diff --git a/composer.json b/composer.json
index ad8f3a6..825f608 100644
--- a/composer.json
+++ b/composer.json
@@ -13,9 +13,9 @@
         "durable-workflow/ai": "dev-main",
         "durable-workflow/sdk": "^3.11.0",
         "durable-workflow/waterline": "^2.0",
-        "durable-workflow/workflow": "^2.22.0",
+        "durable-workflow/workflow": "^2.28.1",
         "laravel/ai": "^0.6.0",
-        "laravel/framework": "^13.30",
+        "laravel/framework": "^13.41.0",
         "laravel/mcp": "^0.6.0",
         "laravel/tinker": "^3.0"
     },
diff --git a/composer.lock b/composer.lock
index f8d8737..d26fac7 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "257ec6f4169d25ea0016821e3c5d0376",
+    "content-hash": "cd21dba100d2a8a9a7404cf60e02d2b5",
     "packages": [
         {
             "name": "apache/avro",
@@ -942,21 +942,21 @@
         },
         {
             "name": "durable-workflow/workflow",
-            "version": "2.22.0",
+            "version": "2.28.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/durable-workflow/workflow.git",
-                "reference": "4e56debcb59546269d8e1a69f31c5e7a111dd7ae"
+                "reference": "c090506cafa011335fcd5db07b7da79945fe83db"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/durable-workflow/workflow/zipball/4e56debcb59546269d8e1a69f31c5e7a111dd7ae",
-                "reference": "4e56debcb59546269d8e1a69f31c5e7a111dd7ae",
+                "url": "https://api.github.com/repos/durable-workflow/workflow/zipball/c090506cafa011335fcd5db07b7da79945fe83db",
+                "reference": "c090506cafa011335fcd5db07b7da79945fe83db",
                 "shasum": ""
             },
             "require": {
                 "apache/avro": "^1.12",
-                "laravel/framework": "^12.69.0|^13.30.0",
+                "laravel/framework": "^12.72.0|^13.41.0",
                 "php": "^8.2",
                 "react/promise": "^2.9|^3.0",
                 "symfony/yaml": "^6.0|^7.0|^8.0"
@@ -992,7 +992,7 @@
                     "dev-main": "2.0.x-dev"
                 },
                 "durable-workflow": {
-                    "product-train": "2.22.0",
+                    "product-train": "2.28.1",
                     "laravel-embedded-upgrade-contract": "resources/laravel-embedded-upgrade-contract.json",
                     "laravel-dependency-security-policy": "resources/laravel-dependency-security-policy.json"
                 }
@@ -1019,9 +1019,9 @@
             "description": "Embedded durable workflow runtime and orchestration engine for Laravel applications.",
             "support": {
                 "issues": "https://github.com/durable-workflow/workflow/issues",
-                "source": "https://github.com/durable-workflow/workflow/tree/2.22.0"
+                "source": "https://github.com/durable-workflow/workflow/tree/2.28.1"
             },
-            "time": "2026-11-08T07:51:24+00:00"
+            "time": "2026-11-14T00:45:51+00:00"
         },
         {
             "name": "egulias/email-validator",
@@ -1710,16 +1710,16 @@
         },
         {
             "name": "laravel/framework",
-            "version": "v13.34.0",
+            "version": "v13.41.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/framework.git",
-                "reference": "c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4"
+                "reference": "95934d2868c90c1aa8e711791ea33d1e990e1719"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/framework/zipball/c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4",
-                "reference": "c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4",
+                "url": "https://api.github.com/repos/laravel/framework/zipball/95934d2868c90c1aa8e711791ea33d1e990e1719",
+                "reference": "95934d2868c90c1aa8e711791ea33d1e990e1719",
                 "shasum": ""
             },
             "require": {
@@ -1740,12 +1740,12 @@
                 "guzzlehttp/promises": "^2.0.3 || ^3.0",
                 "guzzlehttp/psr7": "^2.9 || ^3.0",
                 "guzzlehttp/uri-template": "^1.0 || ^2.0",
-                "laravel/prompts": "^0.3.11",
+                "laravel/prompts": "^0.3.25",
                 "laravel/serializable-closure": "^2.0.10",
                 "league/commonmark": "^2.8.1",
                 "league/flysystem": "^3.25.1",
                 "league/flysystem-local": "^3.25.1",
