Laravel 12.67.0 is out on the 12.x branch. The release contains six merged pull requests; half of them come from Mior Muhammad Zaki (crynobone).

Two changes affect security-relevant behavior. Temporary upload URLs now fetch data strictly from the request's query string instead of broader input sources. A validation rule improvement closes a bypass that relied on loose comparison. A third fix escapes single quotes in Postgres JSON path attributes.

On the reliability side, cloud agent long-polls that time out are now retried automatically, contributed by Kieran Brown. Tim MacDonald promoted nested data to top-level managed queue events. A backport from OutlawPlz avoids quadratic wildcard rule expansion, which should speed up validation with many wildcard rules.