Composer 2.2.30 is a security release for the 2.2 LTS line. It patches a path traversal issue via package bin symlinks (CVE-2026-59944), a command injection through malicious Perforce URLs, and two credential-leak fixes …
Composer 2.10.3 patches four security issues, including symlink-based path traversal in package binaries and command injection via malicious Perforce URLs. The release also fixes PHP 8.6 deprecations and several bugs. Up…
Laravel Boost v2.6.0 merges its overlapping testing skills into one dynamically composed testing-best-practices skill for AI agents. It also enforces read-only transactions at the database level for the DatabaseQuery MCP…
Laravel 13.27 ships a per-connection option to keep query bindings out of exception messages, a whereBinary() family for byte-exact comparisons on MySQL and MariaDB, refreshForUpdate() for reloading models under a pessim…
The Swoole team has open sourced TypePHP, an ahead-of-time compiler that translates PHP into C++ and then native machine code. The compiler is written in PHP itself and fully self-hosting, and it interoperates with the Z…
Laravel AI v0.11.0 introduces ToolSearch, a wrapper that defers tool definitions so providers load them only when needed. The feature maps to hosted tool search on OpenAI and Anthropic, cutting prompt tokens for agents w…
Taylor Otwell tagged the v11.56.1 release of the laravel/framework GitHub repository on 25 August. The tag points to commit d5a6525, labeled "version". The release page lists no further changelog details.
Keyset pagination is the part everyone quotes, and it's the part you'll finish before lunch. What actually turned an 18-hour fintech outage into a boring 8-hour Saturday was the checkpoint, the pause flag, the verificati…
Laravel Auditor by Punyapal Shah equips existing AI coding agents with a written audit methodology, 75 stable rules and read-only project collectors, instead of letting them guess at bugs. The package requires PHP 8.3+ a…
A VLD dump against PHP 8.3.6 shows declare(strict_types=1) leaves the bytecode untouched: same RECV, same VERIFY_RETURN_TYPE, one file-level flag. That kills the performance excuse and exposes the real problem, caller-si…
With PHP 8.6.0 Beta 1 now available, a r/PHP thread asks developers which changes they are most eager to use in production once the stable release ships. The discussion reflects broader confidence in PHP's steady, pragma…
Symfony has published the maintenance release 6.4.44. The update fixes bugs across nearly all components, including Serializer, Security, Messenger, Form, HttpKernel and DependencyInjection, plus updated Validator transl…
The weekly PHP internals recap covers 12 threads: a new array_search_range() proposal met a counter-proposal for lazy array slices, ini_get_all() case sensitivity sparked a withdrawn PR, JSON comment flags were proposed …
Laravel AI SDK v0.11.0 assigns every agent run a single invocation ID and fires lifecycle events around each provider round-trip and tool call. It also adds hosted tool search for OpenAI and Anthropic and broadens failov…
PHP 8.4 moved lazy loading into the engine, so Symfony and Doctrine stopped generating proxy classes. The real payoff is that the object in your debugger is finally the class you wrote. The catch: laziness is now invisib…
FrankenPHP 1.12.7 is out with a fix for classic mode, where output written after fastcgi_finish_request() was silently discarded. The patch release also corrects the thread-count metric and removes an opcache restart hoo…
On the PHP internals list, Robert Chapin objects to the RFC proposing deprecation of fuzzy type casts, warning of a backward compatibility break comparable to the PHP 8.0 equality operator change. He asks that the stalle…
Laravel Tackle is an open-source package that embeds an AI coding agent directly into a Laravel application as Artisan commands. It reads routes, queries databases, reviews pull requests, and can self-heal failed queue j…
Symfony 8.0 removed the XML loader for services and routes, deprecated the fluent config builders, and bet on YAML plus a typed array format. Kai argues the cull is right: config formats should be judged by what machines…
Taylor Otwell tagged Laravel Framework v11.56.0 on August 20 as commit 3dc2399. The release listing on GitHub carries no changelog notes beyond the version marker, so teams on the 11.x branch should review the compare vi…
Symfony 8.0, released November 27, 2025, removes the XML configuration loader for services and routes entirely. YAML remains supported and gains JSON schema tooling, while a new array-based PHP format replaces the deprec…
The PHP Foundation's Ecosystem Security Team has published a step-by-step guide by Sebastian Bergmann for PHP maintainers who receive a vulnerability report. It covers private triage, safe proof-of-concept handling, GitH…
Laravel v13.26.0, released on August 18, 2026, adds a read-through filesystem driver that promotes files from a fallback disk on first read, debouncing for queued event listeners via #[DebounceFor], and a Queue::forward(…
Laravel 13.25's tabbed dev UI will collect the screenshots, but the release's real gift is queue:pause --all: a precise fix for the deploy window where fresh code meets stale workers. I argue why that command, and the ca…
Laravel 12.67.0 tightens temporary upload URL handling, closes a loose-comparison bypass in validation rules, and escapes single quotes in Postgres JSON paths. It also adds retries for timed-out cloud agent long-polls an…
Laravel Chores, a package by Amr Lotfy Saleh, wraps one-off data operations in batches that checkpoint progress to the database after every batch. An interrupted run resumes where it stopped. Inspired by Shopify's mainte…
The serversideup/php v4.6.0-beta1 images introduce a CADDY_ACME_PROFILE variable that selects Let's Encrypt's shortlived profile, the only profile under which IP-address certificates are issued. A FrankenPHP container re…
