[Security] Bump laravel/framework from 5.6.21 to 5.6.39

[dependabot-preview]

Bumps laravel/framework from 5.6.21 to 5.6.39. This update includes security fixes.

Vulnerabilities fixed

Sourced from The PHP Security Advisories Database.

Cookie serialization vulnerability

Affected versions: >=4.0.0, <=4.0.11; >=4.1.0, <=4.1.31; >=4.2.0, <=4.2.22; >=5.0.0, <=5.0.35; >=5.1.0, <=5.1.46; >=5.2.0, <=5.2.45; >=5.3.0, <=5.3.31; >=5.4.0, <=5.4.36; >=5.5.0, <5.5.42; >=5.6.0, <5.6.30

Release notes

Sourced from laravel/framework's releases.

v5.6.39

v5.6.39 (2018-10-04)

Fixed

• Fixed broken email sub-copy template escaping (#25734)
• Fixed required carbon version (394f79f9a6651b103f6e065cb4470b4b347239ea)
• Fixed translation escaping (25858, 4c465007bbf51d7f269871cd76b6d99de7df90bb)

v5.6.29

Added

• Added restored() and forceDeleted() to observer stub (#40ba2ee)
• Added UploadedFile::getContents() (#24924)
• Added an alias for a single FactoryBuilder state definition (#24937)

Changed

• Allow closure to determine if event should be faked (#24887)
• Update error message for MailFake::assertSent() (#24911)
• Return instance of spy when swapping facade for a Mockery spy (#24918)
• Renamed Mailer::setGlobalTo() to setGlobalToAndRemoveCcAndBcc() to be more clear about what it does (#24917)
• Update the font path used in frontend stub (#24926)

Fixed

• Fixed an issue when passing an array to Request::is() (#24885)
• Fixed message string in NotificationFake::assertSentToTimes() (#24929)

v5.6.24

Added

• Added assertSessionHasNoErrors() test helper (#24308)
• Added support for defining and enforcing a Spatial reference system for a Point column (#24320)
• Added Builder::whereJsonDoesntContain() and Builder::orWhereJsonDoesntContain() (#24367)
• Added Queueable, SerializesModels to all notification events (#24368)
• Allow callable array syntax in route definition (#24385)
• Added JSON SELECT queries to SQL Server (#24397)

Changed

• Optimize query builder's pluck() method (#23482)
• Allow passing object instances regardless of the parameter name to method injection (#24234)
• Extract setting mutated attribute into method (#24307)
• Let apiResource support except option (#24319)
• Skip null/empty values in SeeInOrder (#24395)
• Sync Original modal attributes after soft deletion (#24400)

Fixed

• Fixed typo of missing underscore in not_regexp rule name (#24297)
• Cleanup null relationships in loadMorph (#24322)
• Fix loadMissing() relationship parsing (#24329)
• Fix FormRequest class authorization validation priority (#24369)
• Fix custom blade conditional ignoring 0 as argument (#24394)

v5.6.23

... (truncated)

Changelog

Sourced from laravel/framework's changelog.

Release Notes for 5.6.x

v5.6.38 (2018-09-04)

Fixed

• Fix nullable MorphTo and $touches (#25438)
• Allow load relations with similar keys using strict comparison (#25429)

v5.6.37 (2018-09-02)

Fixed

• Fixed MorphTo lazy loading and withoutGlobalScopes method (#25406)

v5.6.36 (2018-09-02)

Changed

• Use higher order messages in Collection (#25356)
• Use the getAttributes method on insert (#25355)

Fixed

• logoutOtherDevices method in Illuminate/Auth/SessionGuard.php class breaks "remember me" cookie (#25386)
• Fix self relation existence queries with custom keys (#25397)
• Fix relationships with global scope columns (#25368)
• Fix: revert model syncing after soft-delete (#25392)
• Fix mailables always being queued for later if using Queueable trait (#25378)

Security

• escape lang directive echos (d3c0a369057d0b6ebf29b5f51c903b1a85e3e09b)

v5.6.35 (2018-08-27)

Added

• Handle AWS Connection Lost (#25295)
• Support JSON SELECT queries on SQLite (#25328)

Changed

• Throw exception for has() with MorphTo relationship (#25337)

Fixed

• Fix MorphTo eager loading and withoutGlobalScopes() (#25331)
• Fix whereTime() on SQL Server (#25316)

v5.6.34 (2018-08-21)

Changed

• Wrap columns in whereRowValues (#25179)
• Make copyrights line localizable in mail messages (#25183)

... (truncated)

Commits

• 37bb306 version
• 4c46500 revert
• 1807c92 [5.6] Fix translation escaping (#25858)
• fa5ea32 [5.6] Add changelog for v5.6.38 (#25760)
• ecf2999 [5.6] Add changelog for v5.6.37 (#25707) (#25747)
• 852ff28 Update email.blade.php (#25734)
• 7c09461 [5.6] make a 2 new line before new release in CHANGELOG-5.6 file (#25722)
• aa249cb [5.6] Add changelog for v5.6.36 (#25707)
• 0a83ce3 Merge pull request #25705 from pahan35/5.6-port-test-fixes
• e7ba421 [5.6] port Windows test fixes PR #25646 to 5.6 branch
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

Superseded by #72.