Who contributed to Laravel on June 13, 2026?

1 developer shipped this update, including dependabot[bot].

What were the notable Laravel updates?

Bump esbuild from 0.27.3 to 0.28.1, Bump guzzlehttp/psr7 from 2.7.1 to 2.11.0, and Bump the github-actions group with 2 updates.

♥

Jun 13, 2026

$ the-wire · showcase

ESBUILD PATCHES SECURITY HOLE IN LARAVEL STREAM

By RepoJournal · Filed 06:00 UTC on June 13, 2026 · About Laravel · Composed from the cited sources · methodology

1 person shipped this

dependabot[bot] @dependabot[bot] 3 cited

Laravel Stream bumped esbuild to 0.28.1 overnight to patch a security issue in the development server that could allow malformed HTTP requests to slip through.

The fix blocks backslash characters in local development server HTTP requests, closing a vector that could have caused problems during development [1]. This is a small but important upgrade if you're running Stream in active development. Meanwhile, the Bootcamp project jumped guzzlehttp/psr7 four minor versions (2.7.1 to 2.11.0) [2], tightening validation in request modification and header parsing to prevent subtle HTTP bugs. Over on the Vonage notification channel, routine GitHub Actions maintenance bumped checkout and setup-php [3], keeping CI pipelines current. None of these are blocking issues, but the esbuild patch is worth pulling in before your next development session.

Action items

→ Update esbuild in laravel/stream to 0.28.1 laravel/stream [plan]
→ Review guzzlehttp/psr7 changelog before upgrading Bootcamp laravel/bootcamp [monitor]

References

[1] Bump esbuild from 0.27.3 to 0.28.1 ↗ laravel/stream
[2] Bump guzzlehttp/psr7 from 2.7.1 to 2.11.0 ↗ laravel/bootcamp
[3] Bump the github-actions group with 2 updates ↗ laravel/vonage-notification-channel

$ ls laravel/reviews/ # the step-back reads

the week in review Boost skill downloads reject backslash path escapes the month in review Laravel 13 exits eager-loading beta as AI and cloud CLI harden

Full archive → Weekly reviews →

Quick answers

What shipped in Laravel on June 13, 2026?: Laravel Stream bumped esbuild to 0.28.1 overnight to patch a security issue in the development server that could allow malformed HTTP requests to slip through. In total, 3 pull requests landed.
Who contributed to Laravel on June 13, 2026?: 1 developer shipped this update, including dependabot[bot].
What were the notable Laravel updates?: Bump esbuild from 0.27.3 to 0.28.1, Bump guzzlehttp/psr7 from 2.7.1 to 2.11.0, and Bump the github-actions group with 2 updates.

♥

$ log @laravel --recent

2026-09-17 Gemini request fields unblocked, inplace DDL lands, Anthropic counts thinking tokens 37 shipped 2026-09-16 Readable env encryption goes incremental, OpenRouter gets reranking 47 shipped 2026-09-15 Tagged cache TTL fix, versionless Cloud database types 17 shipped 2026-09-14 CloudManager answers isManagedQueue, Collection types tighten 5 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training 2026-10-22 verl standardizes low-precision rollout kernels on DeepGEMM Agent Security 2026-10-22 Guardrails exposes hooks over HTTP, certifi floor raised in agent-scan

$ ls showcases/

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.