What shipped in Laravel on August 20, 2026?

Laravel's Cloud CLI was printing live API tokens into CI logs, and the patch is already out. In total, 4 commits and 5 pull requests landed.

Who contributed to Laravel on August 20, 2026?

2 developers shipped this update, including dependabot and joetannenbaum.

What were the notable Laravel updates?

Mask API tokens in auth:token --list, Swap handrolled dynamic spinner component for Prompts task component, and Replace `selectWithContext` with `select`.

@laravel

PHP's most popular framework - Forge, Vapor, and a massive paying audience

github ↗

Pick a date

Topics: PHP Full archive →

The Wire · Showcase

Cloud CLI leaks API tokens, fix lands in hours

By RepoJournal · Filed 06:55 UTC on August 20, 2026 · About Laravel

2 people shipped this

joetannenbaum @joetannenbaum 5 cited

dependabot @dependabot 1 cited

Laravel's Cloud CLI was printing live API tokens into CI logs, and the patch is already out.

A credential leak in laravel/cloud-cli's `auth:token --list` command printed full API tokens, not just in the table but in JSON output, which is the documented `-n` mode that ends up in CI logs and agent transcripts [1]. Tokens now show as `*****` plus the last four characters, and the fix is in. The team also streamlined prompts by swapping a handrolled spinner for the official Prompts task component [2], replacing `selectWithContext` with the built-in `select` now that it renders the `info` parameter upstream [3], and dropping a custom notification in favor of Prompts' new `notify` helper [4][5]. Meanwhile, Nightwatch bumped EndBug/add-and-commit to 11.0.0, an automated tooling update with no breaking changes [6]. Joe Tannenbaum noted the reasoning behind the prompts migration: 'Replaced the custom prompts component with the official one now that the `info` parameter renders upstream' [3].

Action items

→ Update laravel/cloud-cli to the latest release to get the token masking fix laravel/cloud-cli [immediate]
→ Audit recent CI logs and agent transcripts for any leaked API tokens from 'auth:token --list -n' laravel/cloud-cli [immediate]
→ Review any custom prompt or notification code in your Cloud CLI fork or wrapper for removal laravel/cloud-cli [plan]

References

[1] Mask API tokens in auth:token --list ↗ laravel/cloud-cli
[2] Swap handrolled dynamic spinner component for Prompts task component ↗ laravel/cloud-cli
[3] Replace `selectWithContext` with `select` ↗ laravel/cloud-cli
[4] dropped our notification for prompts (#202) laravel/cloud-cli
[5] Dropped handrolled notification for Prompts ↗ laravel/cloud-cli
[6] Bump EndBug/add-and-commit from 10.0.0 to 11.0.0 in the github-actions group ↗ laravel/nightwatch

Quick answers

What shipped in Laravel on August 20, 2026?: Laravel's Cloud CLI was printing live API tokens into CI logs, and the patch is already out. In total, 4 commits and 5 pull requests landed.
Who contributed to Laravel on August 20, 2026?: 2 developers shipped this update, including dependabot and joetannenbaum.
What were the notable Laravel updates?: Mask API tokens in auth:token --list, Swap handrolled dynamic spinner component for Prompts task component, and Replace `selectWithContext` with `select`.

Laravel AI drops streaming protocol bomb

The Vercel streaming protocol is getting a long-overdue overhaul that finally surfaces errors to your AI SDK client.

php 31 shipped

@laravel Aug 19

LARAVEL/BOOST CORRUPTS UTF-8 RULE FILES

A newline normalization bug in Boost is silently corrupting rule files with multi-byte characters, and the fix is critical before your next AI-assisted commit.

php 28 shipped

@laravel Aug 18

SURVEYOR'S TYPE BUGS EXPOSE SILENT JSON LEAKS

Surveyor's type resolver was quietly treating string literals like 'request' as class names and leaking Arrayable payloads into redirects and Blade views.

php 36 shipped

@laravel Aug 17

ANTHROPIC ATTACHMENT BUG FIXED, OPENROUTER GAINS WEB FETCH, BOOST PATCHES CONFIG TRAP

Laravel/ai shipped a critical fix for Anthropic file attachments that were failing on media type alone, while OpenRouter gained web fetch support and Boost plugged a config hole that breaks MCP initialization.

php 15 shipped

Elsewhere on the wire

AI Agents Aug 21

CLINE V4.1.11 SHIPS IMAGE GENERATION AND AGENT-UI FIXES

Cline's latest release lets models generate images mid-task, while LlamaIndex quietly breaks frontend tool handlers.

ai-agents 78 shipped

Local LLMs Aug 21

DeepSeek V4 fuses shared experts, as vLLM ships a security guard

The biggest local-LLM repos are moving fast: DeepSeek V4's MoE kernel gets a massive fusion, while vLLM patches a security hole.

+12

llms 274 shipped

@CachyOS Aug 21

CachyOS Scheduler Hotfixes and Kernel Upgrades Lead the Day

A hotfix for the scx_cake scheduler and the latest Linux 7.2 kernel are rolling out across CachyOS repos.

infra 66 shipped

Elixir & Phoenix Aug 21

Phoenix 1.8.12 patches channel message drop

Phoenix shipped a patch release that fixes a channel bug silently dropping messages without a join_ref, and LiveView is quietly rewriting the rules of navigation.