Fix four silent validation failures, add PHP 8.5 support and an optional Laravel provider

[yordadev]

Summary

Prepares v1.1.0. Adds PHP 8.5 and Laravel 12/13 to the supported range, ships the optional Laravel integration the package has advertised since v1.0 but never actually contained, and fixes four defects that let the validator return a plausible answer without doing the work.

No public API is removed, and composer.lock still resolves zero runtime packages — the core library stays framework-agnostic.

Four silent failures

Same shape in all four: a value that is almost right flows through a type juggle or an uninitialised read, and the caller gets a confident answer instead of an error.

passes() and fails() answered before validating. Both read $this->errors directly, which is [] on a fresh instance. A caller who skipped validate() got passes() === true and fails() === false on data that had never been looked at:

$v = Validator::make(['email' => 'not-an-email'], ['email' => 'required|email']);
$v->fails();   // false, on main

Both now route through validationPassed(), which validates on first use and memoises with a hasValidated flag. The flag is set on return, not on entry, so a rule that throws leaves the validator reporting unvalidated rather than passed, and it is included in __serialize()/__unserialize() so a round-tripped validator does not silently re-run.

Lazy validation introduces a re-entrancy hazard that did not exist before: a rule holding a reference to its own validator and calling passes() mid-run would re-enter validate() — hasValidated is still false — and recurse until the stack exhausted. A transient $validating flag, reset in a finally, makes such a call report the errors accumulated so far instead. It is deliberately excluded from serialization.

The parsed-rules cache never evicted at small limits. Eviction sliced with -self::$cacheLimit / 2, a float, which array_slice() truncates toward zero:

parsedRulesCache	-$limit / 2	offset used	entries retained
500	-250.0	-250	250
5	-2.5	-2	2
1	-0.5	0	all — never evicts

At a limit of 1 the offset collapses to 0, array_slice() returns the whole array, and the cache grows without bound for the life of the process. Now max(1, intdiv($limit, 2)). The regression test uses limit 1 specifically — an earlier draft used 5, which passes against both implementations and would have proved nothing.

The dynamic chunking heuristic was reachable only through a PHP warning. determineChunkSize() guarded on ($chunkSize = $this->config->chunkSize) !== null, but $config is ?DataValidationConfig and defaults to null. With no config, that read emits Attempt to read property "chunkSize" on null, evaluates to null, and falls through to the heuristic — so the default path for every wildcard validation ran on a diagnostic. With a config, chunkSize was a non-nullable int initialised to 500, so the guard never passed and the heuristic was unreachable. Now $this->config?->chunkSize, with chunkSize widened to ?int so null is a supported way to opt into the heuristic, and a max(1, …) floor so a configured 0 cannot reach array_chunk() and throw a ValueError.

optimizeForLargeDataset() assigned floats to three int properties. $totalItems / 2, / 20 and / 100 produce floats for every non-divisible total, deprecated as implicit lossy conversion. intdiv() throughout.

Optional Laravel integration

extra.laravel.providers on main names YorCreative\DataValidation\DataValidationServiceProvider. No such class exists in the package. Auto-discovery registers whatever the manifest lists, so installing v1.0 into a Laravel application fails at package:discover with a class-not-found — the integration was declared, never shipped.

src/Laravel/DataValidationServiceProvider.php is that class, under a Laravel\ sub-namespace so its intent is visible from the path. It binds:

• DataValidationConfig as a singleton hydrated from config/data-validation.php, keyed by array_key_exists() so a published config may set chunk_size to null and get the heuristic
• yorcreative.data-validation, a factory closure returning a Validator already carrying that config

php artisan vendor:publish --tag=data-validation-config

It is the only file in src/ referencing Illuminate\*, and it is only autoloaded inside a Laravel app. illuminate/support is declared under suggest, not require — composer.lock still shows "packages": [].

Validator::isValid() also now takes a ?DataValidationConfig. The constructor and make() both accepted one; the one-line static entry point dropped it on the floor, so the provider had no way to thread configuration through the shortest call.

