​

Laravel 12 Upgrade

​

🎯 What changed

​

🗺️ Map of the new skeleton

​

Things to know before touching bootstrap/app.php

• The global stack is declared in full with $middleware->use([...]), not with prepend/append. Four application middleware (RedirectOldDomain, ForceHttps, SecurityHeaders, BlockBlockedIps) sit between TrustProxies and HandleCors, and only use() reproduces that order.
• InvokeDeferredCallbacks must stay first. Without it, defer() never runs.
• Every route group is registered inside then:, not through the web:/api: arguments. Registration order decides which route wins a URI, and routes/web.php also declares routes under api/.
• The api group no longer ships throttle:api in Laravel 11+. It is added explicitly.
• QrCodeServiceProvider cannot be dropped from bootstrap/providers.php: simplesoftwareio/simple-qrcode declares no extra.laravel section, so package discovery never finds it. maatwebsite/excel and ssheduardo/redsys-laravel do declare it, which is why they are not listed.

​

Health check

​

⚠️ Carbon 3: diffIn*() changed semantics

$ref   = Carbon::parse('2026-03-01');
$birth = Carbon::parse('1990-06-15');

$ref->diffInYears($birth);        // Carbon 2: 35   | Carbon 3: -35.70958904109589
$ref->diffInYears($birth, true);  // Carbon 3: 35.70958904109589

// ❌ Negative under Carbon 3, so the comparison stops meaning anything
$minutes = now()->diffInMinutes($order->updated_at);
if ($minutes <= 60) { ... }   // -500 <= 60 is ALWAYS true

// ✅
$minutes = (int) now()->diffInMinutes($order->updated_at, true);

• app/Services/RegistrationCategoryService.php — age driving the participant category
• app/Http/Controllers/Checkout/CheckoutController.php — recent approved order, and hotel nights
• app/Console/Commands/ExpireAbandonedRateChangeOrdersCommand.php — hours until expiry

​

🖼️ The image rule no longer accepts SVG

'inputThumbnailImage' => 'image:allow_svg|mimes:jpeg,png,jpg,gif,svg|nullable',

​

🧪 PHPUnit 11

use PHPUnit\Framework\Attributes\Group;

#[Group('forms')]
class RegistrationFormFieldStateTest extends TestCase

​

🧰 New tools already in use

​

defer() — work after the response

defer(fn () => GA4::sendEvent([...]));

​

Context — payment log correlation

Context::add(['gateway' => 'redsys', 'order_id' => $order->id, 'internal_code' => $order->internal_code]);
Log::info('Redsys notify signature', ['isValid' => $isValid]);
// [...] local.INFO: Redsys notify signature {"isValid":true} {"gateway":"redsys","order_id":4321,...}

​

Number — figure formatting

A note on language. Laravel does not sync Number’s locale with the application locale: it formats in en by default (€1,234.56), which is exactly what was rendered before. If Spanish formatting (1.234,56 €) is ever wanted, a single Number::useLocale(...) in AppServiceProvider switches it. That is a user-visible change, so it is a product decision, not part of the upgrade.

​

Where not to use Number

• app/Exports/: there, number_format($v, 2, '.', '') produces machine values for CSV/Excel, and FormFieldDisplayValueResolver uses it as a comparison key. Changing it breaks the exports and amount matching.
• Checkout amounts: JavaScript reads them out of the DOM. public/assets/js/checkout/checkout.js calls parseFloat(document.getElementById('locatedPrice').textContent). With Spanish formatting, parseFloat("1.234,56 €") returns 1.234 and the total would become €1.23. Changing those amounts requires rewriting the JavaScript that parses them first.

​

✅ Verifying the upgrade locally

composer validate --strict
./vendor/bin/pint --test
php artisan test --group=forms
php artisan test

php artisan about           # Laravel 12.x
php artisan route:list      # same routes as before, plus /up
php artisan schedule:list   # the 3 tasks with their original cadence
php artisan l5-swagger:generate

​

📌 Notes

• Each Swagger documentation now has its own routes. The package defaults docs and api/oauth2-callback to the same paths for every documentation, so default and supervisor overwrote each other, and the application’s own /docs route (declared in routes/web.php) then took the URI and wiped the l5-swagger.*.docs route names. Since the Swagger view resolves them with route(), /api/documentation and /api/docs-supervisor returned 500. Each documentation now declares its own routes.docs and routes.oauth2_callback in config/l5-swagger.php. If you add a third documentation, give it its own.
• @OA\ OpenAPI annotations still work. swagger-php 5 keeps docblock support; the generated JSON is byte-identical to the previous version. There is no need to migrate to #[OA\...] attributes.
• routes/channels.php stays in the repository but is not registered: broadcasting is unused (Echo is commented out) and registering it would add a broadcasting/auth endpoint that did not exist before.