chore(deps): bump laravel/passport from 12.4.3 to 13.7.5

[dependabot]

Bumps laravel/passport from 12.4.3 to 13.7.5.

Release notes

Sourced from laravel/passport's releases.

v13.7.5

• Add notice of invalid tokens when user and client id match by @​Levivb in laravel/passport#1910
• Clarify that running passport:hash is not optional by @​bram-pkg in laravel/passport#1911

v13.7.4

• [13.x] Support space-delimited prompt parameter by @​hafezdivandari in laravel/passport#1906

v13.7.3

• [13.x] Fix session JSON serialization by @​hafezdivandari in laravel/passport#1905

v13.7.2

• [13.X] fix: resolve user as null when user ID matches client ID on integer key setups by @​Can-Kar in laravel/passport#1902

v13.7.1

• Prevent user impersonation via client credentials token by @​pushpak1300 in laravel/passport#1901

v13.7.0

• [13.x] Add middleware attribute by @​axlon in laravel/passport#1897

v13.6.0

• Add Boost skill for Passport development by @​pushpak1300 in laravel/passport#1893

v13.5.0

• Add mixin annotation for Token model in AccessToken by @​fjkorf in laravel/passport#1886
• Add dedicated token lifetime for client credentials grant by @​sajanp in laravel/passport#1880
• Add missing OAuthenticatable interface step to upgrade guide by @​FeBe95 in laravel/passport#1887
• Improve code syntax highlighting in upgrade guide by @​FeBe95 in laravel/passport#1890
• Allow custom middleware to be registered by @​timacdonald in laravel/passport#1892
• Update UPGRADE.md by @​siarheipashkevich in laravel/passport#1891

v13.4.4

• [13.x] Supports Laravel 13 by @​crynobone in laravel/passport#1885
• [13.x] Add can and cant methods to Token model by @​hafezdivandari in laravel/passport#1882

v13.4.3

• [13.x] Allow firebase/php-jwt v7 by @​hafezdivandari in laravel/passport#1879

v13.4.2

• [13.x] PHP 8.5 Compatibility by @​crynobone in laravel/passport#1869
• Remove the usage of deprecated $request->get() by @​hivokas in laravel/passport#1873
• [13.x] Allow setting the client with Passport::actingAs() by @​axlon in laravel/passport#1876

v13.4.1

• [13.x] Fix possible 500 error when retrieving user on token guard by @​hafezdivandari in laravel/passport#1871

v13.4.0

• [13.x] Add static setter for authorizationServerResponseType by @​RSpeekenbrink in laravel/passport#1867

v13.3.0

• chore(UPGRADE): v13, update oauth_clients table schema changes by @​maximepvrt in laravel/passport#1865

... (truncated)

Changelog

Sourced from laravel/passport's changelog.

v13.7.5 - 2026-04-16

• Add notice of invalid tokens when user and client id match by @​Levivb in laravel/passport#1910
• Clarify that running passport:hash is not optional by @​bram-pkg in laravel/passport#1911

v13.7.4 - 2026-04-09

• [13.x] Support space-delimited prompt parameter by @​hafezdivandari in laravel/passport#1906

v13.7.3 - 2026-04-07

• [13.x] Fix session JSON serialization by @​hafezdivandari in laravel/passport#1905

v13.7.2 - 2026-04-02

• [13.X] fix: resolve user as null when user ID matches client ID on integer key setups by @​Can-Kar in laravel/passport#1902

This change permanently invalidates client credential tokens for any user whose user ID happens to match the client ID of the token issuer.

v13.7.1 - 2026-04-01

• Prevent user impersonation via client credentials token by @​pushpak1300 in laravel/passport#1901

v13.7.0 - 2026-03-21

• [13.x] Add middleware attribute by @​axlon in laravel/passport#1897

v13.6.0 - 2026-03-05

• Add Boost skill for Passport development by @​pushpak1300 in laravel/passport#1893

v13.5.0 - 2026-02-23

• Add mixin annotation for Token model in AccessToken by @​fjkorf in laravel/passport#1886
• Add dedicated token lifetime for client credentials grant by @​sajanp in laravel/passport#1880
• Add missing OAuthenticatable interface step to upgrade guide by @​FeBe95 in laravel/passport#1887
• Improve code syntax highlighting in upgrade guide by @​FeBe95 in laravel/passport#1890
• Allow custom middleware to be registered by @​timacdonald in laravel/passport#1892
• Update UPGRADE.md by @​siarheipashkevich in laravel/passport#1891

v13.4.4 - 2026-02-09

• [13.x] Supports Laravel 13 by @​crynobone in laravel/passport#1885
• [13.x] Add can and cant methods to Token model by @​hafezdivandari in laravel/passport#1882

v13.4.3 - 2025-12-22

• [13.x] Allow firebase/php-jwt v7 by @​hafezdivandari in laravel/passport#1879

v13.4.2 - 2025-12-15

... (truncated)

Upgrade guide

Sourced from laravel/passport's upgrade guide.

Upgrade Guide

General Notes

Upgrading To 13.0 From 12.x

Minimum PHP Version

PR: laravel/passport#1734, laravel/passport#1783

PHP 8.2 is now the minimum required version.

Minimum Laravel Version

PR: laravel/passport#1757, laravel/passport#1783, laravel/passport#1797

Laravel 11.35 is now the minimum required version.

OAuth2 Server

PR: laravel/passport#1734

The league/oauth2-server Composer package which is utilized internally by Passport has been updated to 9.0, which adds additional types to method signatures. To ensure your application is compatible, you should review this package's complete changelog.

Headless

PR: laravel/passport#1771

Passport's views were not rendering properly for several release cycles. Passport is now a headless OAuth2 library. If you would like a frontend implementation of Laravel Passport's OAuth features that are already completed for you, you should use an application starter kit.

All the authorization view's rendering logic may be customized using the appropriate methods available via the Laravel\Passport\Passport class. Typically, you should call these methods within the boot method of your application's App\Providers\AppServiceProvider class. Passport will take care of defining the routes that return these views:

public function boot(): void
{
    // By providing the view names...
    Passport::authorizationView('auth.oauth.authorize');
    Passport::deviceUserCodeView('auth.oauth.device.user-code');
    Passport::deviceAuthorizationView('auth.oauth.device.authorize');
// Or using conventional names under the given prefix...
Passport::viewPrefix('auth.oauth');

}

User Model Interface

PR: laravel/passport#1797

Passport 13 introduces the Laravel\Passport\Contracts\OAuthenticatable interface, which must now be

... (truncated)

Commits

• 90053dc Clarify that running passport:hash is not optional (#1911)
• ed8956c add notices of invalid tokens when user and client have identical ids (#1910)
• d085f96 Update CHANGELOG
• 16c4579 [13.x] Support space-delimited prompt parameter (#1906)
• cfcd9db Update CHANGELOG
• f4f85e3 [13.x] Fix session JSON serialization (#1905)
• 27ba0a8 Update CHANGELOG
• 0c016c9 [13.X] fix: resolve user as null when user ID matches client ID on integer ke...
• dd68c65 Update CHANGELOG
• ca14d97 Prevent user impersonation via client credentials token (#1901)
• Additional commits viewable in compare view