The below code has a vulnerability that could lead to a SQL Injection attack. Because the binding value of is_admin would-be 1 instead 0. This happens due to the false binding when passing an array $value = [1,1] to the where() method.

User::where('id', [1,1])->where('is_admin', 0)->first();
// sql: select * from `users` where `id` = 1 and `is_admin` = 1

But this has now been covered in the update. The query string will now be like this:

// sql: select * from `users` where `id` = 1 and `is_admin` = 0

In the above section, we have talked about Laravel 9 and Laravel 10 new features, and the security vulnerabilities are covered. Next, let us show you how to upgrade your Laravel project from version 8 to 10.

Migrate your project from Laravel 8 to Laravel 10:

Upgrade to PHP 8.1.0 & Composer 2.2.0:

Since Laravel 10 requires at least PHP 8.1.0, you must upgrade to PHP 8.1.0. Also, you must upgrade Composer to 2.2.0 or greater. This is a very crucial step. You must complete it before proceeding to the next section.

Make changes to your dependencies in composer.json:

a. Packages version upgrade:

Below are packages that need to update to newer versions. Follow the instruction to update them.

In your composer.json, change the version of these items as the following:

{
  "require": {
    "php": "^8.1",
    "laravel/framework": "^10.0",
    "laravel/sanctum": "^3.2",
    "doctrine/dbal": "^3.0",
    "laravel/passport": "^11.0"
  },
  "require-dev": {
    "nunomaduro/collision": "^6.1",
    "spatie/laravel-ignition": "^2.0"
  }
}

If your project uses the Broadcasting feature, you must also change this item version:

{
  "require": {
    "pusher/pusher-php-server": "^5.0"
  }
}

If you use the S3, FTP, or SFTP drivers through Storage, you must also change this item version:

{
  "require": {
    "league/flysystem-aws-s3-v3": "^3.0",
    "league/flysystem-ftp": "^3.0",
    "league/flysystem-sftp-v3": "^3.0"
  }
}

Furthermore, if you wish to use PHPUnit 10, you should delete the processUncoveredFiles="true" attribute from the <coverage> section of your application’s phpunit.xml configuration file. Then, update the following dependencies in your application’s composer.json file:

{
  "require-dev": {
    "nunomaduro/collision": "^7.0",
    "phpunit/phpunit": "^10.0"
  }
}

b. Removed packages:

These packages are no longer required or used, so you should remove it.

Trusted Proxies:

In your app/Http/Middleware/TrustProxies.php file, update

use Fideloper\Proxy\TrustProxies as Middleware;

to this

use Illuminate\Http\Middleware\TrustProxies as Middleware;

Next, in app/Http/Middleware/TrustProxies.php, you should update the $headers property definition:

// Before...
protected $headers = Request::HEADER_X_FORWARDED_ALL;
// After...
protected $headers =
    Request::HEADER_X_FORWARDED_FOR |
    Request::HEADER_X_FORWARDED_HOST |
    Request::HEADER_X_FORWARDED_PORT |
    Request::HEADER_X_FORWARDED_PROTO |
    Request::HEADER_X_FORWARDED_AWS_ELB;

Finally, you can remove the fideloper/proxy from your application:

{
  "require": {
    // Remove this package
    "fideloper/proxy": "^4.4"
  }
}

Fruitcake/laravel-cors:

This package is no longer maintained. And in Laravel 10, it is removed. First, in the app\Http\Kernel.php, you must change the namespace of HandleCors middleware.

\Fruitcake\Cors\HandleCors::class

to

\Illuminate\Http\Middleware\HandleCors::class

Then, remove it from composer.json:

{
  "require": {
    // Remove this package
    "fruitcake/laravel-cors": "^2.0"
  }
}

c. Packages Replacement:

Switch these items with their replacement in composer.json.

{
  "require-dev": {
    // Replace this
    "facade/ignition": "^2.5"
    // With this
    "spatie/laravel-ignition": "^1.0"
  }
}

For the Laravel SMS Notifications feature, you must be aware that Nexmo is now acquired by Vonage. Therefore, make changes to your composer.json:

{
  "require": {
    // Replace this
    "laravel/nexmo-notification-channel": "^2.0"
    // With this
    "laravel/vonage-notification-channel": "^3.0"
  }
}

d. Swift Mailer is replaced with Symfony Mailer:

One of the largest changes in Laravel 9.x is the transition from SwiftMailer, which is no longer maintained as of December 2021, to Symfony Mailer. To upgrade, run the following command:

composer remove wildbit/swiftmailer-postmark
composer require symfony/mailgun-mailer symfony/postmark-mailer symfony/http-client

Run “composer update”:

After making all changes to the composer.json, run the “composer update” command. Be aware that all the above packages are just for Laravel basis, so you must also upgrade your project’s other dependencies (if required). If you don’t upgrade them, they will conflict with Laravel dependencies.

