Who contributed to Laravel on August 18, 2026?

7 developers shipped this update, including timacdonald, lazerg, xurshudyan, jnoordsij, joetannenbaum, Suliman Benhalim, and pushpak1300.

What were the notable Laravel updates?

Stop string literals from becoming class types, Resolve ternary branches instead of the compared value, and Invalidate the analysis cache per file.

@laravel

PHP's most popular framework - Forge, Vapor, and a massive paying audience

github ↗

Pick a date

Topics: PHP Full archive →

The Wire · Showcase

SURVEYOR'S TYPE BUGS EXPOSE SILENT JSON LEAKS

By RepoJournal · Filed 06:55 UTC on August 18, 2026 · About Laravel

7 people shipped this

joetannenbaum @joetannenbaum 4 cited

timacdonald @timacdonald 1 cited

lazerg @lazerg 1 cited

pushpak1300 @pushpak1300 1 cited

xurshudyan @xurshudyan

jnoordsij @jnoordsij

Suliman Benhalim @sulimanbenhalim

Surveyor's type resolver was quietly treating string literals like 'request' as class names and leaking Arrayable payloads into redirects and Blade views.

Three fixes from the Surveyor team stop a class of silent data leaks: string literals that collide with loaded function names were being promoted to class types [1], ternary branches were resolving to the compared value instead of the branch types [2], and the analysis cache was invalidating 1796 of 3078 entries on a single file edit [3]. In Multiplex, graceful shutdown now sends SIGTERM before SIGKILL so commands run their cleanup handlers, with a two-second grace period [4]. Boost shipped v2.5.4, which handles signaled processes and rejects Blade templates from remote skills [5]. On the framework side, a managed queue event is getting richer payloads with exception previews and job names [6], and a test helper is being fixed to preserve assertion failure messages when sessions serialize to JSON [7]. Surveyor's fix ensures "Loaded types are now found without the autoloader" [1], closing the hole that let 'request' resolve to the Request facade and emit empty JSON responses.

Action items

→ Update Surveyor to pick up the type-resolution and cache fixes laravel/surveyor [immediate]
→ Review Multiplex signal handling if your commands rely on cleanup on quit laravel/multiplex [plan]
→ Upgrade Boost to v2.5.4 for the graceful test-enforcement handling and remote skill protection laravel/boost [plan]

References

[1] Stop string literals from becoming class types ↗ laravel/surveyor
[2] Resolve ternary branches instead of the compared value ↗ laravel/surveyor
[3] Invalidate the analysis cache per file ↗ laravel/surveyor
[4] Give commands a chance to clean up before killing them ↗ laravel/multiplex
[5] v2.5.4 ↗ laravel/boost
[6] [13.x] Promote nested data to top-level managed queue event (#61209) laravel/framework
[7] [13.x] Keep the assertion failure message when session errors are JSON serialized ↗ laravel/framework

Quick answers

What shipped in Laravel on August 18, 2026?: Surveyor's type resolver was quietly treating string literals like 'request' as class names and leaking Arrayable payloads into redirects and Blade views. In total, 18 commits, 17 pull requests, and 1 releases landed.
Who contributed to Laravel on August 18, 2026?: 7 developers shipped this update, including timacdonald, lazerg, xurshudyan, jnoordsij, joetannenbaum, Suliman Benhalim, and pushpak1300.
What were the notable Laravel updates?: Stop string literals from becoming class types, Resolve ternary branches instead of the compared value, and Invalidate the analysis cache per file.

LARAVEL/BOOST CORRUPTS UTF-8 RULE FILES

A newline normalization bug in Boost is silently corrupting rule files with multi-byte characters, and the fix is critical before your next AI-assisted commit.

php 28 shipped

@laravel Aug 17

ANTHROPIC ATTACHMENT BUG FIXED, OPENROUTER GAINS WEB FETCH, BOOST PATCHES CONFIG TRAP

Laravel/ai shipped a critical fix for Anthropic file attachments that were failing on media type alone, while OpenRouter gained web fetch support and Boost plugged a config hole that breaks MCP initialization.

php 15 shipped

@laravel Aug 16

LIVEWIRE 3 JAVASCRIPT HOOKS EXAMPLE BROKEN IN BOOST DOCS

The official Livewire 3 failure handler example in Laravel Boost fires neither of its two hooks, leaving developers with dead code.

php 2 shipped

@laravel Aug 15

LARAVEL AI FIXES STREAMED TOOL-CALL USAGE LEAKS, CLOUD CLI PLUGS CREDENTIAL BLEED

Multi-step AI inference was silently dropping usage data from all but the final step, while the Cloud CLI was printing passwords in JSON output and breaking database restore commands entirely.

php 50 shipped

Elsewhere on the wire

AI Agents Aug 19

CLINE DESKTOP GOES NATIVE WITH BACKGROUND ALERTS

Cline's desktop app just became a tool you can leave running while you grab coffee, and LangChain is quietly fixing the token math that makes DeepSeek caching actually count.

ai-agents 97 shipped

@CachyOS Aug 19

CACHYOS PUSHES KERNEL 7.1.8 AND SCHEDULER FIXES ACROSS THE STACK

CachyOS is shipping a new kernel meanwhile patching its scheduler stack, and that combination is exactly what you want before your next deploy.

infra 58 shipped

Elixir & Phoenix Aug 19

LiveView memory leak fix leads overnight Elixir cleanup

A handful of pull requests across Elixir and Phoenix are quietly fixing leaks and edge cases that have been nagging at production apps.

elixir 19 shipped

@dotnet Aug 19

MAUI Overhauls NuGet Publishing as FSharp Preps for VS 18.11

MAUI is replacing its custom NuGet publishing with Microsoft's 1ES.PublishNuget, and FSharp is rolling Microsoft.Build deps forward to VS 18.11, two moves that reshape release engineering across the .NET ecosystem.