-                "league/uri": "^7.5.1",
+                "league/uri": "^7.6",
                 "monolog/monolog": "^3.10",
                 "nesbot/carbon": "^3.8.4",
                 "nunomaduro/termwind": "^2.0",
@@ -1822,11 +1822,12 @@
                 "spatie/once": "*"
             },
             "require-dev": {
-                "ably/ably-php": "^1.0",
+                "ably/pubsub-server": "^1.0|^2.0",
                 "aws/aws-sdk-php": "^3.322.9",
                 "ext-gmp": "*",
                 "fakerphp/faker": "^1.24",
-                "intervention/image": "^4.0",
+                "intervention/image": "^4.2",
+                "jasonmccreary/double": "^1.1",
                 "laravel/pint": "^1.18",
                 "league/flysystem-aws-s3-v3": "^3.25.1",
                 "league/flysystem-ftp": "^3.25.1",
@@ -1835,10 +1836,10 @@
                 "league/flysystem-sftp-v3": "^3.25.1",
                 "mockery/mockery": "^1.6.10",
                 "opis/json-schema": "^2.4.1",
-                "orchestra/testbench-core": "^11.5.0",
+                "orchestra/testbench-core": "^11.6.0",
                 "pda/pheanstalk": "^7.0.0 || ^8.0.0",
                 "php-http/discovery": "^1.15",
-                "phpstan/phpstan": "2.2.15",
+                "phpstan/phpstan": "2.3.5",
                 "phpunit/phpunit": "^11.5.50 || ^12.5.8 || ^13.0.3",
                 "predis/predis": "^2.3 || ^3.0",
                 "rector/rector": "2.6.3",
@@ -1851,7 +1852,7 @@
                 "web-token/jwt-library": "^4.1"
             },
             "suggest": {
-                "ably/ably-php": "Required to use the Ably broadcast driver (^1.0).",
+                "ably/pubsub-server": "Required to use the Ably broadcast driver (^1.0|^2.0).",
                 "aws/aws-sdk-php": "Required to use the SQS queue driver, DynamoDb failed job storage, and SES mail driver (^3.322.9).",
                 "brianium/paratest": "Required to run tests in parallel (^7.0 || ^8.0).",
                 "ext-apcu": "Required to use the APC cache driver.",
@@ -1865,7 +1866,7 @@
                 "ext-redis": "Required to use the Redis cache and queue drivers (^4.0 || ^5.0 || ^6.0).",
                 "fakerphp/faker": "Required to generate fake data using the fake() helper (^1.23).",
                 "filp/whoops": "Required for friendly error pages in development (^2.14.3).",
-                "intervention/image": "Required to use the image processing features (^4.0).",
+                "intervention/image": "Required to use the image processing features (^4.2).",
                 "laravel/tinker": "Required to use the tinker console command (^2.0).",
                 "league/flysystem-aws-s3-v3": "Required to use the Flysystem S3 driver (^3.25.1).",
                 "league/flysystem-ftp": "Required to use the Flysystem FTP driver (^3.25.1).",
@@ -1937,7 +1938,7 @@
                 "issues": "https://github.com/laravel/framework/issues",
                 "source": "https://github.com/laravel/framework"
             },
-            "time": "2026-09-29T12:46:21+00:00"
+            "time": "2026-11-10T15:44:39+00:00"
         },
         {
             "name": "laravel/mcp",
@@ -2014,16 +2015,16 @@
         },
         {
             "name": "laravel/prompts",
-            "version": "v0.3.24",
+            "version": "v0.3.27",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/prompts.git",
-                "reference": "5d3cdef29e93ca3b62b1871359db3078cd99908b"
+                "reference": "abdfc75a1ae6c6f21522daed50da7124cbff09d2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/prompts/zipball/5d3cdef29e93ca3b62b1871359db3078cd99908b",
-                "reference": "5d3cdef29e93ca3b62b1871359db3078cd99908b",
+                "url": "https://api.github.com/repos/laravel/prompts/zipball/abdfc75a1ae6c6f21522daed50da7124cbff09d2",
+                "reference": "abdfc75a1ae6c6f21522daed50da7124cbff09d2",
                 "shasum": ""
             },
             "require": {
@@ -2066,10 +2067,9 @@
             ],
             "description": "Add beautiful and user-friendly forms to your command-line applications.",
             "support": {
-                "issues": "https://github.com/laravel/prompts/issues",
-                "source": "https://github.com/laravel/prompts/tree/v0.3.24"
