Laravel has published release v12.69.0 for its 12.x branch, contributed by Mior Muhammad Zaki (crynobone).

First, HTML rendering is now disabled by default in the tooltip of the Laravel exception page (pull request #61381). This reduces the risk of injected markup being rendered in error output.

Second, the framework now checks that the password hash matches the value stored in the remember-me cookie before authenticating the user (#61386). This closes a gap where a stale or manipulated cookie could authenticate a session against an outdated credential state.

Applications on 12.x should update via Composer as usual.