Laravel 13.36.0 was released on October 14, 2026. The update gives Illuminate\Validation\Rule a builder for every validation rule that previously had only string syntax. Examples include required_with, accepted_if, url, uuid, and distinct. The new API supports IDE completion.

use Illuminate\Validation\Rule;

$request->validate([
    'phone' => [Rule::requiredWithout('email')],
    'website' => ['nullable', Rule::url()->protocols(['https'])],
    'device_id' => [Rule::uuid()->version(4)],
    'tags.*' => [Rule::distinct()->ignoreCase()],
    'password' => ['required', Rule::confirmed()],
]);

Rule::required() and Rule::nullable() return plain rule strings. Builders that receive field names or values pass those arguments as an array, so commas inside a value remain intact. Rule::date() also gains equals(). The change was contributed by @ericmp33 in pull request #61833.

Jack Bayliss added olap() and isVitess() to the MySQL connection. PlanetScale runs on Vitess, whose default OLTP workload limits a query to 100,000 rows. DB::olap() switches both read and write connections to the OLAP workload for a callback, then restores the previous workload. On a non-Vitess database, it only runs the callback, so the same code also works with local MySQL.

Queue workers can set Worker::$flushStickyConnections = true to reset sticky database connections before each job. With sticky read/write connections, a write routes later reads to the write connection. The option is disabled by default because a later job may depend on data written by an earlier job.

Kévin Dunglas changed Mercure broadcasting so events sent only to Mercure run synchronously by default. Events that also target another connection remain queued. MERCURE_ASYNC=true restores asynchronous publishing, and queue workers in that mode require MERCURE_URL. The release also prevents Artisan crashes when BROADCAST_CONNECTION=mercure has no URL and when FrankenPHP lacks mercure_publish().

Queued mailables now honor #[DeleteWhenMissingModels] and #[FailOnTimeout], along with their matching properties. If the referenced Order is deleted before delivery, the job is deleted and does not fail with ModelNotFoundException. A timed-out mailable is marked as failed, which prevents an automatic retry from sending it twice. Volodya Kurshudyan contributed this fix.

Stephen Rees-Carter fixed Markdown mail escaping. A backslash in user input could previously escape a link's closing bracket and alter its target. Backslashes are now escaped together with brackets.

The remaining changelog includes worker timeout exit codes, background queue configuration, queue:work --json connection data, and fixes for a Prompts-related test-suite memory leak. It adds named S3 credential providers, Cloud IAM disks, EncodedParameter, and support for phpstan/phpstan:2.3.1. phpredis now rebuilds correctly when no cluster node is reachable and releases persistent sockets before rebuilding.

Other fixes cover PgBouncer SSL EOF failover errors, Notification::locale(), morph map aliases in constrain(), morphWith(), and loadMorph(), numeric keys in JSON translation files, Number::pairs(), mailer retry_after handling, and eventStream() messages containing line breaks. The release also updates Schema::getColumn(), Arr::first(), Context::pop(), queue notification batching, JSON path updates, process timeouts, unique queued listener locks, broadcast UniqueFor attributes, recursive reconnect handling, contextual binding lookup, and model attribute casts. Test, cache, proxy, console, StyleCI, GitHub Actions, and view cleanup changes are included as well.