vivace is a Rust reimplementation of composer install that produces a byte-for-byte identical vendor directory compared to Composer 2.10. It runs 5 to 16 times faster across the benchmarked operations. It requires an exi…
Osama Aldemeery withdrew the PREG_THROW_ON_ERROR vote after 56 hours following a policy objection from Tim Düsterhus. The weekly internals recap also covers Gina Banyard's undefined-behaviour proposal, progress on sunset…
Laravel Telescope 5.24.0, released September 8, 2026, adds two Artisan commands, telescope:list and telescope:show, for inspecting recorded entries from the terminal. Both support filters and JSON output for scripts and …
PHP 8.6 arrives on 19 November 2026 as a light release: partial function application, a Duration class, and about thirty deprecations. My argument: the version bump is trivial, so spend the saved time making deprecation …
PHP 8.6 arrives 19 November 2026 with partial function application, the Time\Duration class and roughly thirty deprecations that map out PHP 9.0. A new overview covers the features, the migration work and why enabling E_…
Laravel v13.31.0 ships a new Queue::totalSize() method and a JobInterrupted event for Interruptible jobs. The release also adds chaperone support for BelongsToMany pivot models, a Vite devServerUrl() method, once asserti…
GiveWP's first attempt at fixing CVE-2026-82222 detected the malicious object and then returned the original payload anyway. That single line is the whole lesson of this CVSS 10.0 bug: allowed_classes => false does not d…
Laravel released v12.69.2, a patch on the 12.x branch. It sets a default memoryExceededExitCode for Laravel Cloud and corrects closure return types in withFreshQueryLog() and askWithCompletion(). The release is available…
Fuzz, a package by Jon Purvis, adds coverage-guided fuzz testing to Pest 5 via nikic's PHP-Fuzzer. It mutates seed strings, tracks code coverage without Xdebug, and reports crashes as failed tests. A walkthrough shows it…
CVE-2026-82222 affects GiveWP up to 4.16.7.1, a WordPress donation plugin with over 100,000 installs. An unauthenticated attacker can chain a registration bypass, a weak unserialize helper and a TCPDF gadget chain into r…
Symfony 7.3 gave voters a Vote object and addReason(); 7.4 and 8.0 add extraData plus two Twig functions that expose the whole access decision. The boolean era of authorization is quietly over, and the per-voter logger c…
Timo Poppinga has opened an internals discussion on an RFC to expose OpenSSL provider-based algorithms generically in ext/openssl. The goal is support for post-quantum algorithms like ML-KEM, ML-DSA and SLH-DSA, includin…
Taylor Otwell has disabled GitHub Issues on most Laravel open-source packages, asking users to describe bugs to a coding agent and submit pull requests instead. The main Laravel repository is unaffected. Symfony is exper…
PHP 8.5's |> is a one-rule feature: left value in, first argument out. The loudest complaint is the parentheses you need around every multi-argument arrow function. I think that friction is the operator's best quality, b…
Voting has started on a PHP RFC that adds an opt-in PREG_THROW_ON_ERROR flag for preg_* functions. With the flag, PCRE errors surface as a \PregException instead of requiring preg_last_error() checks. The vote closes on …
PHP 8.5's new pipe operator lets developers write chained function calls in execution order instead of nested inside-out. The syntax compiles to the same opcodes as traditional calls, so there is no runtime cost. Multi-a…
FrankenPHP 1.12.7 is out. The patch release fixes a classic-mode bug where output sent after fastcgi_finish_request() was silently dropped, corrects a thread-count metric, tones down client-disconnect logging, and remove…
A French field report on moving a Sulu site to FrankenPHP measures 30 to 40 ms saved per request, zero repeated MySQL connections, and one nasty 404 in production. Kai argues the modest, honest numbers are a better case …
The weekly PHP internals recap covers a Unicode identifier scan across half a million files, Nick Sdot's RFC to end PEAR endorsement with only Net_SMTP still maintained, a dispute over whether base conversion functions s…
John Koster's Forte package parses Laravel Blade files into a typed syntax tree that developers can query, rewrite, and render back byte-identical. The Laravel News walkthrough covers codemods, audits, and CI checks, plu…
Laravel 13.27 can finally stop interpolating bound values into QueryException messages, which means your logs, failed_jobs rows and APM traces stop collecting customer data by accident. I say flip the flag in production …
Sebastian Bergmann argues that European digital sovereignty already runs on PHP applications like TYPO3, Drupal and Nextcloud, citing Germany's €108 million Government Site Builder and the EU's 770 Drupal sites. His piec…
Laravel 13.30 ships chunkBy() for grouping adjacent collection items, forces Storage::path() through the Flysystem path normalizer so traversal attempts now throw PathTraversalDetected, prints the queue worker's stop rea…
Laravel v12.69.0 disables HTML in exception page tooltips by default and verifies the password hash against the stored cookie before authenticating the user. Both fixes come from contributor Mior Muhammad Zaki (crynobone…
Robert Landers has opened discussion on a nameof() RFC for PHP. The construct would return the name of a variable, property, method, function or constant as a string, usable anywhere a string literal is allowed, includin…
Brent Roose, PHP developer advocate at JetBrains and creator of the Tempest framework, has joined The PHP Foundation's Board of Directors in the JetBrains Platinum Sponsor seat. He replaces Roman Pronskiy, founding membe…
PHPStreamServer 0.9, the largest update to the PHP-based application server, now requires FFI for native OS APIs, supports dynamically registered workers and scheduled tasks, and ships a hardened Unix-socket message bus …
Eleven Laravel releases in under three months, and everyone is talking about the image component. I think the additions that earn the upgrade are the defensive ones: masked query bindings, refreshForUpdate() for pessimis…
Inertia.js v3.7.0 adds a cancelOnUnmount attribute and a cancel method to the <Form> component, letting developers abort in-flight submissions when a form unmounts or on demand. usePoll now reports a reactive polling sta…
