Who contributed to Laravel on May 15, 2026?

1 developer shipped this update, including dependabot[bot].

What were the notable Laravel updates?

Bump socket.io-parser from 4.2.4 to 4.2.6, Bump axios from 1.15.0 to 1.15.2, and Bump flatted from 3.3.3 to 3.4.2.

@laravel

PHP's most popular framework - Forge, Vapor, and a massive paying audience

github ↗

Pick a date

Topics: PHP Full archive →

The Wire · Showcase

ECHO DEPENDENCY SECURITY BLITZ CLOSES SOCKET.IO VULNERABILITY

By RepoJournal · Filed 06:00 UTC on May 15, 2026 · About Laravel

1 person shipped this

dependabot[bot] @dependabot[bot] 5 cited

Laravel Echo shipped five critical dependency updates overnight, including a socket.io-parser patch that closes CVE-2026-33151 and hardens axios against prototype pollution attacks.

The socket.io-parser bump to 4.2.6 [1] fixes a known vulnerability that could affect real-time communication in production apps. That's the one that demands immediate attention. Running alongside it, axios upgraded to 1.15.2 [2] with prototype-pollution hardening for the Node HTTP adapter plus a Unix domain socket SSRF mitigation that closes a supply-chain attack vector. Flatted jumped to 3.4.2 [3] fixing CWE-1321, while minimatch's aggressive leap from 3.0.8 to 9.0.9 [4] brings major pattern-matching improvements. PostCSS landed at 8.5.14 [5] resolving custom syntax regressions. On the Moat side, the team shipped light theme support [6], improved naming conventions [7], and patched exit code handling [8], but these are polish work while Echo's security chain is tightening. This is a maintenance release that actually matters: your WebSocket layer is more secure, your HTTP client is hardened, and your CLI tools are more reliable.

Action items

→ Upgrade laravel/echo to pull socket.io-parser 4.2.6 before next deploy laravel/echo [immediate]
→ Review axios configuration if you use custom HTTP adapters laravel/echo [plan]
→ Test minimatch 9.x behavior in your build pipeline laravel/echo [monitor]

References

[1] Bump socket.io-parser from 4.2.4 to 4.2.6 ↗ laravel/echo
[2] Bump axios from 1.15.0 to 1.15.2 ↗ laravel/echo
[3] Bump flatted from 3.3.3 to 3.4.2 ↗ laravel/echo
[4] Bump minimatch from 3.0.8 to 9.0.9 ↗ laravel/echo
[5] Bump postcss from 8.5.8 to 8.5.14 ↗ laravel/echo
[6] feat: light theme laravel/moat
[7] feat: improves naming laravel/moat
[8] fix: exit code laravel/moat

Quick answers

What shipped in Laravel on May 15, 2026?: Laravel Echo shipped five critical dependency updates overnight, including a socket.io-parser patch that closes CVE-2026-33151 and hardens axios against prototype pollution attacks. In total, 24 commits, 6 pull requests, and 8 releases landed.
Who contributed to Laravel on May 15, 2026?: 1 developer shipped this update, including dependabot[bot].
What were the notable Laravel updates?: Bump socket.io-parser from 4.2.4 to 4.2.6, Bump axios from 1.15.0 to 1.15.2, and Bump flatted from 3.3.3 to 3.4.2.

ACTIONS/CHECKOUT 7.0.1 ROLLS OUT ACROSS LARAVEL ECOSYSTEM

GitHub Actions security patch lands in four Laravel notification and UI libraries as the ecosystem tightens its CI/CD hygiene.

php 6 shipped 1-min read

@laravel 1 day ago

VAPOR-CLI SHIPS 1.70.2 WITH STYLE FIXES AS AI TIGHTENS LANGUAGE HANDLING

Vapor-cli v1.70.2 lands with code cleanup [ref:2] while the Laravel AI package now preserves conversation titles in the user's language instead of defaulting to English [ref:6].

php 11 shipped 1-min read

@laravel 2 days ago

LARAVEL LSP FIXES CONFIG COMPLETIONS, FRAMEWORK TIGHTENS TEST PATTERNS

Laravel LSP v0.0.27 shipped with a critical fix for dotted config key completion, while the framework enables 16 Rector rules to modernize test patterns across 13.x.

php 15 shipped 1-min read

@laravel 3 days ago

LARAVEL 13 DOUBLES DOWN ON ATTRIBUTES AND AI DOCS

The framework is shipping request-scoped attributes, trait-level model attributes, and a major CI refactor while docs race to cover the expanding AI SDK surface.

php 31 shipped 2-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.