Phase 2: rule parity — 21 new rules, six dataset contracts, PHP ^8.5

.github/workflows/benchmark.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: '8.5'
           coverage: none
 
       - name: Install base dependencies

.github/workflows/laravel-13-dev.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
-    name: P8.4 - L-13.x-dev - testbench-newest-dev - ubuntu-latest
+    name: P8.5 - L-13.x-dev - testbench-newest-dev - ubuntu-latest
 
     steps:
       - name: Checkout code
@@ -44,7 +44,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: 8.4
+          php-version: 8.5
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo
           coverage: none
 
@@ -77,7 +77,7 @@ jobs:
           Nightly \`laravel/framework:13.x-dev\` run failed.
 
           - **Run:** <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}>
-          - **Matrix:** PHP 8.4 × laravel:13.x-dev × testbench:*@dev × prefer-stable × ubuntu-latest
+          - **Matrix:** PHP 8.5 × laravel:13.x-dev × testbench:*@dev × prefer-stable × ubuntu-latest
           - **Commit:** ${{ github.sha }}
           - **Install outcome:** ${{ steps.install.outcome }}
           - **Test outcome:** ${{ steps.tests.outcome }}

.github/workflows/phpstan.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: '8.5'
           coverage: none
 
       - name: Install composer dependencies

.github/workflows/rector.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: '8.5'
           coverage: none
 
       - name: Install composer dependencies

.github/workflows/release-benchmark.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: '8.5'
           coverage: none
 
       - name: Install dependencies

.github/workflows/run-tests.yml

@@ -31,7 +31,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
-        php: [8.5, 8.4]
+        php: [8.5]
         laravel: [13.*]
         stability: [prefer-lowest, prefer-stable]
         include:

CHANGELOG.md

@@ -19,8 +19,8 @@ Entries below `Unreleased` are written by CI from the GitHub release body — se
   Pest testing helpers.
 - Four Laravel Boost skills shipped under `resources/boost/skills/`, namespaced
   `laranail-validation*`.
-- An extended rule library under `Rules\`: 54 rules across AntiSpam, Banking, Codes, Colour,
-  Crypto, Database, Email, Fiscal, Geo, Identifiers, Markup, Net, Network, Numbers, Postal,
+- An extended rule library under `Rules\`: 84 rules across AntiSpam, Banking, Codes, Colour,
+  Crypto, Database, Email, Fiscal, Geo, I18n, Identifiers, Markup, Net, Network, Numbers, Postal,
   Profanity, Structure, Telecom, Text and Vendor. Each is a plain `ValidationRule`
   usable on its own, in a rule array, or through the builder's `rule()` escape hatch. See
   [the reference](docs/tools/rule-library.md).
@@ -45,7 +45,7 @@ Entries below `Unreleased` are written by CI from the GitHub release body — se
   regex contorted into a numeric range. Implemented by `Text\Slug`, `Text\WithoutSpaces`,
   `Identifiers\SemVer`, `Net\Subdomain`, `Crypto\EthereumAddress`, `Text\CaseStyle`,
   `Text\Username`, `Text\PersonName`, `Numbers\MonetaryAmount`, `Vendor\VendorIdentifier`,
-  `Postal\PostalCode`,
+  `Postal\PostalCode`, `Banking\BsbNumber`, `Identifiers\HashDigest`,
   `Geo\Latitude`, `Geo\Longitude` and `Colour\CssColor` — the rules whose entire check is a pattern, which they return so there is no second
   implementation to drift. `PostalCode` sends only the named countries' patterns and nothing at
   all when the country comes from a sibling field.

README.md

@@ -7,7 +7,7 @@
 
 > Write Laravel validation rules with IDE autocompletion instead of memorising string syntax — each rule type exposes only the methods that apply to it, `each()` and `children()` keep parent and child rules in one place, and large wildcard arrays validate tens of times faster — see the [benchmarks](docs/performance.md).
 
