chore: drop Laravel 11, whose every release is blocked by security advisories

Author: Rati Rukhadze

.github/workflows/tests.yml

@@ -20,10 +20,12 @@ jobs:
         # The package is proven against its supported peers. Laravel 13 needs
         # Testbench 11, which needs PHP 8.4, so the 8.3 legs stop at Laravel 12 —
         # which is exactly the combination the composer constraints allow.
+        #
+        # Laravel 11 is not here, and not supported: every one of its releases is
+        # now covered by a security advisory, so Composer's default policy refuses
+        # to install any of them. Claiming support for a major nobody can install
+        # would be a promise the package cannot keep.
         include:
-          - php: '8.3'
-            laravel: '11.*'
-            testbench: '9.*'
           - php: '8.3'
             laravel: '12.*'
             testbench: '10.*'

CHANGELOG.md

@@ -7,6 +7,10 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## Unreleased
 
+### Requirements
+
+- PHP 8.3+, Laravel 12 or 13. Laravel 11 is not supported: every one of its releases is covered by a security advisory, so Composer's default policy refuses to install them.
+
 ### Added
 
 - **Schema introspection** across MySQL, MariaDB, PostgreSQL and SQLite through Laravel's own schema builder — no Doctrine DBAL. Normalised, deterministic value objects for tables, columns, indexes and foreign keys, with every field a driver did not report left as `null` rather than invented.

README.md

@@ -129,9 +129,11 @@ php artisan vendor:publish --tag=difflock-config
 **Requirements**
 
 - PHP 8.3+
-- Laravel 11, 12 or 13
+- Laravel 12 or 13
 - MySQL, MariaDB, PostgreSQL or SQLite
 
+Laravel 11 is deliberately not supported. Every one of its releases is now covered by a security advisory, so Composer's default policy refuses to install any of them — claiming support for a major nobody can install would be a promise the package cannot keep.
+
 No Doctrine DBAL. Laravel 11 moved schema introspection into the framework, so Difflock uses that and carries no driver-specific SQL of its own beyond one cheap metadata query for table sizes.
 
 ## Quick start

composer.json

@@ -27,15 +27,15 @@
   ],
   "require": {
     "php": "^8.3",
-    "illuminate/console": "^11.0 || ^12.0 || ^13.0",
-    "illuminate/contracts": "^11.0 || ^12.0 || ^13.0",
-    "illuminate/database": "^11.0 || ^12.0 || ^13.0",
-    "illuminate/support": "^11.0 || ^12.0 || ^13.0"
+    "illuminate/console": "^12.0 || ^13.0",
+    "illuminate/contracts": "^12.0 || ^13.0",
+    "illuminate/database": "^12.0 || ^13.0",
+    "illuminate/support": "^12.0 || ^13.0"
   },
   "require-dev": {
     "larastan/larastan": "^3.0",
     "laravel/pint": "^1.18",
-    "orchestra/testbench": "^9.5 || ^10.0 || ^11.0",
+    "orchestra/testbench": "^10.0 || ^11.0",
     "pestphp/pest": "^3.7 || ^4.0",
     "pestphp/pest-plugin-laravel": "^3.1 || ^4.0",
     "pestphp/pest-plugin-type-coverage": "^3.2 || ^4.0",