chore: bump version to 2.1.3

fix: add PHPStan/Larastan support to CartFacade

.github/dependabot.yml

@@ -1,17 +1,33 @@
 version: 2
-
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
-    target-branch: "master"
     schedule:
       interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore"
+      include: "scope"
     labels:
-      - "deps"
+      - "dependencies"
+
   - package-ecosystem: "composer"
     directory: "/"
-    target-branch: "master"
     schedule:
       interval: "weekly"
+      day: "tuesday"
+    open-pull-requests-limit: 10
+    groups:
+      php-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
     labels:
-      - "deps"
+      - "dependencies"

.github/workflows/dependabot-auto-merge.yml

@@ -13,7 +13,7 @@ jobs:
 
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2.2.0
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/tests.yml

@@ -9,19 +9,19 @@ on:
 jobs:
   tests:
     name: Tests
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: true
       matrix:
-        php: ['8.3', '8.4', '8.5']
+        php: ["8.3", "8.4", "8.5"]
         stability: [prefer-stable]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, gd, redis, memcached
@@ -29,12 +29,11 @@ jobs:
           coverage: none
 
       - name: Install dependencies
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           timeout_minutes: 5
           max_attempts: 5
           command: composer update --${{ matrix.stability }} --prefer-dist --no-interaction --no-progress ${{ matrix.flags }}
 
-
       - name: Execute tests
         run: vendor/bin/pest

.gitignore

@@ -4,3 +4,4 @@
 .phpunit.result.cache
 READMETODO.md
 build
+docs/superpowers/

README.md

@@ -9,11 +9,12 @@
 
 A Cart Implementation for Laravel.
 
-Supported Laravel Versions: 10, 11, and 12.
+Supported Laravel Versions: 10, 11, 12, and 13.
 
 For Laravel 9.0 and below, please use version [1.0](https://github.com/wearepixel/laravel-cart/releases/tag/1.0.12)
 
 ## Table of Contents
+
 - [Getting Started](#-getting-started)
 - [Demo](#-deni)
 - [Documentation](#-documentation)
@@ -27,6 +28,7 @@ ## Table of Contents
 - [License](#-license)
 
 ## 🚀 Getting Started
+
 ### 🔥 Installing
 
 Install the package through [Composer](http://getcomposer.org/).
@@ -107,7 +109,6 @@ #### Round Mode
 'round_mode' => env('LARAVEL_CART_ROUND_MODE', 'down'),
 ```
 
-
 ### Basic Usage
 
 The cart has a default sessionKey that holds the cart data and stores it in the session, so you can have multiple carts for multiple users.

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+**PLEASE DON'T DISCLOSE SECURITY-RELATED ISSUES PUBLICLY, [SEE BELOW](#reporting-a-vulnerability).**
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately using the below channel:
+
+**GitHub Private Vulnerability Reporting** — go to the repository's **Security** tab and click **"Report a vulnerability"**. This creates a private advisory visible only to maintainers and provides a structured workflow for triage, fix coordination, and CVE assignment.
+
+All security vulnerabilities will be promptly addressed.

composer.json

@@ -1,6 +1,6 @@
 {
   "name": "wearepixel/laravel-cart",
-  "version": "2.1.0",
+  "version": "2.1.3",
   "description": "A cart implementation for Laravel",
   "keywords": [
     "laravel",
@@ -29,7 +29,7 @@
   "require-dev": {
     "mockery/mockery": "^2.0",
     "laravel/pint": "^1.21",
-    "pestphp/pest": "^3.0",
+    "pestphp/pest": "^4.7",
     "larapack/dd": "dev-master"
   },
   "autoload": {

phpunit.xml.dist

@@ -1,15 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         bootstrap="vendor/autoload.php"
-         colors="true"
-         xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.4/phpunit.xsd"
->
-<source>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" bootstrap="tests/bootstrap.php" colors="true" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/11.5/phpunit.xsd">
+  <source ignoreIndirectDeprecations="true">
     <include>
       <directory suffix=".php">./src</directory>
     </include>
   </source>
-    <testsuites>
+  <testsuites>
     <testsuite name="Laravel Cart Test Suite">
       <directory>tests</directory>
     </testsuite>

src/Facades/CartFacade.php

@@ -3,10 +3,40 @@
 namespace Wearepixel\Cart\Facades;
 
 use Illuminate\Support\Facades\Facade;
+use Wearepixel\Cart\Cart;
+use Wearepixel\Cart\CartCollection;
+use Wearepixel\Cart\CartCondition;
+use Wearepixel\Cart\CartConditionCollection;
+use Wearepixel\Cart\ItemCollection;
 
+/**
+ * @mixin Cart
+ *
+ * @method static ItemCollection|null get(int|string $itemId)
+ * @method static bool has(int|string $itemId)
+ * @method static self add(string|int|array<string, mixed> $id, string|null $name = null, float|null $price = null, int|float|null $quantity = null, array<string, mixed> $attributes = [], CartCondition|array<mixed> $conditions = [], string|null $associatedModel = null)
+ * @method static bool update(int|string $id, array $data)
+ * @method static void remove(int|string $id)
+ * @method static void clear()
+ * @method static void clearItems()
+ * @method static Cart condition(array|CartCondition $condition)
+ * @method static CartConditionCollection|array getConditions(bool $array = false, bool $active = false)
+ * @method static CartCondition|null getCondition(string $conditionName)
+ * @method static CartConditionCollection getConditionsByType(string $type)
+ * @method static void removeConditionsByType(string $type)
+ * @method static void removeCartCondition(string $conditionName)
+ * @method static void clearItemConditions(int|string $itemId)
+ * @method static void clearAllConditions()
+ * @method static CartCollection getContent()
+ * @method static bool isEmpty()
+ * @method static int getTotalQuantity()
+ * @method static int|float|string getSubTotal(bool $formatted = true)
+ * @method static int|float|string getSubTotalWithoutConditions(bool $formatted = true)
+ * @method static int|float getTotal()
+ */
 class CartFacade extends Facade
 {
-    protected static function getFacadeAccessor()
+    protected static function getFacadeAccessor(): string
     {
         return 'cart';
     }

tests/bootstrap.php

@@ -0,0 +1,14 @@
+<?php
+
+require __DIR__ . '/../vendor/autoload.php';
+
+// Suppress PHP 8.4 deprecation notices that originate from vendor code.
+// These are typically from third-party packages (e.g. Mockery) that have not
+// yet updated implicit-nullable parameter signatures and are not actionable here.
+set_error_handler(static function (int $errno, string $errstr, string $errfile): bool {
+    if ($errno === E_DEPRECATED && str_contains($errfile, DIRECTORY_SEPARATOR . 'vendor' . DIRECTORY_SEPARATOR)) {
+        return true;
+    }
+
+    return false;
+}, E_DEPRECATED);