-Targets PHP `^8.4.1` on Laravel `^13`.
+Targets PHP `^8.5` on Laravel `^13`.
 
 ```php
 // Before

UPGRADING.md

@@ -4,6 +4,12 @@ Breaking changes, and what to do about them. Versions not listed here need no ac
 
 ## Unreleased
 
+### The PHP floor is now `^8.5`
+
+The package requires PHP 8.5. The `Rules/Chrono/` family and the 1.0 platform work target the
+8.5 runtime, and the test matrix runs 8.5 only. Applications on PHP 8.4 must upgrade the runtime
+before taking this version; no code changes are required beyond that.
+
 ### `ArrayRule::getEachRules()` is removed
 
 It was an exact alias of `getEachKeyedRules()` — same body, wider advertised type. Replace

composer.json

@@ -64,7 +64,7 @@
         "docs": "https://opensource.simtabi.com/documentation/laranail/validation/"
     },
     "require": {
-        "php": "^8.4.1 || ^8.5",
+        "php": "^8.5",
         "illuminate/contracts": "^13.0",
         "illuminate/http": "^13.0",
         "illuminate/support": "^13.0",

docs/architecture.md

@@ -241,6 +241,47 @@ So the four skills carry the vendor and slug themselves:
 | `laranail-validation-optimize` | Finding conversion opportunities in existing validation |
 | `laranail-validation-migrate-messages` | Moving `messages(): array` to inline `message:` |
 
+## Not in this library — and why
+
+The migration audit swept every feature of the legacy packages (`enekia` v1/v2). Most were
+ported, usually improved; the rest were dropped or relocated **on purpose**, and this section
+is the durable record of each decision so nobody re-litigates them one at a time.
+
+- **`RemoteRule`** (a rule POSTing the value to a DB-configured URL) — dropped as designed.
+  A validation rule that ships user input to a runtime-configurable endpoint is an SSRF and
+  exfiltration hazard wearing a helpful name. The sanctioned shapes are a container-resolved
+  invokable rule (your code, your endpoint) or the validation-js transport layer, which is
+  security-reviewed before any dynamic endpoint ships.
+- **SMTP deep-check verification** — `laranail/email`'s scope. `Networking\DeliverableEmail`
+  answers the narrower MX question here; an SMTP conversation needs sending infrastructure a
+  validation library must not own.
+- **zxcvbn strength scoring / password history** — their own packages
+  (`laranail/password-strength`, `laranail/password-history`), bridged into `password()` via
+  guarded macros and listed under `suggest` only.
+- **Disposable-phone lists** — `laranail/phone`'s scope, beside the phone metadata they
+  describe.
+- **The framework-free PHP tier** — enekia v1's vanilla validators are not restored. The
+  successor is Laravel-coupled by design; the portable role belongs to the JS engine, which is
+  framework-free from the ground up.
+- **`is*()`/`assert*()` magic statics** — replaced by the typed fluent API and the explicit
+  `Check::` statics, which give the same one-liner ergonomics with real signatures.
+- **`Transfigure`'s ~55 type predicates** — a utility library that lived inside a validation
+  package; neither ported nor replaced, because type predicates are not validation rules.
+- **`Str` contains-all/contains-any rules** — deferred, not refused: core `contains` plus the
+  string builder cover the common cases, and the dedicated rules land if real demand appears.
+- **`MissingFromDB`** — expressible as `Rule::unique` directly; a wrapper would rename a core
+  rule without changing it.
+- **JAN and UPC-A** — documented onto `Ean` and `Gtin` rather than duplicated: each IS the
+  other rule with a prefix, and a prefix-only class would restate a checksum to say less.
+
+Two probes the plan recommended dropping were instead **redesigned and implemented** by owner
+decision — `Networking\ImageUrl` (guarded, redirect-refusing, fail-closed) and
+`Networking\HasGravatar` (https, sha256, fail-open, privacy cost documented). The enekia
+v1-only rules all resolve to core or existing successors: `Equals` → `same`, `Coordinate` →
+`Geo\LatLng`, `Timezone` → core `timezone` (identifiers) + `Chrono\TimezoneAbbreviation`
+(abbreviations), `IsAStateInNorthAmerica` → `Geo\UsState` / `Geo\CaProvince`,
+`IncludesHtml` → `Text\HtmlClean`'s `mustContainHtml:` flag.
+
 ---
 
 [← Docs index](../README.md#documentation)

docs/installation.md

@@ -8,7 +8,7 @@ You can install the package via composer:
 composer require laranail/validation
 ```
 
-Requires PHP 8.4.1+ and Laravel 13.
+Requires PHP 8.5+ and Laravel 13.
 
 > The package is pre-1.0. The public surface is settling, so pin a constraint you are happy to
 > review — `^0.1` tracks the current line.