build(deps-dev): bump the version-updates group with 4 updates

[dependabot]

Bumps the version-updates group with 4 updates: larastan/larastan, laravel/boost, laravel/pint and phpstan/phpstan.

Updates larastan/larastan from 3.11.0 to 3.12.1

Release notes

Sourced from larastan/larastan's releases.

3.12.1

What's Changed

Fixed

• Preserve custom builder types in relation count queries and BelongsToMany::firstWhere() callbacks by @​canvural in 2e561c8
• Allow null and object HTTP request body data by @​lazerg in #2507

Changed

• Require PHPStan 2.2.14 or newer by @​canvural in 7cf994b

Internal

• Correct the collection concat() key type expectation by @​canvural in 7cf994b
• Update agent contributor guidelines by @​canvural in 168fd3b

Full Changelog: v3.12.0...v3.12.1

3.12.0

What's Changed

Added

• Extend view-string coverage to more view-name signatures by @​maks-oleksyuk in #2513. Read more about it here.
• Add seven opt-in rules for queued jobs by @​laravel-o11y in #2522. Read more about it here.
• Detect anonymous Blade component views in checkUnusedViews by @​G4Zz0L1 in #2519. Read more about it here.
• Add ResponseInterface mixin to the HTTP client Response stub by @​ramonrietdijk in #2428
• Add builder-of<Model> custom PHPDoc type by @​canvural in #2374. Read more about it here.
• Infer array shapes for model toArray() and attributesToArray() calls by @​canvural in 75ea2fd. Read more about it here.
• Check view names passed to mailable Content constructors by @​canvural in 43f9cae. Read more about it here.
• Add an opt-in rule requiring explicit model query builder calls, with automatic fixes, by @​canvural in 59fa341. Read more about it here.
• Infer relationship query callback types and support relationship paths in builder-of by @​canvural in 62342c8. Read more about it here.

Fixed

• Refine queue rule checks and diagnostics by @​canvural in 80838e1
• Resolve typed migration table constants by @​riasvdv in #2520
• Preserve static in the newQuery() method family on non-final models by @​yeapea in #2544
• Preserve model types and custom builders with builder-of by @​canvural in a23d0c9
• Preserve custom paginator collection types and track key and value types through setCollection() by @​canvural in f336303. Read more about it here.
• Avoid crashes when models implement missing interfaces by @​canvural in bce4756
• Fix callback types for Eloquent where subqueries by @​canvural in eb73731

Changed

• Expand relation existence checking to more query and loading methods, Eloquent collections, and model $with and $withCount defaults by @​canvural in 99a3b0e. Read more about it here.

Internal

... (truncated)

Commits

• 168fd3b chore: update AGENTS file
• 7cf994b fix: require phpstan 2.2.14 and correct concat expectation
• fa32723 fix: allow null and object as Http request body data (#2507)
• 2e561c8 fix: add more stubs to use builder-of
• ab26fdf test: support older PHPStan closure diagnostics
• eb73731 fix: infer where subquery callback types
• bce4756 fix: handle missing model interfaces
• 62342c8 feat: infer relationship query callback types
• 59fa341 feat: add opt-in explicit model query rule
• 43f9cae feat: check mailable Content view names
• Additional commits viewable in compare view

Updates laravel/boost from 2.7.1 to 2.9.0

Release notes

Sourced from laravel/boost's releases.

v2.9.0

What's Changed

• Bump the github-actions group with 2 updates by @​dependabot[bot] in laravel/boost#1020
• Point the skill sync workflow at the renamed deploying-to-cloud folder in cloud-cli by @​sulimanbenhalim in laravel/boost#1021
• Support laravel/mcp 1.x by @​pushpak1300 in laravel/boost#1028

Full Changelog: laravel/boost@v2.8.1...v2.9.0

v2.8.1

What's Changed

• Run test workflows on pushes to main by @​Mohammad-Ranjbar in laravel/boost#1013
• feat: support third-party NPM package guidelines and skills by @​calebdw in laravel/boost#935
• Reject backslash paths when downloading a skill so files cannot land outside the skill directory by @​sulimanbenhalim in laravel/boost#963
• Ignore commented-out entries when checking for existing MCP servers by @​lazerg in laravel/boost#933
• Treat a whitespace-only MCP config file as new instead of failing the install by @​sulimanbenhalim in laravel/boost#1018
• Resolve the browser log path from the browser channel config instead of a hardcoded location by @​sulimanbenhalim in laravel/boost#1017
• Preserve SQL literals when applying table prefixes by @​Mohammad-Ranjbar in laravel/boost#1014
• Record rules only when the user asks for them by @​pushpak1300 in laravel/boost#1019

Full Changelog: laravel/boost@v2.8.0...v2.8.1

v2.8.0

What's Changed

• Remove redundant test lifecycle overrides by @​Mohammad-Ranjbar in laravel/boost#1004
• Leave fenced code blocks alone when spacing markdown headings by @​sulimanbenhalim in laravel/boost#961
• Throw on invalid SKILL.md frontmatter instead of silently unregistering the skill by @​shoemoney in laravel/boost#965
• Show repo-relative skill paths with forward slashes on Windows by @​pushpak1300 in laravel/boost#1011
• Stop normalizing blank lines outside the Boost guidelines block by @​sulimanbenhalim in laravel/boost#996
• Use installed PHPUnit version in testing skill docs by @​Mohammad-Ranjbar in laravel/boost#1008
• Fix entity decoding in fenced code blocks by @​Mohammad-Ranjbar in laravel/boost#997
• Fix: browser-logs watcher can crash any Livewire page via JSON.stringify auto-invoking $wire's fake toJSON by @​thealejandro in laravel/boost#1007
• Drop the truncated leading fragment when the log chunk boundary lands inside an entry by @​sulimanbenhalim in laravel/boost#1009
• Bundle the Laravel Cloud skill and sync it nightly from cloud-cli by @​pushpak1300 in laravel/boost#1012
• Key nested user guidelines by relative path so same-named files stop overwriting each other by @​sulimanbenhalim in laravel/boost#1010

