RepoJournal
Laravel

@laravel

PHP's most popular framework - Forge, Vapor, and a massive paying audience

Keep up with Laravel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Thu 18 jun
  2. Fri 19 jun
  3. Sat 27 jun
  4. Mon 29 jun
  5. Tue 30 jun
  6. Wed 1 jul
  7. Thu 2 jul
  8. Fri 3 jul
  9. Sat 4 jul
  10. Sun 5 jul
  11. Tue 7 jul
  12. Wed 8 jul
  13. Thu 9 jul
  14. Fri 10 jul
  15. Sat 11 jul
  16. Mon 13 jul
  17. Tue 14 jul
  18. Wed 15 jul
  19. Thu 16 jul
  20. Fri 17 jul
  21. Sat 18 jul
  22. Sun 19 jul
  23. Mon 20 jul
  24. Tue 21 jul
  25. Wed 22 jul
  26. Thu 23 jul
  27. Fri 24 jul
  28. Sat 25 jul
  29. Sun 26 jul
  30. Mon 27 jul
Topics: PHP Full archive →

The Wire · Showcase

GITHUB ACTIONS CHECKOUT 7.0 ROLLS ACROSS LARAVEL ECOSYSTEM

By RepoJournal · Filed · About Laravel

dependabot
1 person shipped this
dependabot @dependabot 3 cited

Actions/checkout jumped to v7.0.0 overnight, and three Laravel core repositories just pulled the trigger on the upgrade.

The github-actions group bump hit locket [1], forge-sdk [2], and passkeys-server [3] simultaneously, all moving actions/checkout from 6.0.3 to 7.0.0. The v7 release includes a critical security change: it now blocks checking out fork PRs for pull_request_target events, closing a known attack vector where malicious code could steal secrets. This is the kind of silent fix that matters more than it sounds. If you're running CI workflows that accept external contributions, this upgrade hardens your pipeline against a real class of exploits. The rollout across three different repos suggests this wasn't accidental - this was coordinated. Worth noting that cache action also got bumped in locket and passkeys-server, though the details are light on what changed there.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] Bump the github-actions group across 1 directory with 2 updates ↗ laravel/locket
  2. [2] Bump the github-actions group across 1 directory with 2 updates ↗ laravel/forge-sdk
  3. [3] Bump the github-actions group across 1 directory with 2 updates ↗ laravel/passkeys-server

Quick answers

What shipped in Laravel on July 11, 2026?
Actions/checkout jumped to v7.0.0 overnight, and three Laravel core repositories just pulled the trigger on the upgrade. In total, 3 pull requests landed.
Who contributed to Laravel on July 11, 2026?
1 developer shipped this update, including dependabot.
What were the notable Laravel updates?
Bump the github-actions group across 1 directory with 2 updates, Bump the github-actions group across 1 directory with 2 updates, and Bump the github-actions group across 1 directory with 2 updates.

More from @laravel

Laravel @laravel

HORIZON METRICS BUG SILENTLY LEAKS REDIS KEYS ON PHPREDIS 6.1+

Laravel Horizon's clear-metrics command reports success while accumulating unbounded Redis keys on phpredis 6.1 or newer, potentially starving your queue storage.

dependabot ademola-emmanuel
php 3 shipped 1-min read
Laravel @laravel

ACTIONS/CHECKOUT 7.0.1 SHIPS WITH UNSAFE PR CHECK FIX

GitHub Actions' checkout action patched an unsafe PR verification bypass that could have exposed workflows to malicious pull requests.

dependabot
php 1 shipped 1-min read
Laravel @laravel

ACTIONS/CHECKOUT 7.0.1 ROLLS OUT ACROSS LARAVEL ECOSYSTEM

GitHub Actions security patch lands in four Laravel notification and UI libraries as the ecosystem tightens its CI/CD hygiene.

dependabot scybulski
php 6 shipped 1-min read
Laravel @laravel

VAPOR-CLI SHIPS 1.70.2 WITH STYLE FIXES AS AI TIGHTENS LANGUAGE HANDLING

Vapor-cli v1.70.2 lands with code cleanup [ref:2] while the Laravel AI package now preserves conversation titles in the user's language instead of defaulting to English [ref:6].

Mohamed Said yuters dependabot
php 11 shipped 1-min read

Daily updates, in your inbox

Follow Laravel

Keep up with Laravel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

langchain-oss-model-profiles langchain-oss-model-profiles[bot] saoudrizwan
ai-agents 16 shipped 2-min read
Local LLMs Local LLMs

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

github-actions[bot] dhiltgen timkhronos Pascal +10
llms 125 shipped 1-min read
CachyOS @CachyOS

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

Piotr Gorski github-actions Vladislav Nepogodin ptr1337 +7
infra 97 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.

Benjamin Milde Alexander Gubarev lukaszsamson makoto-developer
elixir 10 shipped 1-min read
Want every project, not just this one?

We use privacy-friendly analytics (Google Analytics, IP-anonymized) to see which pages help readers. No ads, and we never sell your data. See our Privacy Policy.