+                "source": "https://github.com/laravel/prompts/tree/v0.3.27"
             },
-            "time": "2026-08-20T12:55:36+00:00"
+            "time": "2026-11-09T16:07:10+00:00"
         },
         {
             "name": "laravel/serializable-closure",
@@ -7131,12 +7131,12 @@
             "version": "v5.7.0",
             "source": {
                 "type": "git",
-                "url": "https://github.com/vlucas/phpdotenv.git",
+                "url": "https://github.com/phpdotenv/phpdotenv.git",
                 "reference": "301c07936b16d88628b126b01d082ba153cf4c40"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40",
+                "url": "https://api.github.com/repos/phpdotenv/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40",
                 "reference": "301c07936b16d88628b126b01d082ba153cf4c40",
                 "shasum": ""
             },
diff --git a/microservice/composer.json b/microservice/composer.json
index cc90e52..dd672a8 100644
--- a/microservice/composer.json
+++ b/microservice/composer.json
@@ -11,9 +11,9 @@
     "require": {
         "php": "^8.4",
         "durable-workflow/sdk": "^3.11.0",
-        "durable-workflow/workflow": "^2.22.0",
+        "durable-workflow/workflow": "^2.28.1",
         "durable-workflow/waterline": "^2.0",
-        "laravel/framework": "^12.69",
+        "laravel/framework": "^12.72.0",
         "laravel/tinker": "^2.10.1"
     },
     "require-dev": {
diff --git a/microservice/composer.lock b/microservice/composer.lock
index b84d2ed..bf662b8 100644
--- a/microservice/composer.lock
+++ b/microservice/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "eedffe0500e11c3890f0d50a9eb54e5f",
+    "content-hash": "dff320ded8aefccc360e5957f72080d2",
     "packages": [
         {
             "name": "apache/avro",
@@ -727,21 +727,21 @@
         },
         {
             "name": "durable-workflow/workflow",
-            "version": "2.22.0",
+            "version": "2.28.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/durable-workflow/workflow.git",
-                "reference": "4e56debcb59546269d8e1a69f31c5e7a111dd7ae"
+                "reference": "c090506cafa011335fcd5db07b7da79945fe83db"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/durable-workflow/workflow/zipball/4e56debcb59546269d8e1a69f31c5e7a111dd7ae",
-                "reference": "4e56debcb59546269d8e1a69f31c5e7a111dd7ae",
+                "url": "https://api.github.com/repos/durable-workflow/workflow/zipball/c090506cafa011335fcd5db07b7da79945fe83db",
+                "reference": "c090506cafa011335fcd5db07b7da79945fe83db",
                 "shasum": ""
             },
             "require": {
                 "apache/avro": "^1.12",
-                "laravel/framework": "^12.69.0|^13.30.0",
+                "laravel/framework": "^12.72.0|^13.41.0",
                 "php": "^8.2",
                 "react/promise": "^2.9|^3.0",
                 "symfony/yaml": "^6.0|^7.0|^8.0"
@@ -777,7 +777,7 @@
                     "dev-main": "2.0.x-dev"
                 },
                 "durable-workflow": {
-                    "product-train": "2.22.0",
+                    "product-train": "2.28.1",
                     "laravel-embedded-upgrade-contract": "resources/laravel-embedded-upgrade-contract.json",
                     "laravel-dependency-security-policy": "resources/laravel-dependency-security-policy.json"
                 }
@@ -804,9 +804,9 @@
             "description": "Embedded durable workflow runtime and orchestration engine for Laravel applications.",
             "support": {
                 "issues": "https://github.com/durable-workflow/workflow/issues",
-                "source": "https://github.com/durable-workflow/workflow/tree/2.22.0"
+                "source": "https://github.com/durable-workflow/workflow/tree/2.28.1"
             },
-            "time": "2026-11-08T07:51:24+00:00"
+            "time": "2026-11-14T00:45:51+00:00"
         },
         {
             "name": "egulias/email-validator",
@@ -1427,16 +1427,16 @@
         },
         {
             "name": "laravel/framework",
-            "version": "v12.69.3",
+            "version": "v12.72.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/framework.git",
-                "reference": "58ea544a2a80dc03c168e13a5dc9a1d176a88717"
