diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
index c63f65a95..f0011327d 100644
--- a/.github/workflows/phpstan.yml
+++ b/.github/workflows/phpstan.yml
@@ -33,6 +33,10 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-php-${{ matrix.php }}-composer-
 
+      # Laravel 10/11 已停止安全维护，Composer >= 2.10 默认拒绝加载带安全公告的版本，
+      # 会导致 PHP 8.1 无可安装版本；仅在 CI 中关闭该阻断以保留低版本矩阵。
+      - run: composer config policy.advisories.block false
+
       - run: composer install --no-interaction --prefer-dist
 
       - run: vendor/bin/phpstan analyse --no-progress --memory-limit=512M --error-format=github
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
index 2c5ccbd12..36d0e6fa9 100644
--- a/phpstan-baseline.neon
+++ b/phpstan-baseline.neon
@@ -558,12 +558,6 @@ parameters:
 			count: 1
 			path: src/Support/Setting.php
 
-		-
-			message: '#^Variable \$folders might not be defined\.$#'
-			identifier: variable.undefined
-			count: 1
-			path: src/Support/Zip.php
-
 		-
 			message: '#^Result of method Dcat\\Admin\\Tree\:\:disableCreateButton\(\) \(void\) is used\.$#'
 			identifier: method.void
diff --git a/resources/views/form/multipleselect.blade.php b/resources/views/form/multipleselect.blade.php
index c6ed2e195..8e6683173 100755
--- a/resources/views/form/multipleselect.blade.php
+++ b/resources/views/form/multipleselect.blade.php
@@ -20,10 +20,4 @@
     </div>
 </div>
 
-@include('admin::form.select-script')
-
-<script>
-$('.{{$selector}}').off('change.select2').on('change.select2', function () {
-    $(this).closest('.field').find('input[type="hidden"][name="{{$name}}[]"]').prop('disabled', $(this).val()?.length > 0);
-});
-</script>
+@include('admin::form.select-script', ['multiple' => true])
diff --git a/resources/views/form/select-script.blade.php b/resources/views/form/select-script.blade.php
index 8e1ab33b3..085f40343 100644
--- a/resources/views/form/select-script.blade.php
+++ b/resources/views/form/select-script.blade.php
@@ -4,6 +4,23 @@
 <script require="@select2?lang={{ config('app.locale') === 'en' ? '' : str_replace('_', '-', config('app.locale')) }}" init="{!! $selector !!}">
     var configs = {!! admin_javascript_json($configs) !!};
 
+    @if(! empty($multiple))
+    // 多选：有选中值时禁用占位的隐藏 input，避免额外提交空值。
+    // 不能再单独用 Dcat.init 注册同一选择器，否则会被 initialized 标记跳过。
+    $this.each(function () {
+        var $select = $(this),
+            $hidden = $select.siblings('input[type="hidden"][name="' + $select.attr('name') + '"]'),
+            toggle = function () {
+                var val = $select.val();
+
+                $hidden.prop('disabled', !!(val && val.length > 0));
+            };
+
+        $select.on('change', toggle);
+        toggle();
+    });
+    @endif
+
     @yield('admin.select-ajax')
 
     @if(isset($remoteOptions))
diff --git a/src/Http/Controllers/HasMenuTreeField.php b/src/Http/Controllers/HasMenuTreeField.php
index c6298c5ce..7d0de876b 100644
--- a/src/Http/Controllers/HasMenuTreeField.php
+++ b/src/Http/Controllers/HasMenuTreeField.php
@@ -30,10 +30,16 @@ protected function addMenuTreeField(Form $form)
 
     /**
      * Flush menu cache after form saved.
+     *
+     * 注意：Form 的事件回调会被重新绑定到模型实例（见 HasEvents::makeListener），
+     * 回调内的 $this 不再是控制器，因此这里不能依赖 $this，统一通过本方法注册。
      */
-    protected function flushMenuCache()
+    protected function flushMenuCacheOnSaved(Form $form)
     {
-        $model = config('admin.database.menu_model');
-        (new $model())->flushCache();
+        $form->saved(function () {
+            $model = config('admin.database.menu_model');
+
+            (new $model())->flushCache();
+        });
     }
 }
diff --git a/src/Http/Controllers/PermissionController.php b/src/Http/Controllers/PermissionController.php
index 67d1bb164..ad181bbd8 100644
--- a/src/Http/Controllers/PermissionController.php
+++ b/src/Http/Controllers/PermissionController.php
@@ -88,7 +88,7 @@ public function form()
             $with[] = 'menus';
         }
 
-        return Form::make(Permission::with($with), function (Form $form) use ($bindMenu) {
+        $form = Form::make(Permission::with($with), function (Form $form) use ($bindMenu) {
             $permissionTable = config('admin.database.permissions_table');
             $connection = config('admin.database.connection');
             $permissionModel = config('admin.database.permissions_model');
@@ -125,9 +125,11 @@ public function form()
 
             $form->disableViewButton();
             $form->disableViewCheck();
-        })->saved(function () {
-            $this->flushMenuCache();
         });
+
+        $this->flushMenuCacheOnSaved($form);
+
+        return $form;
     }
 
     public function getRoutes()
diff --git a/src/Http/Controllers/RoleController.php b/src/Http/Controllers/RoleController.php
index 86c54f166..f1576df16 100644
--- a/src/Http/Controllers/RoleController.php
+++ b/src/Http/Controllers/RoleController.php
@@ -83,7 +83,7 @@ public function form()
             $with[] = 'menus';
         }
 
-        return Form::make(Role::with($with), function (Form $form) use ($bindMenu) {
+        $form = Form::make(Role::with($with), function (Form $form) use ($bindMenu) {
             $roleTable = config('admin.database.roles_table');
             $connection = config('admin.database.connection');
 
@@ -125,9 +125,11 @@ public function form()
             if ($id == $roleModel::ADMINISTRATOR_ID) {
                 $form->disableDeleteButton();
             }
-        })->saved(function () {
-            $this->flushMenuCache();
         });
+
+        $this->flushMenuCacheOnSaved($form);
+
+        return $form;
     }
 
     public function destroy($id)
diff --git a/src/Support/Zip.php b/src/Support/Zip.php
index 98cb8487a..0582d503f 100644
--- a/src/Support/Zip.php
+++ b/src/Support/Zip.php
@@ -148,6 +148,8 @@ public function add($source, $options = [])
         $basedir = $options['basedir'];
         $baseglob = $options['baseglob'];
 
+        $folders = [];
+
         if (is_file($source)) {
             $files = [$source];
             $recursive = false;