Symfony 8.2 brings plenty of new features, but the one I care most about is a single transport option: the transactional outbox. Once preventing dual writes takes one line of config, sending to the broker directly from i…
Laravel published framework version 13.35.0 on 6 October. The release adds percentage values to queue:work --memory, new scheduling controls, QUERY route support, response markdown() and lazy local-disk root creation. It…
Matthieu Napoli has opened an RFC for --enable-cli-fpm, a build option that embeds FPM in the php executable. The combined binary would select FPM through --fpm as its first argument or through a php-fpm name, with norma…
PHPStan 2.3.0, released on 6 October, fixes 75 issues and delivers a major analysis speedup. The WordPress core benchmark falls from 60 seconds in PHPStan 2.1.33 to under eight seconds. PHPStan Turbo adds another 60% ove…
Symfony 8.2 is scheduled for November 2026 and will require PHP 8.4 or newer. The development branch adds component-owned bundles, recent-authentication checks, native OpenID Connect login, transactional Messenger outbox…
Mago, the Rust toolchain for PHP, formats, lints, analyzes and guards architecture from one binary, and its speed is real. Kai argues the smart move is to let it take over the fast, cheap checks right now, keep your plug…
This article explains what the score measures and where the 15 underlying checks appear. Maintainers learn what they must do for private plugins or packages outside Filament. It also shows how a perfect 100/100 score and…
PHP internals is voting on an RFC titled “End PEAR Project Endorsement.” Nick Sdot opened the vote and linked the RFC’s wiki page and discussion thread. The proposal needs a two-thirds majority to pass. Voting ends on 19…
Mago combines PHP formatting, linting, static analysis and architectural checks in one Rust binary. Version 1.51.2 offers 190 lint rules and parallel execution. The project reports a 29-fold speed advantage over PHP-CS-F…
Sjoerd Langkemper has proposed PASSWORD_BCRYPT_SHA256 for PHP’s password_hash() and password_verify(). Existing bcrypt can mishandle null bytes and ignores password data beyond 72 bytes. The proposal applies HMAC SHA256 …
FrankenPHP 1.13.0, released on 4 October, updates the embedded server to Caddy 2.11.7 and adds Mercure 1.0. The release fixes five security issues, including two high-severity flaws, hardens configuration reloads, change…
Smarty PHP releases before 4.5.8 and 5.8.5 can escalate a template injection issue from cross-site scripting to remote code execution under specific conditions. The attacker must control an unescaped rendered value. The …
Partial Function Application lands in PHP 8.6 and finally makes the pipe operator pleasant to use. It is also easy to misread. A partial evaluates its fixed arguments once, when you create it, and it drops most attribute…
Laravel News reviews Inertia.js 3.8.0, a release aimed at edge cases in SSR, numeric transport, forms, optimistic navigation, and history restoration. The practical highlights are WhenMounted for React, Vue, and Svelte, …
PHPUnit 13.4.0 is available as a new release of the PHP unit testing framework. The announcement links to the release page maintained by Sebastian Bergmann's project on GitHub. The supplied notice does not list changes o…
FrankenPHP 1.12.7 fixes lost output in classic mode after fastcgi_finish_request() or frankenphp_finish_request(). The release also corrects the frankenphp_total_threads metric and removes an opcache restart hook that co…
Since the earlier bcrypt report, the discussion has expanded to a possible change of the default algorithm, while PHP 8.6.0RC2 becomes the first release candidate after RC1 was skipped. The Oct. 1 roundup also covers Io\…
Laravel 14 introduces defaults() for Eloquent models, letting default attributes depend on runtime values such as config(), now(), or feature flags. defaults() overrides the $attributes property but loses to values passe…
The PHP Foundation is accepting proposals for its 2027 contractor program until October 20, 2026, at the end of the day in Anywhere on Earth time. The call targets experienced C and systems programmers who can maintain P…
Laravel has fixed two security issues in laravel/ai and laravel/mcp. Laravel AI SDK 1.0.0 allowed server-side requests through its Vercel and AG-UI adapters, while Laravel MCP mishandled OAuth redirect validation. Instal…
Jakub Zelenka has opened discussion on an early PHP RFC for IO hooks and operations. The proposal depends on the newly introduced Polling API Additions RFC and could later gain Ring API support. A working proof of concep…
Laravel AI SDK 1.0 lets an agent pause a tool call until a human decides what happens. That's useful, and it's also a dialog box. Anyone who has watched people click through dialog boxes knows how that ends. Kai argues t…
Laravel 13.34.0 adds opt-in accounting for worker crashes in maxExceptions, timeout notification for Interruptible jobs, and execution duration on JobProcessed. The release also scopes queue:flush to one queue, adds Sche…
PHP 8.5 ships Uri\Rfc3986\Uri and Uri\WhatWg\Url, and the obvious complaint is that one clean class would have been simpler. Kai argues the split is the real fix: most URL bugs come from two components reading the same s…
Laravel released v11.57.0 of its framework on GitHub. taylorotwell created the tag on 29 September at 15:33. The release page lists no changelog entries. The update confirms the version tag but leaves the code changes un…
Symfony released version 6.4.47 on 29 September. The update fixes escaping in generated PHP code and tightens Redis namespace cleanup. Serializer cache keys and YAML parsing also receive fixes, alongside HTTP client and …
Sjoerd Langkemper has proposed the PHP RFC bcrypt_max_password_length. It would make password_hash() throw ValueError when bcrypt receives input longer than 72 bytes. PHP currently truncates longer input silently, hashin…
laravel/mcp 1.0 drops server-side sessions, and for a language built on share-nothing requests that part of the upgrade is mostly a grep. The work that deserves real thinking is the one nobody forces on you: deciding whi…
A new Laravel-focused walkthrough tests Laravel AI SDK v1 with real OpenAI API calls. It examines middleware applied per step and approvals for tool execution. The guide also covers conversations and streaming. It adds p…
Pratik Bhujel has proposed Io\Terminal for PHP 8.7. The API would add native terminal sessions, size detection, safe raw mode, normalized key input, and hidden input to ext/standard. A reduced implementation is under rev…
