Laravel 12 upgrade patch — 3 November 2026

Applies only to the supplied Veltrix_Laravel10_React_MySQL project.

Why: Composer blocks the allowed Laravel 10 versions because of security
advisories. Laravel 10 security support ended 4 February 2025. Laravel 12
supports PHP 8.2 and receives security fixes until 24 February 2027.

Changes:
- composer.json: PHP ^8.2, Laravel ^12.0, Sanctum ^4.0,
  Collision ^8.6, PHPUnit ^11.5. Other requirements unchanged.
- config/sanctum.php: Sanctum 4 middleware keys and framework references.
The existing application structure is retained as recommended by Laravel.
The supplied personal_access_tokens migration already contains expires_at;
do not publish another copy of that migration.

Apply:
1. Back up the project, its .env and database. Try on a staging copy first.
2. Open the existing backend directory in cPanel File Manager.
3. Upload and extract this ZIP there. Replace composer.json and
   config/sanctum.php only. The ZIP contains those exact relative paths.
   Leave .env, APP_KEY, storage, frontend and database untouched.
4. From that backend directory run, one at a time:

   php composer.phar update --no-dev --optimize-autoloader
   php composer.phar check-platform-reqs --no-dev
   php composer.phar audit --no-dev
   php artisan --version
   php artisan optimize:clear

   Stop at any error. Do not turn off advisory blocking or ignore platform
   requirements. Keep the generated composer.lock for future deployments;
   future deployments should use install, not update.
5. For a NEW installation only, if .env does not exist, copy .env.example
   to .env, configure production/database/mail values and generate APP_KEY
   once using php artisan key:generate. Never overwrite an existing .env
   or regenerate an existing APP_KEY.
6. With the correct database credentials and a backup, run:

   php artisan migrate --force

   Do not use migrate:fresh. For a new installation create the administrator
   using php artisan veltrix:admin your-email@example.com.
7. Point the domain document root at backend/public. storage and
   bootstrap/cache must be writable by the PHP user. Keep APP_DEBUG=false.
8. Test enquiry submission, admin login, HRM departments/employees,
   attendance, leave review and CSV export before switching live traffic.

Validation limits:
This is an upgrade patch prepared from the official 10-to-11 and 11-to-12
guides. JSON validity, patch scope and existing token migration were checked.
PHP and Composer are unavailable in the creation environment. Dependency
resolution, security audit, Laravel boot and database tests have NOT run.
This patch is not a claim of a verified production deployment and includes
neither vendor nor composer.lock. The server commands above must succeed.
For development/staging automated tests, install dev dependencies with
php composer.phar install, then run php artisan test using the supplied
SQLite test configuration (PHP SQLite support is needed).

References:
https://laravel.com/docs/11.x/upgrade
https://laravel.com/docs/12.x/upgrade
https://laravel.com/docs/12.x/releases
https://getcomposer.org/doc/06-config.md
