Laravel 13.21 Adds RouteKey Attribute and Broader Image Format Support

Laravel 13.21, released July 21, 2026 alongside patch 13.21.1, adds a #[RouteKey] attribute for declarative route model binding, a base64 validation rule, and a #[RequestAttribute] contextual attribute for injecting request data into controller parameters. The Image component now outputs PNG, GIF, AVIF, and BMP, and the application builder class becomes customizable.

Laravel 13.21 was tagged on July 21, 2026 together with a same-day patch release, 13.21.1, which only bumps the framework's internal version constant and adds no functional changes; the two are effectively one release for developers.

The headline addition is a #[RouteKey] class attribute for Eloquent models. Previously, customizing the column used for implicit route model binding required overriding the getRouteKeyName() method. Now a model can simply declare #[RouteKey('slug')] above the class definition, following the same pattern already used by #[ObservedBy] and #[ScopedBy]. If no attribute is present, getRouteKeyName() still falls back to the model's primary key. The feature was contributed by GitHub user nimnaherath in pull request #60841.

A new base64 validation rule has been added to the validator's string-format checks, closing a gap already covered by libraries such as Zod. It confirms that a field is a valid RFC 4648 Base64 string by requiring strict-mode decoding that re-encodes to an identical string, so malformed padding or stray characters fail validation. Contributed by lucasmichot in PR #60808.

A #[RequestAttribute] contextual attribute now lets developers inject values previously stored on the request's attribute bag (for example, a tenant or organization resolved by middleware) directly as typed method parameters, instead of manually calling $request->attributes->get(). An example shows #[RequestAttribute('org')] Organization $org used in an InventoryController::index() method. Contributed by cosmastech in PR #60847.

The Image component, introduced in Laravel 13.20, previously supported only WebP, JPG, and JPEG conversion despite the bundled Intervention Image library supporting more formats. Laravel 13.21 adds toPng(), toGif(), toAvif(), and toBmp() fluent methods. The release also fixes Image::extension(), which lacked an image/avif MIME mapping and had been generating incorrect .bin file extensions for AVIF output. Contributed by Tresor-Kasenda in PR #60713.

Application::configure() previously hardcoded the ApplicationBuilder class, forcing packages that extend Laravel's Application class to override the entire method just to swap builders. A new protected static $applicationBuilder property now allows subclasses to specify a custom builder while keeping the existing configuration API (PR #60848).

The Illuminate\Concurrency component gains its own read-only Git subsplit, joining other Illuminate components already published as standalone packages (PR #60836).

Additional fixes in this release: database transaction rollback callbacks now fire correctly (#60777); a new lost-connection message pattern is recognized to trigger automatic reconnects (#60819); Grammar::whereColumn() now escapes question marks (#60832); InvalidPayloadException messages include the job name and queue (#60799); passing an enum to LogManager::forgetChannel() no longer throws a TypeError (#60801); RedisTaggedCache::decrement() now handles enum keys (#60821); Str::wordWrap() correctly handles multibyte strings (#60814); contextual attribute caching no longer collides across properties of the same class (#60815); falsey concurrency exception parameters are now preserved (#60822); host port parsing in the serve command is fixed (#60828); and an undefined index error in Pipeline\Hub::pipe() is resolved (#60802).