Platform and CI matrix

• PHP ^8.3 || ^8.4 || ^8.5; the CI matrix gains 8.5 and the Dockerfile takes ARG PHP_VERSION so all three legs build from one file
• Dev dependencies move to Laravel 10–13 via direct illuminate/* components. orchestra/testbench is removed — it pins a Laravel range of its own, which is the thing standing between this package and a 10–13 matrix. LaravelServiceProviderTest wires a bare Illuminate\Container\Container plus a config repository directly, which is all the provider actually needs
• actions/checkout@v3 → @v4, and --no-suggest → --no-interaction (Composer 2.10 reports --no-suggest as "deprecated… has no effect and will break in Composer 3")

config.platform.php is pinned to 8.3.0. Without it the lock resolves against whichever PHP generated it: twelve Symfony dev packages (clock, console, event-dispatcher, filesystem, finder, http-foundation, mime, options-resolver, process, stopwatch, string, translation) landed on 8.x releases requiring PHP >=8.4, making the lockfile uninstallable on 8.3 — composer install exits 2 and the 8.3 leg would have failed on merge. This was caught by running the matrix locally before opening the PR, not by CI. The pin moves those twelve to 7.4.x, and one lockfile now installs across the whole supported range.

Diagnostics are now failures

phpunit.xml sets failOnDeprecation="true" and failOnWarning="true". This is not hygiene — it is load-bearing. Two of the fixes above (the intdiv() conversions and the null-config read) have no value-level observable: behaviour is identical, only the diagnostic differs. Without these flags their tests pass against the unfixed code and guard nothing.

The ordering that made this possible is worth noting for anyone bisecting: applyRules() declared array &$data while never writing to it, and two reflection-based test fixtures raised Argument #5 ($data) must be passed by reference as a result. Dropping the & took the warning count to zero, which is what let failOnWarning be switched on without manufacturing failures — so the signature change lands before the tests that depend on it.

Verification

Full matrix run locally in Docker, each leg building its own image from the same Dockerfile:

PHP	composer install	PHPUnit	Result
8.3.33	exit 0	exit 0	483 tests, 598 assertions
8.4.25	exit 0	exit 0	483 tests, 598 assertions
8.5.10	exit 0	exit 0	483 tests, 598 assertions

3/3 green, zero warnings and zero deprecations under the flags above. phpcs --standard=PSR12 ./src exits 0. composer.lock reports 0 runtime packages, 95 dev.

461 test methods on main → 483 here. Every substantive fix was watched failing for the right reason before the fix landed, with exit codes captured rather than banner text — failOnDeprecation only changes the shell exit code, and PHPUnit still prints an OK-style summary alongside it, so stdout is a poor witness.

Five tests were flagged during final review as unable to discriminate v1.0 from v1.1. One was a genuine gap — the serialization round-trip test passed with the hasValidated line deleted — and now guards both __serialize() and __unserialize(). One (testValidatorIsValidSupportsConfigObject) is inert for config threading because PHP discards a surplus argument; rather than delete it, its name and docblock have been narrowed to the null-chunkSize smoke test it actually is. The rest are deliberate forward guards for later workstreams.

Known issue, not addressed here

self::$cacheLimit is process-global, and passing a config writes to it from the constructor. Workstream 0 widens its reach three ways at once: isValid() now accepts a config, the provider routes every application validation through a config-bearing make(), and a new test enshrines the write as the specified observable.

In a long-lived worker (Octane, queues) a job that calls optimizeForLargeDataset(100000) leaves the static at 5000; the next job in that process inherits a 5000-entry parsed-rules cache it never asked for, and nothing writes 500 back. Pre-existing v1.0 shape, and Workstream 2.1 removes the static outright — flagged here so the two new callers are on record as needing to be re-pointed at instance state.

Also

• fails()/passes() lazy behaviour, the Laravel section and the 8.5 requirement are documented in the README
• Long lines in src/ wrapped to PSR-12's 120-character limit; a stray trailing-space keyword in composer.json corrected
• The docs/superpowers/ additions are the design spec, execution plan and review record for this workstream. Process artefacts with no runtime effect — they account for most of the line count outside composer.lock