+                "reference": "b089d3020e508f49b3625726ab4a2c897f1b78d5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/framework/zipball/58ea544a2a80dc03c168e13a5dc9a1d176a88717",
-                "reference": "58ea544a2a80dc03c168e13a5dc9a1d176a88717",
+                "url": "https://api.github.com/repos/laravel/framework/zipball/b089d3020e508f49b3625726ab4a2c897f1b78d5",
+                "reference": "b089d3020e508f49b3625726ab4a2c897f1b78d5",
                 "shasum": ""
             },
             "require": {
@@ -1549,10 +1549,10 @@
                 "league/flysystem-sftp-v3": "^3.25.1",
                 "mockery/mockery": "^1.6.10",
                 "opis/json-schema": "^2.4.1",
-                "orchestra/testbench-core": "^10.9.0",
+                "orchestra/testbench-core": "^10.15.0",
                 "pda/pheanstalk": "^5.0.6|^7.0.0",
                 "php-http/discovery": "^1.15",
-                "phpstan/phpstan": "^2.1.41",
+                "phpstan/phpstan": "2.2.13",
                 "phpunit/phpunit": "^10.5.35|^11.5.3|^12.0.1",
                 "predis/predis": "^2.3|^3.0",
                 "resend/resend-php": "^0.10.0|^1.0",
@@ -1645,7 +1645,7 @@
                 "issues": "https://github.com/laravel/framework/issues",
                 "source": "https://github.com/laravel/framework"
             },
-            "time": "2026-09-29T12:53:25+00:00"
+            "time": "2026-11-10T15:45:11+00:00"
         },
         {
             "name": "laravel/prompts",
@@ -6647,12 +6647,12 @@
             "version": "v5.7.0",
             "source": {
                 "type": "git",
-                "url": "https://github.com/vlucas/phpdotenv.git",
+                "url": "https://github.com/phpdotenv/phpdotenv.git",
                 "reference": "301c07936b16d88628b126b01d082ba153cf4c40"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40",
+                "url": "https://api.github.com/repos/phpdotenv/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40",
                 "reference": "301c07936b16d88628b126b01d082ba153cf4c40",
                 "shasum": ""
             },
diff --git a/polyglot/qualified-artifact-tuple.json b/polyglot/qualified-artifact-tuple.json
index f3366a1..640658a 100644
--- a/polyglot/qualified-artifact-tuple.json
+++ b/polyglot/qualified-artifact-tuple.json
@@ -10,6 +10,6 @@
     "sdk-rust": "4.12.0",
     "server": "3.3.2",
     "waterline": "2.13.2",
-    "workflow": "2.22.0"
+    "workflow": "2.28.1"
   }
 }
diff --git a/tests/Unit/LaravelSecurityFloorContractTest.php b/tests/Unit/LaravelSecurityFloorContractTest.php
new file mode 100644
index 0000000..ebc5407
--- /dev/null
+++ b/tests/Unit/LaravelSecurityFloorContractTest.php
@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+final class LaravelSecurityFloorContractTest extends TestCase
+{
+    // Covers the concurrency and signed-URL advisories published in November 2026.
+    private const APPLICATION_FLOORS = [
+        '.' => '13.41.0',
+        'microservice' => '12.72.0',
+    ];
+
+    public function test_application_constraints_exclude_affected_framework_versions(): void
+    {
+        foreach (self::APPLICATION_FLOORS as $directory => $floor) {
+            $composer = $this->readJson($directory.'/composer.json');
+            $constraint = $composer['require']['laravel/framework'] ?? null;
+
+            $this->assertIsString($constraint, $directory);
+            $this->assertMatchesRegularExpression('/^\^\d+\.\d+\.\d+$/D', $constraint, $directory);
+            $this->assertTrue(version_compare(substr($constraint, 1), $floor, '>='), $directory);
+        }
+    }
+
+    public function test_application_locks_exclude_affected_framework_versions(): void
+    {
+        foreach (self::APPLICATION_FLOORS as $directory => $floor) {
+            $lock = $this->readJson($directory.'/composer.lock');
+            $packages = array_column($lock['packages'], null, 'name');
+            $version = $packages['laravel/framework']['version'] ?? null;
+
+            $this->assertIsString($version, $directory);
+            $this->assertTrue(version_compare(ltrim($version, 'v'), $floor, '>='), $directory);
+        }
+    }
+
+    /** @return array<string, mixed> */
+    private function readJson(string $path): array
+    {
+        return json_decode(
+            (string) file_get_contents(dirname(__DIR__, 2).'/'.$path),
+            true,
+            flags: JSON_THROW_ON_ERROR,
+        );
+    }
+}