RepoJournal
Laravel

@laravel

PHP's most popular framework - Forge, Vapor, and a massive paying audience

Keep up with Laravel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Tue 16 jun
  2. Wed 17 jun
  3. Thu 18 jun
  4. Fri 19 jun
  5. Sat 27 jun
  6. Mon 29 jun
  7. Tue 30 jun
  8. Wed 1 jul
  9. Thu 2 jul
  10. Fri 3 jul
  11. Sat 4 jul
  12. Sun 5 jul
  13. Tue 7 jul
  14. Wed 8 jul
  15. Thu 9 jul
  16. Fri 10 jul
  17. Sat 11 jul
  18. Mon 13 jul
  19. Tue 14 jul
  20. Wed 15 jul
  21. Thu 16 jul
  22. Fri 17 jul
  23. Sat 18 jul
  24. Sun 19 jul
  25. Mon 20 jul
  26. Tue 21 jul
  27. Wed 22 jul
  28. Thu 23 jul
  29. Fri 24 jul
  30. Today 25 jul
Topics: PHP Full archive →

The Wire · Showcase

ACTIONS/CHECKOUT 7.0.1 ROLLS OUT ACROSS LARAVEL ECOSYSTEM

By RepoJournal · Filed · About Laravel

dependabot scybulski
2 people shipped this
dependabot @dependabot 4 cited scybulski @scybulski 1 cited

GitHub Actions security patch lands in four Laravel notification and UI libraries as the ecosystem tightens its CI/CD hygiene.

The actions/checkout v7.0.1 patch, which skips running unsafe PR checks when input is default [1], is now live across vonage-notification-channel [1], envoy [2], slack-notification-channel [3], and ui [5]. The fix addresses a safety condition in pull request handling that could have bypassed intended security gates. More significant for production stacks: slack-notification-channel merged support for Guzzle 8.0 [4], ending the pinch point for teams running HTTP client 8.x alongside Laravel's first-party notification drivers. All changes land cleanly with zero breaking surface - this is pure housekeeping that unblocks dependency upgrades you've probably already wanted to ship.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group ↗ laravel/vonage-notification-channel
  2. [2] Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group ↗ laravel/envoy
  3. [3] Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group ↗ laravel/slack-notification-channel
  4. [4] allow guzzlehttp/guzzle 8.0 (#118) laravel/slack-notification-channel
  5. [5] Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group ↗ laravel/ui

Quick answers

What shipped in Laravel on July 25, 2026?
GitHub Actions security patch lands in four Laravel notification and UI libraries as the ecosystem tightens its CI/CD hygiene. In total, 1 commits and 5 pull requests landed.
Who contributed to Laravel on July 25, 2026?
2 developers shipped this update, including dependabot and scybulski.
What were the notable Laravel updates?
Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group, Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group, and Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group.

More from @laravel

Laravel @laravel

VAPOR-CLI SHIPS 1.70.2 WITH STYLE FIXES AS AI TIGHTENS LANGUAGE HANDLING

Vapor-cli v1.70.2 lands with code cleanup [ref:2] while the Laravel AI package now preserves conversation titles in the user's language instead of defaulting to English [ref:6].

Mohamed Said yuters dependabot
php 11 shipped 1-min read
Laravel @laravel

LARAVEL LSP FIXES CONFIG COMPLETIONS, FRAMEWORK TIGHTENS TEST PATTERNS

Laravel LSP v0.0.27 shipped with a critical fix for dotted config key completion, while the framework enables 16 Rector rules to modernize test patterns across 13.x.

dependabot Titas Gailius github-actions[bot] github-actions +3
php 15 shipped 1-min read
Laravel @laravel

LARAVEL 13 DOUBLES DOWN ON ATTRIBUTES AND AI DOCS

The framework is shipping request-scoped attributes, trait-level model attributes, and a major CI refactor while docs race to cover the expanding AI SDK surface.

dependabot pushpak1300 lucasmichot jackbayliss +3
php 31 shipped 2-min read
Laravel @laravel

LARAVEL 13.x CUTS DEAD CODE FROM JSON:API RESOURCES, ADDS NATIVE ROUTE KEY ATTRIBUTES

The framework dropped never-executed generator logic that was silently re-resolving nested relationships on every request, while introducing a cleaner declarative way to customize route binding keys.

DAFFA ADITYA PRATAMA nimnaherath Chris Lloyd pushpak1300 +1
php 16 shipped 2-min read

Daily updates, in your inbox

Follow Laravel

Keep up with Laravel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

github-actions[bot] hntrl dependabot ak684 +6
ai-agents 28 shipped 1-min read
Local LLMs Local LLMs

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.

dhiltgen ParthSareen Xuan-Son Nguyen Johannes Gäßler +11
llms 210 shipped 2-min read
CachyOS @CachyOS

HYPRLAND V0.56 FIXES LAND, PACKAGE ECOSYSTEM ROLLS FORWARD

Hyprland configuration updated for v0.56 compatibility across multiple desks, while the AUR-derived ecosystem locked in four automated package bumps.

cantosun99 Jinra Aarrayy Valeri +7
infra 85 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

LIVEVIEW ASYNC CLEANUP FIX SHIPS ALONGSIDE RANGE OPTIMIZATIONS

Phoenix LiveView closes a critical async task test failure while Elixir cuts unnecessary abs calls from Range operations.

Barna Kovacs Alexander Gubarev SteffenDE José Valim +1
elixir 19 shipped 1-min read
Want every project, not just this one?