When you have successfully run the command, next, you need to refactor your source code to remove deprecated features so that your project can normally function. Finally, you might want to consider using new features or applying features that changed in the new version of Laravel.

Configuration changes:

In your config/database.php, change the ‘schema’ to ‘search_path’ for Postgres database configuration:

'connections' => [
  'pgsql' => [
    // replace this
    'schema' => 'public',
    // by this
    'search_path' => 'public',
  ]
]

If you are using SFTP through Laravel Storage, in your config/filesystems.php:

'sftp' => [
  // Replace this         
  'password' => env('SFTP_PASSPHRASE'),
  // By this
  'passphrase' => env('SFTP_PASSPHRASE'),
]

Defining stream options for the SMTP is no longer supported. Instead, you must define the relevant options directly within the configuration if they are supported. For example, to disable TLS peer verification, you can follow the below configuration. Also, notice that auth_mode is commented out since this is no longer available in Laravel’s new version.

'smtp' => [
  // 'auth_mode' => null,

  // Laravel 8.x...
  'stream' => [
      'ssl' => [
          'verify_peer' => false,
      ],
  ],
  // Laravel 9.x...
  'verify_peer' => false,
]

Directories structure changes:

In new Laravel applications, the resources/lang directory is now located in the root project directory (lang). If you’ve been hardcode the lang directory, you must update it. You should use app()->langPath() instead of a hard-coded path.

Refactor your code:

There are breaking changes and deprecated features that are required to make changes in the source code when upgrading to Laravel 10. You don’t have to change the code for every feature list below because it depends on whether the feature is used by your project.

Removed functions:

These functions exist in Laravel 8 but are no longer available in Laravel’s newer version. So you need to search for all of them in your source code, then fix it manually.

EnumeratesValues Trait: the reduceWithKeys() method is removed, so you might use reduce() method instead. And the reduceMany() method has been renamed to reduceSpread().

Illuminate\Database\Schema\Builder::registerCustomDoctrineType() method has been removed. You may use the registerDoctrineType() method on the DB facade instead or register custom Doctrine types in the config/database.php configuration file.

Testing: All assertDeleted() method calls should be updated to assertModelMissing().

Queue: the Bus::dispatchNow() and dispatch_now() methods have been removed. Instead, your application should use the Bus::dispatchSync() and dispatch_sync() methods, respectively.

The Redirect::home() method has been removed. Instead, your application should redirect to an explicitly named route: return Redirect::route('home').

[Deprecated] – Blade – Lazy Collections & The $loop Variable:

@php
    use App\Models\Car;
    $cars = Car::cursor();  // cars lazy collection
    foreach($cars as $c) {
        echo $loop->iteration;
    }
@endphp

In the above snippet, you are trying to use $loop var in a LazyCollection. This is no longer suporrted. This doesn’t mean that the $loop var is removed, but you should not use it with LazyCollection because it causes the entire Collection to be loaded into memory (that is not how LazyCollection is supposed to be).

[Removed] – Storage:

Storage – Flysystem no longer supports cached-adapters feature. You should remove it using the composer command:

composer require league/flysystem-cached-adapter

[Removed] Get DB Expression string value:

In the previous version, you might do this to get the Expression string:

$expression = DB::raw('select * from news');
$expStr = (string)$expression;

But that is no longer supported, instead:

$expStr = $expression->getValue(DB::connection()->getQueryGrammar());

[Removed] Eloquent model’s $date property:

The Eloquent model’s deprecated $dates property has been removed.

protected $dates = [
    'deployed_at'
];

Your application should now use the $casts property:

protected $casts = [
    'deployed_at' => 'datetime',
];

[Removed] Testing – Service Mocking:

The deprecated MocksApplicationServices trait has been removed from the framework. This trait provided testing methods such as expectsEvents(), expectsJobs(), and expectsNotifications(). If your application uses these methods, we recommend transitioning to Event::fake, Bus::fake, and Notification::fake, respectively. You can learn more about mocking via fakes in the corresponding documentation for the component you are attempting to fake.

[Changed] Validation – the ‘password’ Rule:

The password rule validates that the given input value matches the authenticated user’s current password and has been renamed to current_password.

[Changed] Blade – Avoid overwriting Vue snippet:

Laravel 9 comes with new blade directives @diabled, @checked, and @selected that will overwrite your Vue directives. Therefore, to escape it, you must replace them with escaped ones @@disabled, @@checked, @@selected.

[Changed] – Collections:

You can now pass a closure as the first argument into Collection::when(), unless(). In the previous version, the first argument is always treated as a value and will not be executed. Now you can do this.

