The Php Times

Laravel Boost v2.6.0 was released on August 26, 2026. The update reworks how Boost instructs AI coding agents about tests and tightens the safety of its database tooling.

Previously Boost shipped several overlapping testing skills, including pest-testing, enforce-testing and phpunit-guidelines. Because they contradicted each other, agents could produce inconsistent suites, test framework internals, or add redundant mocks. The new release consolidates everything into a single testing-best-practices skill. Boost composes it dynamically based on the testing packages installed in the project, adapting to Pest, PHPUnit, browser testing and Test Impact Analysis.

The skill covers nine areas. Assertions: prefer semantic assertions such as assertOk(). Avoid raw status code checks. Endpoint tests: focus on authorization and core responses. Skip full validation-matrix testing. Feature discovery: locate existing tests before writing new ones. Isolation: prevent shared state leaks. Naming: describe expected behavior. Performance: avoid slow patterns like unnecessary database records in setup hooks. Review: audit suites and prune duplicate coverage. Security: test hostile inputs and unauthenticated boundaries. Test data: use focused model factories. The change landed in PR #769.

The DatabaseQuery MCP tool previously relied on lexical parsing and keyword filtering to block writes, which can miss constructs such as data-modifying CTEs. In v2.6.0 queries run inside a database-enforced read-only transaction: MySQL and MariaDB get SET TRANSACTION READ ONLY before the transaction starts, PostgreSQL sets it after BEGIN, and SQLite uses PRAGMA query_only = ON. Boost always rolls the transaction back afterwards, so the engine itself rejects modifications (PR #957).

Smaller fixes round out the release. boost:add-skill now ignores repository-root SKILL.md files, which had allowed the command to delete an entire skills directory, and it accepts arbitrary skill path shapes (PRs #954, #960). Schema reads now work when MySQL runs in ANSI_QUOTES mode (PR #958). Boost preserves trailing comments when writing MCP server configuration to JSON files (PR #977) and no longer false-positively detects Antigravity when scanning the shared .agents directory (PR #981).