RepoJournal
Laravel @laravel
118 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-05-13
stories 19
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

LARAVEL PLUGS GITHUB CREDENTIALS LEAK ACROSS INSTALLER AND CORE

By RepoJournal · Filed · About Laravel · Composed from the cited sources · methodology

crynobone timacdonald mwikala loadinglucian
4 people shipped this
crynobone @crynobone 1 cited timacdonald @timacdonald 1 cited mwikala @mwikala 1 cited loadinglucian @loadinglucian 1 cited

Laravel is systematically removing exposed Composer OAuth tokens from GitHub Actions workflows in both the installer and framework, a security hygiene fix rolling through 13.x.

The framework team [1] [2] and installer [3] are stripping `github-oauth` credentials from Linux and Windows Actions to prevent accidental token exposure in logs and artifacts—a pattern that should have been locked down long ago but is being addressed now across all entry points. The framework also shipped support for `after_commit` hooks on Cloud queue metrics [4], letting you defer metric writes until transactions actually land, which matters if you're tracking queue performance against eventual consistency. Over in laravel/boost, the MCP JSON config handler now preserves empty objects instead of converting them to arrays [5] , fixing a schema validation failure that was breaking OpenCode startup when Boost installed its server entry. The same crew also cleaned up redundant `.env` read guidance [6] from the MCP docs, removing noise after earlier core-guideline refactoring. Infrastructure work across `.github` workflows is adding Ubuntu runners and reusable composition patterns [7] , likely to support the credential cleanup rollout and future CI standardization.

Action items

References

  1. [1] [13.x] Remove Composer `github-oauth` credentials on Linux & Windows Actions ↗ laravel/framework
  2. [2] [13.x] Remove Composer `github-oauth` credentials on Linux & Windows Actions (#60095) ↗ laravel/framework
  3. [3] Remove Composer `github-oauth` credentials on Linux & Windows Actions (#520) ↗ laravel/installer
  4. [4] [13.x] Add support for `after_commit` for Cloud queue metrics ↗ laravel/framework
  5. [5] Preserve empty objects in MCP JSON config files ↗ laravel/boost
  6. [6] Remove redundant guidance to read .env directly ↗ laravel/boost
  7. [7] Add Ubuntu runner for setup-composer workflow ↗ laravel/.github

$ ls laravel/reviews/ # the step-back reads

the week in review Boost skill downloads reject backslash path escapes the month in review Laravel 13 exits eager-loading beta as AI and cloud CLI harden
Full archive → Weekly reviews →

Quick answers

What shipped in Laravel on May 13, 2026?
Laravel is systematically removing exposed Composer OAuth tokens from GitHub Actions workflows in both the installer and framework, a security hygiene fix rolling through 13.x. In total, 13 commits and 6 pull requests landed.
Who contributed to Laravel on May 13, 2026?
4 developers shipped this update, including crynobone, timacdonald, mwikala, and loadinglucian.
What were the notable Laravel updates?
[13.x] Remove Composer `github-oauth` credentials on Linux & Windows Actions, [13.x] Remove Composer `github-oauth` credentials on Linux & Windows Actions (#60095), and Remove Composer `github-oauth` credentials on Linux & Windows Actions (#520).
♥

$ log @laravel --recent

Gemini request fields unblocked, inplace DDL lands, Anthropic counts thinking tokens 37 shipped Readable env encryption goes incremental, OpenRouter gets reranking 47 shipped Tagged cache TTL fix, versionless Cloud database types 17 shipped CloudManager answers isManagedQueue, Collection types tighten 5 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl standardizes low-precision rollout kernels on DeepGEMM Agent Security Guardrails exposes hooks over HTTP, certifi floor raised in agent-scan

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.