Who contributed to Laravel on July 29, 2026?

1 developer shipped this update, including dependabot.

What were the notable Laravel updates?

Bump the github-actions group with 2 updates, Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group, and Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group.

@laravel

PHP's most popular framework - Forge, Vapor, and a massive paying audience

github ↗

Pick a date

Topics: PHP Full archive →

The Wire · Showcase

ACTIONS/CHECKOUT 7.0.1 ROLLS ACROSS LARAVEL ECOSYSTEM

By RepoJournal · Filed 06:55 UTC on July 29, 2026 · About Laravel

1 person shipped this

dependabot @dependabot 4 cited

GitHub Actions checkout action lands a security fix, and Dependabot is pushing it across four Laravel core packages in a single sweep.

Actions/checkout 7.0.1 patches an unsafe PR check that could bypass security controls when running untrusted code, a fix that matters especially for projects accepting community contributions [1][2][3][4]. Nightwatch got a bonus bump to docker/login-action in the same PR [1], but the real story is the coordinated rollout. Forge-cli, Valet, and Scout all landed their checkout updates within the same window [2][3][4], keeping the ecosystem in sync. This is quiet, routine maintenance that works exactly as it should.

Action items

→ Merge checkout 7.0.1 updates across your workflows laravel/nightwatch [plan]
→ Monitor for any workflow behavior changes in your CI laravel/forge-cli [monitor]

References

[1] Bump the github-actions group with 2 updates ↗ laravel/nightwatch
[2] Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group ↗ laravel/forge-cli
[3] Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group ↗ laravel/valet
[4] Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group ↗ laravel/scout

Quick answers

What shipped in Laravel on July 29, 2026?: GitHub Actions checkout action lands a security fix, and Dependabot is pushing it across four Laravel core packages in a single sweep. In total, 4 pull requests landed.
Who contributed to Laravel on July 29, 2026?: 1 developer shipped this update, including dependabot.
What were the notable Laravel updates?: Bump the github-actions group with 2 updates, Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group, and Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group.

ACTIONS/CHECKOUT 7.0.1 ROLLS ACROSS LARAVEL ECOSYSTEM

GitHub Actions checkout action shipped a patch to skip unsafe PR checks by default, and it's already landing in 4 core Laravel repos.

php 4 shipped 1-min read

@laravel 2 days ago

HORIZON METRICS BUG SILENTLY LEAKS REDIS KEYS ON PHPREDIS 6.1+

Laravel Horizon's clear-metrics command reports success while accumulating unbounded Redis keys on phpredis 6.1 or newer, potentially starving your queue storage.

php 3 shipped 1-min read

@laravel 3 days ago

ACTIONS/CHECKOUT 7.0.1 SHIPS WITH UNSAFE PR CHECK FIX

GitHub Actions' checkout action patched an unsafe PR verification bypass that could have exposed workflows to malicious pull requests.

php 1 shipped 1-min read

@laravel 4 days ago

ACTIONS/CHECKOUT 7.0.1 ROLLS OUT ACROSS LARAVEL ECOSYSTEM

GitHub Actions security patch lands in four Laravel notification and UI libraries as the ecosystem tightens its CI/CD hygiene.

php 6 shipped 1-min read

Elsewhere on the wire

AI Agents about 4 hours ago

LANGCHAIN CORES SHIP, ANTHROPIC THINKING BLOCKS FIXED, OPENHANDS TIGHTENS WEBSOCKET AUTH

LangChain released two core packages with critical fixes for streaming stability and environment variable handling, while OpenHands closed a security gap that left WebSocket connections unprotected.

ai-agents 119 shipped 1-min read

Local LLMs about 4 hours ago

OLLAMA RIPS OUT IMAGE GENERATION, LLAMA.CPP SHIPS SPECULATIVE DECODING

Ollama removed its entire MLX image generation pipeline overnight, while llama.cpp landed DSpark speculative decoding and fixed a critical SYCL memory bug affecting Arc GPUs.

+11

llms 239 shipped 2-min read

@CachyOS about 4 hours ago

KERNEL SCHEDULER UPDATES ACROSS BORE AND SCX TOOLING

CachyOS shipped BORE 6.8.0 patches across two kernel series while upgrading its sched-ext ecosystem in parallel, signaling major tuning work ahead.

infra 83 shipped 1-min read

Elixir & Phoenix about 4 hours ago

ELIXIR TIGHTENS ERROR HANDLING ACROSS DATE, ECTO, AND IEXHELPERS

Date.range now surfaces ArgumentError instead of Protocol.UndefinedError when passed invalid step values, catching a class of bugs that silently fail in production code.