Who contributed to Laravel on May 13, 2026?

4 developers shipped this update, including crynobone, timacdonald, mwikala, and loadinglucian.

What were the notable Laravel updates?

[13.x] Remove Composer `github-oauth` credentials on Linux & Windows Actions, [13.x] Remove Composer `github-oauth` credentials on Linux & Windows Actions (#60095), and Remove Composer `github-oauth` credentials on Linux & Windows Actions (#520).

@laravel

PHP's most popular framework - Forge, Vapor, and a massive paying audience

github ↗

Pick a date

Topics: PHP Full archive →

The Wire · Showcase

LARAVEL PLUGS GITHUB CREDENTIALS LEAK ACROSS INSTALLER AND CORE

By RepoJournal · Filed 06:00 UTC on May 13, 2026 · About Laravel

4 people shipped this

crynobone @crynobone 1 cited

timacdonald @timacdonald 1 cited

mwikala @mwikala 1 cited

loadinglucian @loadinglucian 1 cited

Laravel is systematically removing exposed Composer OAuth tokens from GitHub Actions workflows in both the installer and framework, a security hygiene fix rolling through 13.x.

The framework team [1] [2] and installer [3] are stripping `github-oauth` credentials from Linux and Windows Actions to prevent accidental token exposure in logs and artifacts—a pattern that should have been locked down long ago but is being addressed now across all entry points. The framework also shipped support for `after_commit` hooks on Cloud queue metrics [4], letting you defer metric writes until transactions actually land, which matters if you're tracking queue performance against eventual consistency. Over in laravel/boost, the MCP JSON config handler now preserves empty objects instead of converting them to arrays [5] , fixing a schema validation failure that was breaking OpenCode startup when Boost installed its server entry. The same crew also cleaned up redundant `.env` read guidance [6] from the MCP docs, removing noise after earlier core-guideline refactoring. Infrastructure work across `.github` workflows is adding Ubuntu runners and reusable composition patterns [7] , likely to support the credential cleanup rollout and future CI standardization.

Action items

→ Review your GitHub Actions workflows for exposed Composer credentials — audit `composer config` outputs in logs laravel/framework [immediate]
→ If using laravel/boost with MCP, upgrade to the latest commit with JSON object preservation laravel/boost [plan]
→ Monitor 13.x PRs landing — the credentials cleanup is live and rolling forward laravel/framework [monitor]

References

[1] [13.x] Remove Composer `github-oauth` credentials on Linux & Windows Actions ↗ laravel/framework
[2] [13.x] Remove Composer `github-oauth` credentials on Linux & Windows Actions (#60095) laravel/framework
[3] Remove Composer `github-oauth` credentials on Linux & Windows Actions (#520) laravel/installer
[4] [13.x] Add support for `after_commit` for Cloud queue metrics ↗ laravel/framework
[5] Preserve empty objects in MCP JSON config files ↗ laravel/boost
[6] Remove redundant guidance to read .env directly ↗ laravel/boost
[7] Add Ubuntu runner for setup-composer workflow laravel/.github

Quick answers

What shipped in Laravel on May 13, 2026?: Laravel is systematically removing exposed Composer OAuth tokens from GitHub Actions workflows in both the installer and framework, a security hygiene fix rolling through 13.x. In total, 13 commits and 6 pull requests landed.
Who contributed to Laravel on May 13, 2026?: 4 developers shipped this update, including crynobone, timacdonald, mwikala, and loadinglucian.
What were the notable Laravel updates?: [13.x] Remove Composer `github-oauth` credentials on Linux & Windows Actions, [13.x] Remove Composer `github-oauth` credentials on Linux & Windows Actions (#60095), and Remove Composer `github-oauth` credentials on Linux & Windows Actions (#520).

ACTIONS/CHECKOUT 7.0.1 ROLLS OUT ACROSS LARAVEL ECOSYSTEM

GitHub Actions security patch lands in four Laravel notification and UI libraries as the ecosystem tightens its CI/CD hygiene.

php 6 shipped 1-min read

@laravel 1 day ago

VAPOR-CLI SHIPS 1.70.2 WITH STYLE FIXES AS AI TIGHTENS LANGUAGE HANDLING

Vapor-cli v1.70.2 lands with code cleanup [ref:2] while the Laravel AI package now preserves conversation titles in the user's language instead of defaulting to English [ref:6].

php 11 shipped 1-min read

@laravel 2 days ago

LARAVEL LSP FIXES CONFIG COMPLETIONS, FRAMEWORK TIGHTENS TEST PATTERNS

Laravel LSP v0.0.27 shipped with a critical fix for dotted config key completion, while the framework enables 16 Rector rules to modernize test patterns across 13.x.

php 15 shipped 1-min read

@laravel 3 days ago

LARAVEL 13 DOUBLES DOWN ON ATTRIBUTES AND AI DOCS

The framework is shipping request-scoped attributes, trait-level model attributes, and a major CI refactor while docs race to cover the expanding AI SDK surface.

php 31 shipped 2-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.