$ the-wire · showcase
Boost rejects escaping skill paths, Wayfinder resolves middleware aliases
By RepoJournal · Filed · About Laravel · Composed from the cited sources · methodology
Laravel Boost now aborts skill downloads whose paths could escape the skill directory, and Wayfinder resolves the HTTP kernel before route inspection so aliased middleware defaults are picked up.
Laravel Boost closed a path traversal hole in skill downloads. `downloadSkill()` wrote every blob using the git path as-is, and since Git allows `\` in filenames while Windows treats it as a directory separator, a blob at `skill-one/..\..\evil.txt` resolved outside the skill directory. The download now fails as a whole when any blob path contains `\`, a `..` segment, or a NUL byte [1][2]. Separately, `boost:install --mcp` used to report success while writing nothing when the server key appeared only in a commented-out line inside `mcpServers`; `serverExistsInContent()` matched against the raw slice between the braces, so `// "laravel-boost": {...}` counted as an existing entry and the server was filtered out before injection. The check now runs on content with comments removed [3].
Boost also wired third-party NPM packages into guideline and skill discovery. Third-party Composer packages already shipped these via `vendor/{pkg}/resources/boost/guidelines/` and `resources/boost/skills/`, but the NPM equivalents (`Npm::packagesDirectoriesWithBoostGuidelines()` and `Npm::packagesDirectoriesWithBoostSkills()`) were never called in the third-party resolution paths; only first-party packages (`@laravel/*`, `@inertiajs/*`) were discovered [4][5].
Wayfinder now resolves the HTTP kernel before walking routes when inferring URL defaults. Middleware aliases only reach the router once the kernel is resolved, and `php artisan wayfinder:generate` never resolved it, so a group written as `->middleware(['auth', 'organization.user'])` handed Wayfinder the raw alias string, `class_exists()` on it failed, and any `URL::defaults()` set by that middleware was missed, leaving the parameter required in the generated route [6][7].
On 13.x, Laravel Framework landed three fixes: `Factory::raw()` with a count of zero or negative returned a non-empty list because `range(1, 0)` yields `[1, 0]` and `range(1, -3)` yields `[1, 0, -1, -2, -3]` [8][9]; `containsStrict()` returned false when a closure matched a null value [10]; and Eloquent violation callbacks such as `handleLazyLoadingViolationUsing` and `handleMissingAttributeViolationUsing` will receive the exception instead of callers reconstructing it from the environment [11]. Queue `pause`/`resume` now accept enums, matching the Queue and Connection job attributes and manager methods like route and forward [12].
Action items
- → Upgrade laravel/boost to pick up the skill path traversal fix before downloading skills from untrusted repositories laravel/boost [immediate]
- → Re-run php artisan wayfinder:generate if you use middleware aliases that set URL::defaults() laravel/wayfinder [plan]
- → Watch the 13.x branch for the Factory::raw() count-zero, containsStrict() null-closure, and queue pause/resume enum changes laravel/framework [monitor]
References
- [1] Reject backslash paths when downloading a skill so files cannot land outside the skill directory (#963) ↗ laravel/boost
- [2] Reject backslash paths when downloading a skill so files cannot land outside the skill directory ↗ laravel/boost
- [3] Ignore commented-out entries when checking for existing MCP servers ↗ laravel/boost
- [4] feat: support third-party NPM package guidelines and skills ↗ laravel/boost
- [5] feat: support third-party NPM package guidelines and skills (#935) ↗ laravel/boost
- [6] Resolve middleware aliases when inferring URL defaults ↗ laravel/wayfinder
- [7] Resolve middleware aliases when inferring URL defaults (#295) ↗ laravel/wayfinder
- [8] [13.x] Fix Factory::raw() with a count of zero (#61510) ↗ laravel/framework
- [9] [13.x] Fix Factory::raw() with a count of zero ↗ laravel/framework
- [10] [13.x] Fix containsStrict() returning false when a closure matches a null value (#61507) ↗ laravel/framework
- [11] [13.x] Pass the exception to Eloquent violation callbacks ↗ laravel/framework
- [12] [13.x] Allow enums in queue pause/resume methods ↗ laravel/framework
