Spot the bug in the Laravel controller

<?php

final class OrderController
{
    public function update(Request $request, int $orderId): JsonResponse
    {
        $data = $request->validate([
            'status' => ['required', 'in:cancelled'],
        ]);

        $order = Order::findOrFail($orderId);
        $order->update($data);

        return response()->json($order);
    }
}