Upgrades to Laravel 13

[syropian]

Summary

Upgrades the app from Laravel 12 to Laravel 13 (12.52 → 13.15). The framework bump itself is small — the bulk of the work was migrating Hybridly 0.9 → 0.10 (required for L13 support), which carried a number of breaking changes. Also swaps the now-abandoned genealabs/laravel-model-caching for its successor mike-bronner/laravel-model-caching.

What's changed

Dependencies

• laravel/framework → ^13, plus Pest 4 / PHPUnit 12, tinker 3, debugbar 4, and L13-compatible bumps of sanctum, socialite, ignition, ide-helper, typescript-transformer, spatie/laravel-data.
• Frontend: hybridly → 0.10.0-beta.26; re-added unplugin-auto-import / unplugin-vue-components / unplugin-icons (0.10 no longer bundles them).
• Swapped genealabs/laravel-model-caching → mike-bronner/laravel-model-caching (drop-in — identical GeneaLabs\LaravelModelCaching namespace, so the Cachable models are unchanged).

Laravel 13

• CSRF middleware renamed VerifyCsrfToken → PreventRequestForgery (class, kernel, sanctum config).

Hybridly 0.10 migration

• New config/hybridly.php architecture format (component_loader, entrypoint).
• Views/layouts renamed to .view.vue / .layout.vue; backend identifiers → views.*.
• hybridly('x', …) → hybridly()->view('x', …); Deferred namespace move.
• The now-final base middleware replaced by a per-request share()/persist() middleware, with Hybridly's own middleware registered in the web group.
• Validation-errors helper updated to the new protocol-level validation payload.
• vite.config.ts rebuilt with the three unplugin integrations the plugin used to bundle.

Verification

• ✅ Full Pest suite: 106 passed, 2 todos — matches the Laravel 12 baseline.
• ✅ Frontend builds (2,633 modules).
• ✅ Browser smoke test of /auth: page renders, icons resolve to real SVGs, route() produces valid hrefs, and shared security/sponsorUrl props flow through.
• ✅ Pint + prettier applied to touched files.

Notes

• The authenticated dashboard wasn't browser-tested (the dev-login bypass was unavailable in my environment). Its icons and route() calls compile and use the same mechanisms proven on /auth, but a quick manual check while logged in is worth it.
• The first commit (Refreshes Laravel Boost guidelines and skills) is unrelated Boost guideline churn — safe to drop if unwanted.
• composer update was run with --no-scripts; the ide-helper / boost:update post-update scripts haven't been run yet.

Test plan

• CI green (PHP, JS, lint, style gates)
• Manual smoke of the authenticated dashboard — icons, navigation, tag/star/smart-filter CRUD

🤖 Generated with Claude Code