Bump spatie/laravel-data from 4.22.1 to 4.23.0

[dependabot]

Bumps spatie/laravel-data from 4.22.1 to 4.23.0.

Release notes

Sourced from spatie/laravel-data's releases.

4.23.0

A round of bug fixes for validation rules, install resolution, and rule overrides.

Run rules() overrides regardless of property defaults (#1187)

Properties with a default value were silently dropping rules declared in the rules() method when the property was missing from the payload, so conditional rules like required, required_if, and prohibited_if never fired. The skip in DataValidationRulesResolver was originally there to stop auto-generated rules from rejecting empty payloads on all-default data classes (#441), but it also short-circuited explicit overrides.

Overrides are now resolved upfront, and the default-value skip only applies when no override exists for that property. #[WithoutValidation] no longer suppresses an override for the same key. If you wrote rules(), you own them. Thanks @​rubenvanassche.

Fix install conflict on PHP 8.4 with Pest installed (#1186)

composer require spatie/laravel-data failed when Pest was already installed, because Pest's chain pulls phpdocumentor/reflection-docblock 6.0.3 while the phpdocumentor/reflection ^6.0 meta package hard-pinned reflection-docblock ^5. The meta package is now dropped in favour of direct dependencies on the three sub-packages we use, with widened constraints:

-        "phpdocumentor/reflection" : "^6.0",
+        "phpdocumentor/type-resolver" : "^1.7 || ^2.0",
+        "phpdocumentor/reflection-common" : "^2.2",
+        "phpdocumentor/reflection-docblock" : "^5.3 || ^6.0",

The phpDocumentor APIs we call are identical across both majors, so no code changes are required. Thanks @​rubenvanassche.

Allow float values for Min, Max and Size validation attributes (#1185)

The constructors typed their value as int|ExternalReference, and because those classes don't declare strict types, PHP silently coerced floats to int. #[Min(0.01)] became min:0, letting 0 pass validation, even though Laravel's validator accepts floats for these rules. Types are now widened to int|float|ExternalReference, mirroring MultipleOf:

#[Min(0.01), Max(99.99)]
public float $price;

Digit-count rules (Digits, MinDigits, MaxDigits, DigitsBetween) and Password length stay int. Thanks @​rubenvanassche.

What's Changed

• Allow float values for Min, Max and Size validation attributes by @​rubenvanassche in spatie/laravel-data#1185
• Fix install conflict on PHP 8.4 with Pest installed by @​rubenvanassche in spatie/laravel-data#1186
• Run rules() overrides regardless of property defaults by @​rubenvanassche in spatie/laravel-data#1187

Full Changelog: spatie/laravel-data@4.22.1...4.23.0

Changelog

Sourced from spatie/laravel-data's changelog.

4.23.0 - 2026-05-08

A round of bug fixes for validation rules, install resolution, and rule overrides.

Run rules() overrides regardless of property defaults (#1187)

Properties with a default value were silently dropping rules declared in the rules() method when the property was missing from the payload, so conditional rules like required, required_if, and prohibited_if never fired. The skip in DataValidationRulesResolver was originally there to stop auto-generated rules from rejecting empty payloads on all-default data classes (#441), but it also short-circuited explicit overrides.

Overrides are now resolved upfront, and the default-value skip only applies when no override exists for that property. #[WithoutValidation] no longer suppresses an override for the same key. If you wrote rules(), you own them. Thanks @​rubenvanassche.

Fix install conflict on PHP 8.4 with Pest installed (#1186)

composer require spatie/laravel-data failed when Pest was already installed, because Pest's chain pulls phpdocumentor/reflection-docblock 6.0.3 while the phpdocumentor/reflection ^6.0 meta package hard-pinned reflection-docblock ^5. The meta package is now dropped in favour of direct dependencies on the three sub-packages we use, with widened constraints:

-        "phpdocumentor/reflection" : "^6.0",
+        "phpdocumentor/type-resolver" : "^1.7 || ^2.0",
+        "phpdocumentor/reflection-common" : "^2.2",
+        "phpdocumentor/reflection-docblock" : "^5.3 || ^6.0",

The phpDocumentor APIs we call are identical across both majors, so no code changes are required. Thanks @​rubenvanassche.

Allow float values for Min, Max and Size validation attributes (#1185)

The constructors typed their value as int|ExternalReference, and because those classes don't declare strict types, PHP silently coerced floats to int. #[Min(0.01)] became min:0, letting 0 pass validation, even though Laravel's validator accepts floats for these rules. Types are now widened to int|float|ExternalReference, mirroring MultipleOf:

#[Min(0.01), Max(99.99)]
public float $price;

Digit-count rules (Digits, MinDigits, MaxDigits, DigitsBetween) and Password length stay int. Thanks @​rubenvanassche.

What's Changed

• Allow float values for Min, Max and Size validation attributes by @​rubenvanassche in spatie/laravel-data#1185
• Fix install conflict on PHP 8.4 with Pest installed by @​rubenvanassche in spatie/laravel-data#1186
• Run rules() overrides regardless of property defaults by @​rubenvanassche in spatie/laravel-data#1187

Full Changelog: spatie/laravel-data@4.22.1...4.23.0

Commits

• 2305437 Run rules() overrides regardless of property defaults (#1187)
• ba02934 Fix install conflict on PHP 8.4 with Pest installed (#1186)
• de6404a Merge pull request #1185 from spatie/fix/min-max-size-float-values
• c50ca60 Allow float values for Min, Max and Size validation attributes
• 71d9a10 Update CHANGELOG
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: composer. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.