Who contributed to Laravel on June 13, 2026?

1 developer shipped this update, including dependabot[bot].

What were the notable Laravel updates?

Bump esbuild from 0.27.3 to 0.28.1, Bump guzzlehttp/psr7 from 2.7.1 to 2.11.0, and Bump the github-actions group with 2 updates.

@laravel

PHP's most popular framework - Forge, Vapor, and a massive paying audience

github ↗

Pick a date

Topics: PHP Full archive →

The Wire · Showcase

ESBUILD PATCHES SECURITY HOLE IN LARAVEL STREAM

By RepoJournal · Filed 06:00 UTC on June 13, 2026 · About Laravel

1 person shipped this

dependabot[bot] @dependabot[bot] 3 cited

Laravel Stream bumped esbuild to 0.28.1 overnight to patch a security issue in the development server that could allow malformed HTTP requests to slip through.

The fix blocks backslash characters in local development server HTTP requests, closing a vector that could have caused problems during development [1]. This is a small but important upgrade if you're running Stream in active development. Meanwhile, the Bootcamp project jumped guzzlehttp/psr7 four minor versions (2.7.1 to 2.11.0) [2], tightening validation in request modification and header parsing to prevent subtle HTTP bugs. Over on the Vonage notification channel, routine GitHub Actions maintenance bumped checkout and setup-php [3], keeping CI pipelines current. None of these are blocking issues, but the esbuild patch is worth pulling in before your next development session.

Action items

→ Update esbuild in laravel/stream to 0.28.1 laravel/stream [plan]
→ Review guzzlehttp/psr7 changelog before upgrading Bootcamp laravel/bootcamp [monitor]

References

[1] Bump esbuild from 0.27.3 to 0.28.1 ↗ laravel/stream
[2] Bump guzzlehttp/psr7 from 2.7.1 to 2.11.0 ↗ laravel/bootcamp
[3] Bump the github-actions group with 2 updates ↗ laravel/vonage-notification-channel

Quick answers

What shipped in Laravel on June 13, 2026?: Laravel Stream bumped esbuild to 0.28.1 overnight to patch a security issue in the development server that could allow malformed HTTP requests to slip through. In total, 3 pull requests landed.
Who contributed to Laravel on June 13, 2026?: 1 developer shipped this update, including dependabot[bot].
What were the notable Laravel updates?: Bump esbuild from 0.27.3 to 0.28.1, Bump guzzlehttp/psr7 from 2.7.1 to 2.11.0, and Bump the github-actions group with 2 updates.

HORIZON METRICS BUG SILENTLY LEAKS REDIS KEYS ON PHPREDIS 6.1+

Laravel Horizon's clear-metrics command reports success while accumulating unbounded Redis keys on phpredis 6.1 or newer, potentially starving your queue storage.

php 3 shipped 1-min read

@laravel 2 days ago

ACTIONS/CHECKOUT 7.0.1 SHIPS WITH UNSAFE PR CHECK FIX

GitHub Actions' checkout action patched an unsafe PR verification bypass that could have exposed workflows to malicious pull requests.

php 1 shipped 1-min read

@laravel 3 days ago

ACTIONS/CHECKOUT 7.0.1 ROLLS OUT ACROSS LARAVEL ECOSYSTEM

GitHub Actions security patch lands in four Laravel notification and UI libraries as the ecosystem tightens its CI/CD hygiene.

php 6 shipped 1-min read

@laravel 4 days ago

VAPOR-CLI SHIPS 1.70.2 WITH STYLE FIXES AS AI TIGHTENS LANGUAGE HANDLING

Vapor-cli v1.70.2 lands with code cleanup [ref:2] while the Laravel AI package now preserves conversation titles in the user's language instead of defaulting to English [ref:6].

php 11 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.