RepoJournal
Laravel

@laravel

PHP's most popular framework — Forge, Vapor, and a massive paying audience

Pick a date

  1. Thu 28 may
  2. Fri 29 may
  3. Sat 30 may
  4. Sun 31 may
  5. Mon 1 jun
  6. Mon 8 jun
  7. Tue 9 jun
  8. Wed 10 jun
  9. Thu 11 jun
  10. Fri 12 jun
  11. Sat 13 jun
  12. Sun 14 jun
  13. Mon 15 jun
  14. Tue 16 jun
  15. Wed 17 jun
  16. Thu 18 jun
  17. Fri 19 jun
  18. Sat 27 jun
  19. Mon 29 jun
  20. Tue 30 jun
  21. Wed 1 jul
  22. Thu 2 jul
  23. Fri 3 jul
  24. Sat 4 jul
  25. Sun 5 jul
  26. Tue 7 jul
  27. Wed 8 jul
  28. Thu 9 jul
  29. Fri 10 jul
  30. Today 11 jul

The Wire · Showcase

GITHUB ACTIONS CHECKOUT 7.0 ROLLS ACROSS LARAVEL ECOSYSTEM

By RepoJournal · Filed · About Laravel

dependabot
1 person shipped this

Actions/checkout jumped to v7.0.0 overnight, and three Laravel core repositories just pulled the trigger on the upgrade.

The github-actions group bump hit locket [1], forge-sdk [2], and passkeys-server [3] simultaneously, all moving actions/checkout from 6.0.3 to 7.0.0. The v7 release includes a critical security change: it now blocks checking out fork PRs for pull_request_target events, closing a known attack vector where malicious code could steal secrets. This is the kind of silent fix that matters more than it sounds. If you're running CI workflows that accept external contributions, this upgrade hardens your pipeline against a real class of exploits. The rollout across three different repos suggests this wasn't accidental - this was coordinated. Worth noting that cache action also got bumped in locket and passkeys-server, though the details are light on what changed there.

Action items

References

  1. [1] Bump the github-actions group across 1 directory with 2 updates ↗ laravel/locket
  2. [2] Bump the github-actions group across 1 directory with 2 updates ↗ laravel/forge-sdk
  3. [3] Bump the github-actions group across 1 directory with 2 updates ↗ laravel/passkeys-server

More from @laravel

Laravel @laravel

LARAVEL AI GETS AGENT CONSOLE AND FORCED TOOL CHOICE

The AI SDK shipped three critical agent improvements overnight that solve the two biggest pain points developers hit when building autonomous systems: no way to test agents interactively, and models that skip tool calls entirely.

php 27 shipped 2-min read
Laravel @laravel

SQS QUEUE SIZE BUG FIXED, DALL-E TESTS REMOVED, BOOST SHIPS v2.4.12

Laravel framework patches a silent operator precedence bug in SQS queue methods that was throwing undefined key warnings in production.

php 12 shipped 1-min read
Laravel @laravel

LARAVEL AI OVERHAULS TYPE SAFETY AND GATEWAY CONTRACTS

Laravel AI v0.9.0 ships native Anthropic structured outputs and strips away redundant gateway boilerplate that's been slowing down provider implementations for months.

php 29 shipped 1-min read
Laravel @laravel

LARAVEL 13 CUTS SQS COSTS WITH BATCH API, AI SDK HITS PHPSTAN LEVEL 2

The framework is shipping smarter queue batching that cuts AWS API calls by 95 percent, while the AI package climbs the type-safety ladder and gains a manual testing workbench.

php 39 shipped 2-min read

Daily updates, in your inbox

Follow Laravel

PHP's most popular framework — Forge, Vapor, and a massive paying audience We'll email you a link to confirm first.

Free. Confirm via email. Unsubscribe in one click.

— or follow the whole beat:

Elsewhere on the wire

Elixir & Phoenix Elixir & Phoenix

ELIXIR FIXES TIME MATH BUG THAT ROUNDS THE WRONG WAY

NaiveDateTime.diff/3 has been silently rounding elapsed time up instead of down, breaking its documented contract and potentially causing logic errors in any code relying on time-based calculations.

Alexander Gubarev nseaSeb Łukasz Samson SteffenDE
elixir 35 shipped 1-min read
.NET @dotnet

OPERATOR SDK 13.0 BREAKS CONTROLLER ARCHITECTURE, ANDROID TESTS GO LOCAL

The dotnet-operator-sdk ships a major breaking change that fundamentally rewrites how multiple controllers target the same entity, while the Android team closes external test dependencies to fix certificate export failures on macOS.

github-actions[bot] kimpenhaus renovate Weihan Li +7
dotnet 40 shipped 2-min read
Spring @spring-projects

SPRING INTEGRATION FIXES CRITICAL LOCK REGISTRY BUG BLOCKING DISTRIBUTED SYSTEMS

Spring Integration shipped an emergency fix for JdbcLockRegistry that was causing false application hangs when different keys collided on shared locks.

dependabot artembilan Oliver Drotbohm
java 10 shipped 1-min read
FastAPI & Pydantic FastAPI & Pydantic

PYDANTIC ADDS VALIDATION ERROR TROUBLESHOOTING GUIDE

Pydantic just shipped a troubleshooting guide that walks you through reading validation failures in Logfire traces, cutting your debugging time in half.

strawgate
python 2 shipped 1-min read