$collection->when(function ($collection) {
  // This closure is executed...
  return false;
}, function ($collection) {
  // Not executed since first closure returned "false"...
  $collection->merge([1, 2, 3]);
});

[Changed] – Eloquent – custom cast with a null value:

In Laravel 8, the mutator set() method won’t be executed when $value = null. But in Laravel 9, it will be executed. Due to this change, the result of the below snippet is totally different:

// In App\Casts\FilenameWithTimestamp.php
public function set($model, $key, $value, $attributes) {
  return time() . '_' . $value;
}

// In App\Models\File.php
protected $casts = [
  'filename' => FilenameWithTimestamp::class
];

// Somewhere in your program
// With Laravel 8, the result of the echo statement will be: null
// With Laravel 9, the result of the echo statement will be: "20230322_"
$file = File::first();
$file->filename = null;
echo $file->filename;

As you can see, it makes no sense the filename got prefixed with a timestamp even when it was set to null. So, in Laravel 9, you must handle “the null case” for all of your custom casts. E.g.:

// In App\Casts\FilenameWithTimestamp.php
public function set($model, $key, $value, $attributes) {
  if (empty($value)) {
    return '';
  }
  return time() . '_' . $value;
}

Now it works as expected.

[Changed] Storage – Throw exception behavior:

Previously, Laravel will throw exceptions for failure operations such as reading or deleting unexisting files. But in the newer version, Laravel simply returns the appropriate result, such as false, null, or true,…
This change could make an impact on your program if you’ve been using the try-catch block to handle the failures. Therefore, you either config to the default behavior (like below) or just refactor your code to check for failures (e.g., using if-else block)

'public' => [
  'driver' => 'local',
  // ...
  'throw' => true,
]

[Changed] Storage – Custom Filesystems:

Slight changes have been made to the steps required to register custom filesystem drivers. Therefore, if you were defining your own custom filesystem drivers or using packages that define custom drivers, you should update your code and dependencies.

For example, in Laravel 8.x, a custom filesystem driver might be registered like so:

use Illuminate\Support\Facades\Storage;
use League\Flysystem\Filesystem;
use Spatie\Dropbox\Client as DropboxClient;
use Spatie\FlysystemDropbox\DropboxAdapter;

Storage::extend('dropbox', function ($app, $config) {
    $client = new DropboxClient(
        $config['authorization_token']
    );

    return new Filesystem(new DropboxAdapter($client));
});

However, in Laravel 9.x, the callback given to the Storage::extend method should return an instance of Illuminate\Filesystem\FilesystemAdapter directly:

use Illuminate\Filesystem\FilesystemAdapter;
use Illuminate\Support\Facades\Storage;
use League\Flysystem\Filesystem;
use Spatie\Dropbox\Client as DropboxClient;
use Spatie\FlysystemDropbox\DropboxAdapter;

Storage::extend('dropbox', function ($app, $config) {
    $adapter = new DropboxAdapter(
        new DropboxClient($config['authorization_token'])
    );

    return new FilesystemAdapter(
        new Filesystem($adapter, $config),
        $adapter,
        $config
    );
});

[Changed] Migrate from Swift Mailer to Symfony Mailer:

In Lavarel 8 and the previous version, Laravel used the Swift Mailer library to send outgoing emails. However, that library is no longer maintained and has been succeeded by Symfony Mailer, which made this transition one of the largest changes. Therefore, you must refactor your code base as below.

Renamed “Swift” Methods: various SwiftMailer-related methods, some of which were undocumented, have been renamed to their Symfony Mailer counterparts. Use the advanced search of your IDE and perform the mass replacement for these methods with the following:

Message::getSwiftMessage();
Message::getSymfonyMessage();

Mailable::withSwiftMessage($callback);
Mailable::withSymfonyMessage($callback);

MailMessage::withSwiftMessage($callback);
MailMessage::withSymfonyMessage($callback);

Mailer::getSwiftMailer();
Mailer::getSymfonyTransport();

Mailer::setSwiftMailer($swift);
Mailer::setSymfonyTransport(TransportInterface $transport);

MailManager::createTransport($config);
MailManager::createSymfonyTransport($config);

MessageSent Event Changes:

Illuminate\Mail\Events\MessageSent event has changed to include an instance of type Symfony\Component\Mime\Email instead of type Swift_Message. This instance contains data about the message before it is sent. At the same time, a new property called sent has been added too. This new property contains data about the message after it is sent, for example, the MessageID.

Failed Recipients:

It is no longer possible to retrieve a list of failed recipients after sending a message. Instead, a Symfony\Component\Mailer\Exception\TransportExceptionInterface exception will be thrown if a message fails to send.

Comprehensive Exam:

We have created the exam to check your comprehension of this article.
Let’s try it!!

https://exam-site.briswell-vn.com/startTest/BhAaDPZtsN

References:

• https://laravel.com/docs/9.x/releases
• https://laravel.com/docs/10.x/releases
• Laracasts: What’s New in Laravel 9
• Laracasts: What’s New in Laravel 10
• https://github.com/laravel/laravel/compare/8.x…9.x
• https://github.com/laravel/laravel/compare/9.x…10.x
• https://security.snyk.io/package/composer/laravel%2Fframework