New Contributors

• @​shoemoney made their first contribution in laravel/boost#965
• @​thealejandro made their first contribution in laravel/boost#1007

Full Changelog: laravel/boost@v2.7.1...v2.8.0

Changelog

Sourced from laravel/boost's changelog.

v2.9.0 - 2026-09-14

What's Changed

• Bump the github-actions group with 2 updates by @​dependabot[bot] in laravel/boost#1020
• Point the skill sync workflow at the renamed deploying-to-cloud folder in cloud-cli by @​sulimanbenhalim in laravel/boost#1021
• Support laravel/mcp 1.x by @​pushpak1300 in laravel/boost#1028

Full Changelog: laravel/boost@v2.8.1...v2.9.0

v2.8.1 - 2026-09-10

What's Changed

• Run test workflows on pushes to main by @​Mohammad-Ranjbar in laravel/boost#1013
• feat: support third-party NPM package guidelines and skills by @​calebdw in laravel/boost#935
• Reject backslash paths when downloading a skill so files cannot land outside the skill directory by @​sulimanbenhalim in laravel/boost#963
• Ignore commented-out entries when checking for existing MCP servers by @​lazerg in laravel/boost#933
• Treat a whitespace-only MCP config file as new instead of failing the install by @​sulimanbenhalim in laravel/boost#1018
• Resolve the browser log path from the browser channel config instead of a hardcoded location by @​sulimanbenhalim in laravel/boost#1017
• Preserve SQL literals when applying table prefixes by @​Mohammad-Ranjbar in laravel/boost#1014
• Record rules only when the user asks for them by @​pushpak1300 in laravel/boost#1019

Full Changelog: laravel/boost@v2.8.0...v2.8.1

v2.8.0 - 2026-09-08

What's Changed

• Remove redundant test lifecycle overrides by @​Mohammad-Ranjbar in laravel/boost#1004
• Leave fenced code blocks alone when spacing markdown headings by @​sulimanbenhalim in laravel/boost#961
• Throw on invalid SKILL.md frontmatter instead of silently unregistering the skill by @​shoemoney in laravel/boost#965
• Show repo-relative skill paths with forward slashes on Windows by @​pushpak1300 in laravel/boost#1011
• Stop normalizing blank lines outside the Boost guidelines block by @​sulimanbenhalim in laravel/boost#996
• Use installed PHPUnit version in testing skill docs by @​Mohammad-Ranjbar in laravel/boost#1008
• Fix entity decoding in fenced code blocks by @​Mohammad-Ranjbar in laravel/boost#997
• Fix: browser-logs watcher can crash any Livewire page via JSON.stringify auto-invoking $wire's fake toJSON by @​thealejandro in laravel/boost#1007
• Drop the truncated leading fragment when the log chunk boundary lands inside an entry by @​sulimanbenhalim in laravel/boost#1009
• Bundle the Laravel Cloud skill and sync it nightly from cloud-cli by @​pushpak1300 in laravel/boost#1012
• Key nested user guidelines by relative path so same-named files stop overwriting each other by @​sulimanbenhalim in laravel/boost#1010

New Contributors

• @​shoemoney made their first contribution in laravel/boost#965
• @​thealejandro made their first contribution in laravel/boost#1007

Full Changelog: laravel/boost@v2.7.1...v2.8.0

Commits

• ebe59d9 Allow laravel/mcp 1.0 (#1028)
• b4fdbf8 Update skills from upstream
• 2ea83b8 Point the skill sync workflow at the renamed deploying-to-cloud folder in clo...
• 3fe1cf3 Bump the github-actions group with 2 updates (#1020)
• 44eb359 Update CHANGELOG
• 820bc93 Soften Boost's rule recording and test enforcement guidance (#1019)
• 549e73e Preserve SQL literals when applying table prefixes (#1014)
• d3bfc8e Resolve the browser log path from the browser channel config instead of a har...
• 9e03bbf Treat a whitespace-only MCP config file as new instead of failing the install...
• d92c65d Ignore commented-out entries when checking for existing MCP servers (#933)
• Additional commits viewable in compare view

Updates laravel/pint from 1.31.0 to 1.32.1

Release notes

Sourced from laravel/pint's releases.

v1.32.1

Full Changelog: laravel/pint@v1.32.0...v1.32.1

v1.32.0

Full Changelog: laravel/pint@v1.31.1...v1.32.0

v1.31.1

What's Changed

• deps: composer update by @​calebdw in laravel/pint#489

Full Changelog: laravel/pint@v1.31.0...v1.31.1

Commits

• 006bd78 release: v1.32.1
• 10cc988 fix: never leaves a trailing comma on a multiline directive argument
• dea4e95 release: v1.32.0
• b136ceb release: v1.31.1
• 0f79321 deps: composer update (#489)
• See full diff in compare view

Updates phpstan/phpstan from 2.2.13 to 2.2.14

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions