feat: support Laravel 13 and PHP 8.5, drop Laravel 11

[danielebarbaro]

This started as "add a row to the CI matrix" and turned out to be two separate things.

1. Laravel 13 needs a Pest 4 toolchain

Adding laravel/framework:13.* to the matrix does not resolve:

- Root composer.json requires pestphp/pest-plugin-laravel ^3.0
- pestphp/pest-plugin-laravel v3.2.0 requires laravel/framework ^11.39.1|^12.9.2
  but it conflicts with your root composer.json require (13.*)

The plugin's 3.x line caps at Laravel 12. The support matrix upstream:

pest-plugin-laravel	PHP	Laravel
3.2.0	^8.2	11, 12
4.1.0	^8.3	11.45.2+, 12.52+, 13
5.0.1	^8.4	13.23+

Pest 4 is the version that reaches Laravel 13 while keeping the PHP 8.3 floor. Pest 5 would force PHP ^8.4 and cost us 8.3 support for nothing we need. So: pestphp/pest ^4.4.1, pest-plugin-arch ^4.0, pest-plugin-laravel ^4.1.

The test suite needed no changes. All 69 tests pass on Pest 4 as written. Verified locally against Laravel 12 and 13, prefer-lowest and prefer-stable, on PHP 8.5.3.

2. Laravel 11 is out of support and unpatched

This is the part worth reading. With Laravel 11 installed:

$ composer audit
Found 3 security vulnerability advisories affecting laravel/framework

  Temporary Signed URL Path Confusion   affected: <12.61.1 | >=13.0.0,<13.12.0
  CRLF injection in default email rule  affected: <12.60.0 | >=13.0.0,<=13.9.0
  CRLF injection in default email rule  affected: >=11.0.0,<12.0.0 | ... | >=13.0.0,<13.10.0

Every fixed version is in the 12.60/12.61 or 13.10/13.12 line. There is no 11.x release carrying any of them. Laravel 11's security window closed in March 2026.

composer.json declared "illuminate/contracts": "^11.0", which tells every consumer that an unpatched framework is a supported configuration. That is the actual defect here, and it is not fixed by testing Laravel 11 more thoroughly.

Removed. require is now ^12.0||^13.0, and composer audit is clean on both.

Breaking change

Dropping a supported framework version is a major. This targets v3.0.0.

Applications on Laravel 11 stay on kml-parser:^2.0, which keeps working, and the README says so. There is no functional change in this PR: same parser, same output, same 69 tests.

Matrix

os:        [ubuntu-latest, windows-latest]
php:       [8.5, 8.4, 8.3]
laravel:   [13.*, 12.*]
stability: [prefer-lowest, prefer-stable]

16 jobs to 24. Linux runs in about 20s and Windows in about a minute, so the added cost is small next to catching a real incompatibility. PHPStan moves to PHP 8.5.

Verified locally

Every matrix combination was resolved and run before writing it into the workflow, rather than assumed:

combination	result
L12 / testbench 10 / prefer-lowest	69 passed
L12 / testbench 10 / prefer-stable	69 passed, laravel v12.69.2
L13 / testbench 11 / prefer-lowest	69 passed, laravel v13.12.0
L13 / testbench 11 / prefer-stable	69 passed, laravel v13.31.0

PHPStan [OK] No errors, Pint clean, both workflow files pass yaml-lint.

Not changed

minimum-stability: dev stays as the skeleton left it. It does mean composer require laravel/framework:13.* can see 13.x-dev, but prefer-stable picks the stable tag and did so in every combination above. Worth revisiting separately, not while also moving the toolchain.