v0.5.0 - Laravel 13

Laravel 13 support, Octane fix, ReDoS hardening, and a rewritten README focused on Lighthouse / PageSpeed wins.

Breaking

• Drop Laravel 9 support (EOL since Feb 2024). The package now targets Laravel 10, 11, 12, and 13.

Added

• Laravel 13 support.
• orchestra/testbench declared as a dev dependency; Pest updated to support v2/v3/v4.
• Real test coverage for the @user directive (browser, Googlebot, Chrome-Lighthouse, missing UA, oversized UA, @unlessuser).

Changed

• Read the user agent from the current request inside the @user closure instead of capturing it once at boot — fixes a bug under long-running workers (Octane/Swoole) where every request saw the first caller's UA.
• CrawlerDetect is now bound (not registered as a singleton), so its $_SERVER-derived state never persists across requests in long-lived workers. The 'CrawlerDetect' string remains as an alias for backwards compatibility.
• phpunit.xml.dist migrated to the PHPUnit 10+ schema.
• README and composer.json repositioned around the Lighthouse / PageSpeed performance win, with a real-world widgets table.

Removed

• spatie/invade dependency (no longer needed — the user agent is read directly from the request).

Security

• Clamp the user-agent header to 2048 characters before running the crawler regex to defend against ReDoS on pathological input.
• Pin every GitHub Action to a 40-char commit SHA.
• Bump dependabot/fetch-metadata to v2, actions/checkout to v4, stefanzweifel/git-auto-commit-action to v5.
• Tighten update-changelog.yml with least-privilege token permissions.

Full Changelog: v0.4.0...v0.5.0