€0.00 — free as in speechtonight's forecast: clear skies over production Cache: warm · Deploys: fair, 0% rollbacks expectedset by moonlight, shipped before dawn · deploy freely Page A1

❦The Daily Commit❦ ☾The Nightly Build☽

Dev news, typeset daily — PHP · AI · The Wider Stack

The developer's evening paper — PHP · AI · The Wider Stack

Motto of the dayMotto of the night

“When PECL disappears, your containers won't. But have you considered moving anyway?”

Tuesday, October 20, 2026 Vol. I — No. 828 · Morning editionLate edition EN DE FR ES

PHP · The Lead · Releases

Laravel 13.38.0 updates query, queue and cache internals

Laravel 13.38.0, released on 20 October 2026, is a maintenance update for the 13.x branch. It adjusts validation, Eloquent relations, database queries, queues, notifications, logging, caching and lazy collections. The release adds stale-read protection and corrects float handling in Unique and mode(). Additional fixes address lock, route-cache and SQLite edge cases.

Laravel released framework version 13.38.0 for the 13.x branch on 20 October 2026. The release tag points to commit c42f9ab.

Validation now accepts float values in the Unique where rule. mode() no longer truncates float results, and date-comparison rules avoid a TypeError when given non-date values. Eloquent and database changes preserve ofMany() aliases inside closures and repair existence and aggregate queries for self-referencing one-of-many relations. Relations can now be cloned. Collection bounds now work with whereBetween and whereNotBetween. A child #[Connection] attribute takes precedence over an inherited $connection property, and Connection gains usingWritePdo. SQLite table alterations now quote table names correctly when foreign keys refer to names that require quoting.

→ continued: summary & source

curated by Sönke

PHP · Security

CVE-2026-108082 raises a Symfony CPU-exhaustion alert

A post in r/PHP identifies CVE-2026-108082 as a Symfony regular-expression denial-of-service issue. It claims that a single request can consume CPU for several seconds. The excerpt names no affected Symfony versions or fixed releases. Nor does it give exploit details or a vendor advisory. Treat the report as an alert pending confirmation.

curated by Sönke

PHP · Releases

RoadRunner 3 brings SemVer back to PHP infrastructure

RoadRunner 3 is available with a return to Semantic Versioning and a shared roadrunner/* package namespace. The release targets PHP 8.2 and newer, adds several HTTP, jobs, proxy, Redis and gRPC capabilities, and removes the TCP plugin while retaining tcp:// relay support. The API is stable, and no new major version is planned for the foreseeable future. The maintainers also present Rapira, a Rust-based PHP application server in development.

curated by Sönke


Ad — php-net.pro · in our own cause

Ad · php-net.pro

Reach 145,000+ PHP developers.

Sponsored posts on @php_net — the largest independent PHP account on X. From €399, booked online in minutes: write, preview, schedule, pay.

Book a post →

◇ this ad position rotates with every refresh · plus VAT where applicable


PHP · Security

Symfony patches four branches as UX 3.6 arrives

Symfony’s roundup for October 12 to 18, 2026 reports maintenance work across four release branches and security fixes in Yaml and HttpFoundation. Symfony UX 3.6 adds experimental tools, while the project previews Symfony 8.2 work around attribute workflows. The updates also matter to Laravel applications that rely on Symfony for HTTP and console components.

curated by Sönke

PHP · Releases

Laravel 13.36 expands validation APIs and tunes queues

Laravel 13.36, released in October 2026, adds fluent builders for more validation rules and introduces DB::olap() for analytical work on compatible Vitess systems such as PlanetScale. It also changes Mercure delivery defaults, improves queued mail handling, adds a Markdown-email security fix, and refines queue, Redis, S3, and Cloud IAM behavior.

curated by Sönke

PHP · Releases

FrankenPHP 1.13.0 tightens security and changes runtime behavior

The detailed upstream record for FrankenPHP 1.13.0 adds the missing release substance: five security fixes, including two high-severity issues, Caddy 2.11.7, Mercure 1.0, safer configuration reloads, PHP 8.6 compatibility, and revised thread accounting. It also documents migration changes for Mercure, Caddy, ZTS builds, and worker deployments. The release shipped on 4 October.

curated by Sönke

The Wider Stack

Dev · Releases

TypeScript 7.1 beta build is now available

TypeScript 7.1 has reached a beta release in the microsoft/TypeScript repository. GitHub lists the build as v7.1-beta. jakebailey published it on 20 October at 17:38, tied to commit 3e92363. The corresponding TypeScript 7.1.0-beta package is available on npm. The supplied release page contains no ch…

curated by Sönke


Situations Vacant — PHP

live from the Job.bo index — toggle skills, filter by location or remote

Browse all 875 PHP jobs → · Powered by Job.bo