Illuminate\Http\Request empty when using DELETE,PUT,PATCH verbs

[eamon-straughn]

Cashier Stripe Version

16

Laravel Version

12.11

PHP Version

8.4

Database Driver & Version

postgres

Description

When upgrading to laravel cashier 16+ it triggers an update of symfony components and maybe this is laravel specific but the \Illuminate\Http\Request does not have values for $_POST when using DELETE,PUT,PATCH verbs.

This causes an error when CSRF token goes to be validated and $request->all() is blank because the request is empty when using the said verbs.

Here are the packages which get updated when requiring version 16+.

[root@ccefac540f42]# composer upgrade laravel/cashier "^16.2.0" --with-all-dependencies
Loading composer repositories with package information
Package "^16.2.0" listed for update is not locked.
Updating dependencies
Lock file operations: 0 installs, 36 updates, 0 removals

• Upgrading brick/math (0.14.0 => 0.14.8)
• Upgrading doctrine/deprecations (1.1.5 => 1.1.6)
• Upgrading fruitcake/php-cors (v1.3.0 => v1.4.0)
• Upgrading graham-campbell/result-type (v1.1.3 => v1.1.4)
• Upgrading laravel/prompts (v0.3.7 => v0.3.13)
• Upgrading laravel/serializable-closure (v2.0.6 => v2.0.9)
• Upgrading league/commonmark (2.7.1 => 2.8.0)
• Upgrading league/flysystem (3.30.1 => 3.31.0)
• Upgrading league/flysystem-local (3.30.0 => 3.31.0)
• Upgrading league/uri (7.5.1 => 7.8.0)
• Upgrading league/uri-interfaces (7.5.0 => 7.8.0)
• Upgrading monolog/monolog (3.9.0 => 3.10.0)
• Upgrading nesbot/carbon (3.10.3 => 3.11.1)
• Upgrading nette/schema (v1.3.3 => v1.3.4)
• Upgrading nette/utils (v4.0.8 => v4.1.3)
• Upgrading nunomaduro/termwind (v2.3.2 => v2.4.0)
• Upgrading phpoption/phpoption (1.9.4 => 1.9.5)
• Upgrading ramsey/uuid (4.9.1 => 4.9.2)
• Upgrading symfony/clock (v7.3.0 => v8.0.0)
• Upgrading symfony/console (v7.3.6 => v7.4.4)
• Upgrading symfony/css-selector (v7.3.6 => v8.0.0)
• Upgrading symfony/error-handler (v7.3.6 => v7.4.4)
• Upgrading symfony/event-dispatcher (v7.3.3 => v8.0.4)
• Upgrading symfony/finder (v7.3.5 => v7.4.5)
• Upgrading symfony/http-foundation (v7.3.6 => v7.4.5)
• Upgrading symfony/http-kernel (v7.3.6 => v7.4.5)
• Upgrading symfony/mailer (v7.3.5 => v7.4.4)
• Upgrading symfony/mime (v7.3.4 => v7.4.5)
• Upgrading symfony/process (v7.3.4 => v7.4.5)
• Upgrading symfony/routing (v7.3.6 => v7.4.4)
• Upgrading symfony/string (v7.3.4 => v8.0.4)
• Upgrading symfony/translation (v7.3.4 => v8.0.4)
• Upgrading symfony/uid (v7.3.1 => v7.4.4)
• Upgrading symfony/var-dumper (v7.3.5 => v7.4.4)
• Upgrading tijsverkoyen/css-to-inline-styles (v2.3.0 => v2.4.0)
• Upgrading vlucas/phpdotenv (v5.6.2 => v5.6.3)
  Writing lock file
  Installing dependencies from lock file (including require-dev)
  Package operations: 0 installs, 36 updates, 0 removals
• Upgrading phpoption/phpoption (1.9.4 => 1.9.5): Extracting archive
• Upgrading graham-campbell/result-type (v1.1.3 => v1.1.4): Extracting archive
• Upgrading vlucas/phpdotenv (v5.6.2 => v5.6.3): Extracting archive
• Upgrading symfony/css-selector (v7.3.6 => v8.0.0): Extracting archive
• Upgrading tijsverkoyen/css-to-inline-styles (v2.3.0 => v2.4.0): Extracting archive
• Upgrading symfony/var-dumper (v7.3.5 => v7.4.4): Extracting archive
• Upgrading symfony/uid (v7.3.1 => v7.4.4): Extracting archive
• Upgrading symfony/routing (v7.3.6 => v7.4.4): Extracting archive
• Upgrading symfony/process (v7.3.4 => v7.4.5): Extracting archive
• Upgrading symfony/mime (v7.3.4 => v7.4.5): Extracting archive
• Upgrading symfony/event-dispatcher (v7.3.3 => v8.0.4): Extracting archive
• Upgrading symfony/mailer (v7.3.5 => v7.4.4): Extracting archive
• Upgrading symfony/http-foundation (v7.3.6 => v7.4.5): Extracting archive
• Upgrading symfony/error-handler (v7.3.6 => v7.4.4): Extracting archive
• Upgrading symfony/http-kernel (v7.3.6 => v7.4.5): Extracting archive
• Upgrading symfony/finder (v7.3.5 => v7.4.5): Extracting archive
• Upgrading symfony/string (v7.3.4 => v8.0.4): Extracting archive
• Upgrading symfony/console (v7.3.6 => v7.4.4): Extracting archive
• Upgrading brick/math (0.14.0 => 0.14.8): Extracting archive
• Upgrading ramsey/uuid (4.9.1 => 4.9.2): Extracting archive
• Upgrading nunomaduro/termwind (v2.3.2 => v2.4.0): Extracting archive
• Upgrading symfony/translation (v7.3.4 => v8.0.4): Extracting archive
• Upgrading symfony/clock (v7.3.0 => v8.0.0): Extracting archive
• Upgrading nesbot/carbon (3.10.3 => 3.11.1): Extracting archive
• Upgrading monolog/monolog (3.9.0 => 3.10.0): Extracting archive
• Upgrading league/uri-interfaces (7.5.0 => 7.8.0): Extracting archive
• Upgrading league/uri (7.5.1 => 7.8.0): Extracting archive
• Upgrading league/flysystem-local (3.30.0 => 3.31.0): Extracting archive
• Upgrading league/flysystem (3.30.1 => 3.31.0): Extracting archive
• Upgrading nette/utils (v4.0.8 => v4.1.3): Extracting archive
• Upgrading nette/schema (v1.3.3 => v1.3.4): Extracting archive
• Upgrading league/commonmark (2.7.1 => 2.8.0): Extracting archive
• Upgrading laravel/serializable-closure (v2.0.6 => v2.0.9): Extracting archive
• Upgrading laravel/prompts (v0.3.7 => v0.3.13): Extracting archive
• Upgrading fruitcake/php-cors (v1.3.0 => v1.4.0): Extracting archive
• Upgrading doctrine/deprecations (1.1.5 => 1.1.6): Extracting archive

Steps To Reproduce

composer upgrade laravel/cashier "^16.2.0" --with-all-dependencies

Then try a DELETE,PATCH or PUT request.

Illuminate\Http\Request is blank

[eamon-straughn]

Anyone with this issue.

Here's how to overcome it until it's fixed.

<?php

namespace App\Http\Middleware;

use Closure;

class Requests
{
    public function handle($request, Closure $next)
    {
        $request->mergeIfMissing($_POST);
        return $next($request);
    }
}

Must be the first middleware called and must be before csrf.