Laravel 12.67.0 ships with fixes for validation bypass and Postgres JSON escaping
Laravel 12.67.0 tightens temporary upload URL handling, closes a loose-comparison bypass in validation rules, and escapes single quotes in Postgres JSON paths.
It also adds retries for timed-out cloud agent long-polls and avoids quadratic wildcard rule expansion.
Laravel 12.67.0 is out on the 12.x branch. The release contains six merged pull requests; half of them come from Mior Muhammad Zaki (crynobone).
Two changes affect security-relevant behavior. Temporary upload URLs now fetch data strictly from the request's query string instead of broader input sources. A validation rule improvement closes a bypass that relied on loose comparison. A third fix escapes single quotes in Postgres JSON path attributes.
On the reliability side, cloud agent long-polls that time out are now retried automatically, contributed by Kieran Brown. Tim MacDonald promoted nested data to top-level managed queue events. A backport from OutlawPlz avoids quadratic wildcard rule expansion, which should speed up validation with many wildcard rules.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.