Laravel Version

11.44.0

PHP Version

8.3.15

Database Driver & Version

mysql:5.7 (docker image)

Description

When using Laravel’s updateOrCreate with a where condition that includes multiple columns, the update process still only relies on the model’s primaryKey, instead of considering all the where columns provided.

Example:

static::updateOrCreate([
    'website_id' => $activeWebsiteId,
    'key' => $key,
], [
    'value' => $value,
    'encrypted' => $isEncrypted,
]);

In this example:

• The model has protected $primaryKey = 'key'. However, the actual logical primary key is composite: (key, website_id). Since Eloquent does not natively support composite primary keys, only key is set in the model.
• The where clause includes both website_id and key.
• However, during the update operation, Laravel generates a query that only uses key for identifying the record, ignoring website_id.

Impact:

• The wrong record might get updated, especially if multiple records share the same key but have different website_id values.
• Data integrity issues occur because the update does not correctly match the full unique constraint expected.

Expected Behavior:

• updateOrCreate should locate and update records based on all the provided where conditions, not just the primaryKey.
• The primaryKey setting should not override the behavior of updateOrCreate when multiple matching columns are explicitly specified.

Steps To Reproduce

Doing updateOrCreate on a model for table that has composit primary key or no primary key