Ecosystem — The Daily Commit
Security
MEDIUM · LARAVEL, October 19, 2026 — Symfony’s roundup for October 12 to 18, 2026 reports maintenance work across four release branches and security fixes in Yaml and HttpFoundation. Symfony UX 3.6 adds experimental tools, while the project previews Symfony 8.2 work around attribute workflows. The updates also matter to Laravel applications that rely on Symfony for HTTP and console components.
Releases
MEDIUM · LARAVEL, October 19, 2026 — Laravel 13.36, released in October 2026, adds fluent builders for more validation rules and introduces DB::olap() for analytical work on compatible Vitess systems such as PlanetScale. It also changes Mercure delivery defaults, improves queu…
Releases
FRANKENPHP RELEASES, October 16, 2026 — The detailed upstream record for FrankenPHP 1.13.0 adds the missing release substance: five security fixes, including two high-severity issues, Caddy 2.11.7, Mercure 1.0, safer configuration reloads, PHP 8.6 compatibility, and revised threa…
Releases
R/PHP (TOP), October 19, 2026 — RoadRunner 3 is available with a return to Semantic Versioning and a shared roadrunner/* package namespace. The release targets PHP 8.2 and newer, adds several HTTP, jobs, proxy, Redis and gRPC capabilities, and removes the TCP plugin while retaining tcp:// relay support. The API is stable, and no new major version is planned for the foreseeable future. The maintainers also present Rapira, a Rust-based PHP application server in development.
Releases
R/PHP (TOP) — Manticore, an ahead-of-time compiler for PHP 8.5+ with an LLVM backend, can now compile Symfony applications. The milestone covers skeleton projects without Doctrine and simple Symfony Console apps. Its built-in HTTP server reaches 15k RPS …
Tooling
MEDIUM · PHP — In September 2025, the PHP community approved guidance that favors PIE, the PHP Installer for Extensions, over PECL for installing non-bundled extensions. PIE 1.5.2 builds and enables packages from Packagist, while PECL continues to work wi…
The Lead · The Editorial
The RFC that deprecated PECL broke nothing and set no deadline, so most of us will leave pecl install where it is.
October 19, 2026 — I think that's the wrong move. The gaps in PIE are real but small, and every Dockerfile that switches early pushes the ones that still depend on PECL toward Packagist sooner.
The Editorial
mir, a Rust analyzer that reads psalm.xml, baselines and @psalm-* tags, checks Laravel and Symfony in about two seconds where Psalm takes close to a minute. The speed is the headline. The bigger story…
Security
MEDIUM · LARAVEL — Symfony 5.4.54 fixes CVE-2026-109449 in the ExpressionLanguage component by limiting how deeply expressions can nest. The maintenance release also improves cache handling and character escaping in the…
Releases: Laravel 13.37.0 tightens queues and Eloquent behavior B2
Tooling: Pest 5.3.2 skips all PHPUnit tests during sharded parallel runs B2
Security: Symfony 5.4 LTS ships a security-focused update B2
Reads: Inside PHP's Security Report Pipeline B2
Reads: Laravel 13.36.0 rounds out fluent validation rules B2
Releases: Symfony ships maintenance release v6.4.48 B2
RFC Watch: PHP proposal would add separate switches for relaxed JSON input B2
The Editorial: Laravel 13.35's best changes are global switches that should be the default B2
Reads: Inertia.js 3.9.0 makes polling visibility-aware B3
Releases: Laravel v12.70.0 fixes query issues and cache generation B3
The Editorial: PHP 8.6 Gets Louder, and Every New Exception Is a Free Bug Report B3
Security: PHP FastCGI flaw truncates IPv6 client checks B3
Reads: PHP 8.6 Reopens the Door to readonly Defaults B3
Releases: PHP 8.6 RC3 puts partial application first B3
The Editorial: PHP 8.5's best feature is the URL parser, not the pipe operator B3
Releases: PHP 8.5 adds pipelines and safer everyday APIs B3
Releases: FrankenPHP publishes version 1.13.1 B4
The Editorial: Retire POST /search: Route::query() should be your new default for filters B4
Reads: Wayfinder keeps Laravel routes type-safe in React B4
RFC Watch: PHP proposal targets a dedicated CSV extension B4
RFC Watch: PHP internals shifts bcrypt fix to an opt-in SHA-256 scheme B4
"All the Code That's Fit to Ship" · The Daily Commit · Screen edition · Imprint · Privacy Policy