Who contributed to Laravel on August 18, 2026?

7 developers shipped this update, including timacdonald, lazerg, xurshudyan, jnoordsij, joetannenbaum, Suliman Benhalim, and pushpak1300.

What were the notable Laravel updates?

Stop string literals from becoming class types, Resolve ternary branches instead of the compared value, and Invalidate the analysis cache per file.

Aug 18, 2026

$ the-wire · showcase

SURVEYOR'S TYPE BUGS EXPOSE SILENT JSON LEAKS

By RepoJournal · Filed 06:55 UTC on August 18, 2026 · About Laravel · Composed from the cited sources · methodology

7 people shipped this

joetannenbaum @joetannenbaum 4 cited

timacdonald @timacdonald 1 cited

lazerg @lazerg 1 cited

pushpak1300 @pushpak1300 1 cited

xurshudyan @xurshudyan

jnoordsij @jnoordsij

Suliman Benhalim @sulimanbenhalim

Surveyor's type resolver was quietly treating string literals like 'request' as class names and leaking Arrayable payloads into redirects and Blade views.

Three fixes from the Surveyor team stop a class of silent data leaks: string literals that collide with loaded function names were being promoted to class types [1], ternary branches were resolving to the compared value instead of the branch types [2], and the analysis cache was invalidating 1796 of 3078 entries on a single file edit [3]. In Multiplex, graceful shutdown now sends SIGTERM before SIGKILL so commands run their cleanup handlers, with a two-second grace period [4]. Boost shipped v2.5.4, which handles signaled processes and rejects Blade templates from remote skills [5]. On the framework side, a managed queue event is getting richer payloads with exception previews and job names [6], and a test helper is being fixed to preserve assertion failure messages when sessions serialize to JSON [7]. Surveyor's fix ensures "Loaded types are now found without the autoloader" [1], closing the hole that let 'request' resolve to the Request facade and emit empty JSON responses.

Action items

→ Update Surveyor to pick up the type-resolution and cache fixes laravel/surveyor [immediate]
→ Review Multiplex signal handling if your commands rely on cleanup on quit laravel/multiplex [plan]
→ Upgrade Boost to v2.5.4 for the graceful test-enforcement handling and remote skill protection laravel/boost [plan]

References

[1] Stop string literals from becoming class types ↗ laravel/surveyor
[2] Resolve ternary branches instead of the compared value ↗ laravel/surveyor
[3] Invalidate the analysis cache per file ↗ laravel/surveyor
[4] Give commands a chance to clean up before killing them ↗ laravel/multiplex
[5] v2.5.4 ↗ laravel/boost
[6] [13.x] Promote nested data to top-level managed queue event (#61209) ↗ laravel/framework
[7] [13.x] Keep the assertion failure message when session errors are JSON serialized ↗ laravel/framework