
* fix: Dismiss tooltips when Escape is pressed
* fix: Use navigation semantics for page sub-navigation tabs
* fix: Name column-manager reorder handles and associate visibility checkbox labels
* fix: expose heading level on static section and modal heading components
* fix: default an accessible name on the badge delete button
* fix: give icon-only infolist entries a screen-reader text alternative
* fix: announce callout status severity to screen readers
* fix: add `alt()` support to the image entry for accessible names
* fix: give non-text table columns a text alternative
* fix: make the collapsible section disclosure button accessible
* fix: name the collapsible section toggle and correct its disclosure ARIA
* fix: expose the schema section as a named landmark region
* fix: expose disclosure semantics on dropdown triggers
* fix: reword `ColorColumn` swatch comment to drop internal todo reference
* fix: expose query builder rules and groups as named groups
* fix: swap the Blade section disclosure button `aria-label` between expand and collapse states
* fix: sort the `HasLabel` import alphabetically in `IconEntry`
* fix: associate wizard step controls with their panels
* fix: concatenate the section disclosure `x-bind:aria-label` expression instead of echoing inside the attribute
* fix: announce wizard step completion state to screen readers
* fix: harden loading-state accessibility
* fix: use the sanitized color for swatch accessible names
* fix: drop unsupported ARIA attributes from the color picker input
* fix: give table summary footer proper header cell scope semantics
* fix: emit the schema icon tooltip as visually-hidden text instead of an inert unescaped `aria-label`
* fix: expose indeterminate state on select-all checkboxes
* fix: provide text alternatives for chart canvas elements
* fix: expose disclosure state on sidebar toggle buttons
* Update theme.css
* fix: improve accessibility of the link component
* fix: guard icon-button aria-label and disabled-tooltip keyboard focus
* fix: announce dynamic table status changes to screen readers
* fix: announce FileUpload errors and name its download and open links
* fix: announce TagsInput tag additions and removals to screen readers
* fix: associate sidebar group disclosure buttons with their items via aria-controls
* fix: emit a valid aria-pressed value on rich editor toggle tools
* fix: don't apply an assertive role to inline danger notifications
* fix: use the collapsed state for a section's initial collapse-button label
* fix: name wizard step panels when the header is hidden
* fix: expose a user-supplied icon aria-label as a visually-hidden alternative
* fix: make the toggle column switch focusable before Alpine initializes
* fix: give the FileUpload image editor image an empty alt
* fix: rename `ImageColumn::getImageAlt()` to `getAlt()` for sibling parity
* fix: align icon text-alternative type handling between entry and column
* fix: make the text column limited-list expand controls real buttons
* fix: add header scopes and reorder/actions labels to the table repeater
* fix: dismiss only the tooltip on Escape when a dropdown is also open
* fix: add a skip-to-content link to the simple layout
* fix: give the tabs navigation landmark a default accessible name
* fix: mark custom image-path icons as decorative by default
* fix: clamp the heading level components to a valid heading tag
* fix: don't announce the rich editor toolbar until it is keyboard-navigable
* fix: keep text list expand controls as role=button to stay valid inside record links
* fix: bind the toggle column tabindex client-side to stay valid inside record links
* fix: escape sr-only `aria-label` values rendered without attribute escaping
* fix: place plural condition markers at the start of each translation segment
* fix: announce the total result count instead of the current page count
* fix: withhold `role="img"` from copyable color entry swatches to match the column
* fix: key table cell start/end padding off `:first-child`/`:last-child` so summary `<th>` cells do not break `*-of-type` matching
* fix: announce the active tab on button-tag tabs with `aria-current="true"`
* fix: keep sidebar group item ids unique when labels share or lack a slug
* fix: clear stale `TagsInput` live region announcements after a delay
* fix: keep dropdown trigger ARIA wiring in sync across Livewire morphs
* fix: render the tab-reachable modal close button after the content so the focus trap does not autofocus it
* fix: focus the notifications slide-over window on open instead of the `Mark all as read` action
* Update theme.css
* fix: escape the sr-only `aria-label` in the link Blade component
* fix: escape the sr-only `aria-label` in the button Blade component
* fix: omit the section collapse button `aria-controls` when there is no content to control
* test: cover Blade component sr-only `aria-label` escaping and section `aria-controls`
* fix: scope column manager checkbox ids to their table
* fix: insert tags literally into `TagsInput` live region announcements
* fix: keep the tab-reachable modal close button in the sticky header and autofocus the window instead
* test: cover column manager checkbox id scoping across two tables in the browser
* fix: escape aria-labels in the embedded HTML generators and reflect toggle state in aria-checked
The sr-only aria-label escaping fix applied to the link/button Blade views
was not mirrored into the CanGenerate{Button,IconButton,Link}Html traits that
Action renders through, so an Htmlable label could break out of the
attribute (the merges use escape: false). Escape them the same way the Blade
views do, with doubleEncode: false so string labels are not double-encoded,
and give the icon-button Blade view the matching treatment.
Also render the toggle Blade component's initial aria-checked from its state
instead of a hardcoded false, matching the embedded PHP renderers before
Alpine hydrates.
* fix: keep editable column aria-labels safe for Htmlable labels
The editable columns built their aria-label with (string) $this->getLabel(),
which crashes on an Htmlable label that has no __toString() and double-encodes
a HtmlString's entities. Use the Htmlable-aware conversion the rest of the
branch uses, with doubleEncode: false.
* fix: guard tags input live region announcements for published view overrides
announce() wrote to the liveRegion ref and the code called replace() on the
message strings unconditionally, both of which are absent when a user serves a
published pre-change tags-input view, throwing on every tag entry. Bail out of
announce() when the ref is missing and call replace() optionally.
* fix: guard file upload action labels for published view overrides
The download/open anchors set aria-label and title from parameters that are
undefined when a published pre-change file-upload view is served, rendering a
literal "undefined". Only set the attributes when the label is present.
* summary bug
* remove inconsistent labelling
RenHai Wen