Laravel shipped eleven minor releases from 13.17 to 13.27 in under three months. Highlights include a first-party Illuminate\Image component, queue:pause --all for stopping every queue at once, a mask_bindings_in_excepti…
Symfony shipped version 6.4.45 alongside 7.4.18 and 8.1.6, bundling dozens of hardening fixes across HttpClient, HttpFoundation, Security and Mailer/Notifier components. Most changes reject malformed or malicious input r…
FrankenPHP collapses Nginx and PHP-FPM into one Caddy-based binary, and its worker mode keeps your app resident between requests. Kai argues the persistence trap everyone warns about is actually the strongest reason to t…
All Laravel starter kits now build with Vite+, the unified toolchain released in beta in July 2026. The switch, made via laravel/maestro#60, replaces ESLint and Prettier with a single vp CLI covering linting, formatting,…
PHP 8.5 gives you a curl share that survives between FPM requests, and the benchmark headline says an 88 percent cut in request time. I think the number is the least interesting thing here. The function is worth studying…
The August 26 edition of This Week In PHP Internals covers a debate over LLM-written list posts, Sepehr Mahmoudi's new array_str_contain() RFC meeting unanimous resistance, an intl extension roadmap, and a first-time con…
The PHP project has published two new patch versions: PHP 8.5.10 and PHP 8.4.25. Both releases continue the regular maintenance cycle for the currently supported stable branches and are available for download on php.net.…
Four lines of PCNTL turn a silently killed PHP process into a clean exit, and every team should ship them. But a signal handler only guarantees the current work item finishes. If that item is a forty-minute report over t…
Composer 2.2.30 is a security release for the 2.2 LTS line. It patches a path traversal issue via package bin symlinks (CVE-2026-59944), a command injection through malicious Perforce URLs, and two credential-leak fixes …
Composer 2.10.3 patches four security issues, including symlink-based path traversal in package binaries and command injection via malicious Perforce URLs. The release also fixes PHP 8.6 deprecations and several bugs. Up…
Laravel Boost v2.6.0 merges its overlapping testing skills into one dynamically composed testing-best-practices skill for AI agents. It also enforces read-only transactions at the database level for the DatabaseQuery MCP…
Laravel 13.27 ships a per-connection option to keep query bindings out of exception messages, a whereBinary() family for byte-exact comparisons on MySQL and MariaDB, refreshForUpdate() for reloading models under a pessim…
The Swoole team has open sourced TypePHP, an ahead-of-time compiler that translates PHP into C++ and then native machine code. The compiler is written in PHP itself and fully self-hosting, and it interoperates with the Z…
Laravel AI v0.11.0 introduces ToolSearch, a wrapper that defers tool definitions so providers load them only when needed. The feature maps to hosted tool search on OpenAI and Anthropic, cutting prompt tokens for agents w…
Taylor Otwell tagged the v11.56.1 release of the laravel/framework GitHub repository on 25 August. The tag points to commit d5a6525, labeled "version". The release page lists no further changelog details.
Keyset pagination is the part everyone quotes, and it's the part you'll finish before lunch. What actually turned an 18-hour fintech outage into a boring 8-hour Saturday was the checkpoint, the pause flag, the verificati…
Laravel Auditor by Punyapal Shah equips existing AI coding agents with a written audit methodology, 75 stable rules and read-only project collectors, instead of letting them guess at bugs. The package requires PHP 8.3+ a…
A VLD dump against PHP 8.3.6 shows declare(strict_types=1) leaves the bytecode untouched: same RECV, same VERIFY_RETURN_TYPE, one file-level flag. That kills the performance excuse and exposes the real problem, caller-si…
With PHP 8.6.0 Beta 1 now available, a r/PHP thread asks developers which changes they are most eager to use in production once the stable release ships. The discussion reflects broader confidence in PHP's steady, pragma…
Symfony has published the maintenance release 6.4.44. The update fixes bugs across nearly all components, including Serializer, Security, Messenger, Form, HttpKernel and DependencyInjection, plus updated Validator transl…
The weekly PHP internals recap covers 12 threads: a new array_search_range() proposal met a counter-proposal for lazy array slices, ini_get_all() case sensitivity sparked a withdrawn PR, JSON comment flags were proposed …
Laravel AI SDK v0.11.0 assigns every agent run a single invocation ID and fires lifecycle events around each provider round-trip and tool call. It also adds hosted tool search for OpenAI and Anthropic and broadens failov…
PHP 8.4 moved lazy loading into the engine, so Symfony and Doctrine stopped generating proxy classes. The real payoff is that the object in your debugger is finally the class you wrote. The catch: laziness is now invisib…
FrankenPHP 1.12.7 is out with a fix for classic mode, where output written after fastcgi_finish_request() was silently discarded. The patch release also corrects the thread-count metric and removes an opcache restart hoo…
On the PHP internals list, Robert Chapin objects to the RFC proposing deprecation of fuzzy type casts, warning of a backward compatibility break comparable to the PHP 8.0 equality operator change. He asks that the stalle…
Laravel Tackle is an open-source package that embeds an AI coding agent directly into a Laravel application as Artisan commands. It reads routes, queries databases, reviews pull requests, and can self-heal failed queue j…
Symfony 8.0 removed the XML loader for services and routes, deprecated the fluent config builders, and bet on YAML plus a typed array format. Kai argues the cull is right: config formats should be judged by what machines…
