diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b951971..66fe8bd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,4 +32,4 @@ jobs:
       os: >-
         ['ubuntu-latest', 'windows-latest']
       php: >-
-        ['8.1', '8.2', '8.3']
+        ['8.1', '8.2', '8.3', '8.4']
diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml
index 0af646c..fbb33fe 100644
--- a/.github/workflows/composer-require-checker.yml
+++ b/.github/workflows/composer-require-checker.yml
@@ -31,5 +31,5 @@ jobs:
       os: >-
         ['ubuntu-latest']
       php: >-
-        ['8.1', '8.2', '8.3']
+        ['8.1', '8.2', '8.3', '8.4']
       config: ./composer-require-checker.json
diff --git a/.github/workflows/rector.yml b/.github/workflows/rector.yml
index 457772a..5e2fc02 100644
--- a/.github/workflows/rector.yml
+++ b/.github/workflows/rector.yml
@@ -21,4 +21,4 @@ jobs:
       os: >-
         ['ubuntu-latest']
       php: >-
-        ['8.3']
+        ['8.3', '8.4']
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index e496e56..b56464d 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -29,4 +29,4 @@ jobs:
       os: >-
         ['ubuntu-latest']
       php: >-
-        ['8.1', '8.2', '8.3']
+        ['8.1', '8.2', '8.3', '8.4']
diff --git a/composer.json b/composer.json
index 6b85dbd..d5531ec 100644
--- a/composer.json
+++ b/composer.json
@@ -51,29 +51,30 @@
         "yiisoft/di": "^1.0",
         "yiisoft/friendly-exception": "^1.1",
         "yiisoft/http": "^1.2",
+        "yiisoft/http-middleware": "^1.1",
         "yiisoft/middleware-dispatcher": "^5.2",
-        "yiisoft/router": "^3.0",
+        "yiisoft/router": "^4.0",
         "yiisoft/translator": "^3.0",
         "yiisoft/var-dumper": "^1.4",
         "yiisoft/yii-debug": "dev-master",
-        "yiisoft/yii-middleware": "^1.0",
+        "yiisoft/yii-middleware": "^1.1",
         "zircote/swagger-php": "^4.0"
     },
     "require-dev": {
         "codeception/codeception": "^5.0",
         "maglnet/composer-require-checker": "^4.2",
-        "phpunit/phpunit": "^9.6",
+        "phpunit/phpunit": "^9.6 || ^10.0",
         "rector/rector": "^2.1.1",
         "roave/infection-static-analysis-plugin": "^1.16",
         "spatie/phpunit-watcher": "^1.23",
-        "vimeo/psalm": "^5.22",
+        "vimeo/psalm": "^5.22 || ^6.12",
         "yiisoft/active-record": "dev-master",
         "yiisoft/assets": "^4.0",
         "yiisoft/csrf": "^2.0",
         "yiisoft/db": "1.2 as dev-master",
         "yiisoft/db-sqlite": "^1.0",
         "yiisoft/psr-dummy-provider": "^1.0",
-        "yiisoft/router-fastroute": "^3.0",
+        "yiisoft/router-fastroute": "^4.0",
         "yiisoft/test-support": "^3.0",
         "yiisoft/yii-cycle": "dev-master",
         "yiisoft/yii-http": "^1.0",
diff --git a/config/routes.php b/config/routes.php
index 68cc336..eadac30 100644
--- a/config/routes.php
+++ b/config/routes.php
@@ -3,8 +3,9 @@
 declare(strict_types=1);
 
 use Psr\Http\Message\ResponseFactoryInterface;
-use Yiisoft\Csrf\CsrfMiddleware;
+use Yiisoft\Csrf\CsrfTokenMiddleware;
 use Yiisoft\DataResponse\Middleware\FormatDataResponseAsJson;
+use Yiisoft\HttpMiddleware\CorsAllowAllMiddleware;
 use Yiisoft\Router\Group;
 use Yiisoft\Router\Route;
 use Yiisoft\Validator\ValidatorInterface;
@@ -16,7 +17,6 @@
 use Yiisoft\Yii\Debug\Api\Inspector\Controller\GitController;
 use Yiisoft\Yii\Debug\Api\Inspector\Controller\InspectController;
 use Yiisoft\Yii\Debug\Api\Inspector\Controller\OpcacheController;
-use Yiisoft\Yii\Middleware\CorsAllowAll;
 use Yiisoft\Yii\Middleware\IpFilter;
 
 if (!(bool) ($params['yiisoft/yii-debug-api']['enabled'] ?? false)) {
@@ -25,8 +25,8 @@
 
 return [
     Group::create('/debug/api')
-        ->withCors(CorsAllowAll::class)
-        ->disableMiddleware(CsrfMiddleware::class)
+        ->withCors(CorsAllowAllMiddleware::class)
+        ->disableMiddleware(CsrfTokenMiddleware::class)
         ->middleware(
             static function (ResponseFactoryInterface $responseFactory, ValidatorInterface $validator) use ($params) {
                 return new IpFilter(
@@ -60,8 +60,8 @@ static function (ResponseFactoryInterface $responseFactory, ValidatorInterface $
                 ->name('event-stream'),
         ),
     Group::create('/inspect/api')
-        ->withCors(CorsAllowAll::class)
-        ->disableMiddleware(CsrfMiddleware::class)
+        ->withCors(CorsAllowAllMiddleware::class)
+        ->disableMiddleware(CsrfTokenMiddleware::class)
         ->middleware(
             static function (ResponseFactoryInterface $responseFactory, ValidatorInterface $validator) use ($params) {
                 return new IpFilter(