v2.2.0 Laravel 13 and safer public forms

All installs should update: this release moves Input to Laravel 13, limits the public form endpoints and fixes how links and hosts are checked. Back up your database and APP_KEY first, and read the upgrade steps below. On SQLite, make sure the disk has room for a second copy of the database: the update rebuilds some tables.

Before you update

1. Check APP_URL. It must be the address Input is served on. Requests for any other host now get a 400 error, also health checks by IP and proxies that don't pass the host on. By default any proxy is trusted; to trust only yours, list it in the new TRUSTED_PROXIES setting. (#197, #212)
2. Back up APP_KEY with your database. Answers are stored encrypted with it, and a new key can't read them. (#203)
3. Queue: webhooks and mails now run in the background, and the Docker image runs its own queue worker. If you pass QUEUE_CONNECTION=sync to the container, change it to database (or redis). (#218)
4. Form links must start with http(s):// or mailto:. Saved links that don't are hidden on the public form: enter them again as full URLs. (#193)
5. minio → RustFS: the minio image can no longer be pulled, so the production compose example uses RustFS. A running install keeps working, but on the old compose example docker compose pull fails on the minio service; docker compose pull --ignore-pull-failures gets past it. (#203)
6. Deleted teams: forms of teams deleted before this update are still online. Back up, then run php artisan input:prune-orphaned-forms to list them, and add --force to delete them. (#209)
7. Auto-delete and imports: auto-delete needs a retention of at least 1 day. Forms with auto-delete on and no retention now keep their answers, so set a retention to keep deleting. Importing a template into a form that already has answers is refused. Deleting a team now deletes its forms for good, with their answers and files. (#202)
8. SQLite: rows left behind. On SQLite, deleting a team, form, question or submission kept rows in the database: upload records, and on installs set up before v2.0 also answers. The update adds the missing database keys, so this no longer happens. To remove what was left behind, back up, then run php artisan input:prune-orphaned-forms (it lists counts only) and add --force. (#225)
9. Building from source needs Node 22. The Docker image already has it. (#223)

With Docker Compose, run the php artisan commands as docker compose exec input php artisan …, as the hosting docs show.

Going back to 2.1 after this update logs every user out once.

New

• Prefill from the link: a URL parameter named like a text question's Identifier fills in that answer. (#208)
• Create a form from a template file on the dashboard or through the API. (#213, #214)
• Faster busy forms: stats are counted in the database, and the CSV export handles 10,000+ submissions. (#217)
• Webhooks: custom headers are sent again, and a webhook whose receiver is down or answers with a server error is tried up to 5 times. (#218)

Security

• Laravel 13 instead of Laravel 11, which no longer gets security fixes. This closes 3 known Laravel issues, one of them high. JavaScript packages with known advisories are updated too, among them axios, lodash and vue-i18n. (#223, #224)
• Public forms have limits on images, uploads, answer size and link parameters, with rate limits per visitor. (#212)
• Forged hosts can't get into password reset links. (#197)
• Form texts are cleaned before they show; webhook responses and logic picker labels show as plain text. (#193, #196, #199)
• Exported answers starting with = + - @ can't run as spreadsheet formulas. (#217)

Fixed

Forms embedded with an iframe on another site now load and submit (#224). Brand image and background uploads refuse SVG files, which never showed (#224). Show/hide rules and jumps now save only the answers on the respondent's real path, group rules work in the public form, and many smaller fixes. The full list is in CHANGELOG.md.

Full diff: v2.1.0...v2.2.0