[6.x] Fix Eloquent user merge setting roles and groups as model attributes (#14526)

Author: duncanmcclean

src/Auth/Eloquent/User.php

@@ -303,7 +303,11 @@ public function remove($key)
 
     public function merge($data)
     {
-        $this->data($this->data()->merge(collect($data)->filter(fn ($v) => $v !== null)->all()));
+        $merged = $this->data()
+            ->except(['roles', 'groups'])
+            ->merge(collect($data)->filter(fn ($v) => $v !== null)->all());
+
+        $this->data($merged->all());
 
         return $this;
     }

tests/Auth/Eloquent/EloquentUserTest.php

@@ -335,6 +335,20 @@ public function it_does_not_save_null_values_on_the_model()
         $this->assertFalse($attributes['not_null_field']);
     }
 
+    #[Test]
+    public function merge_does_not_set_roles_and_groups_as_model_attributes()
+    {
+        $user = $this->user();
+
+        $user->merge(['name' => 'Updated Name']);
+
+        $attributes = $user->model()->getAttributes();
+
+        $this->assertArrayNotHasKey('roles', $attributes);
+        $this->assertArrayNotHasKey('groups', $attributes);
+        $this->assertEquals('Updated Name', $attributes['name']);
+    }
+
     #[Test]
     #[Group('passkeys')]
     public function it_gets_passkeys()