$ cat laravel/week/2026-09-07.log
the week in review · Sep 7 – Sep 13, 2026
Boost skill downloads reject backslash path escapes
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Laravel's tooling week also brought LSP interpolation fixes, Wayfinder route keying, and corrected Gemini file import behavior.
Reject backslash paths when downloading a skill so files cannot land outside the skill directory (#963) laravel/boost
Boosts's downloadSkill now refuses any skill file whose repository path contains a backslash, closing a path traversal that could write outside the skill directory on Windows. The same rejection also fails the download when a skill tree escapes its directory.
Skip diagnostics for interpolated string arguments laravel/lsp
The LSP was validating interpolated string arguments as if the braces were part of the key, because diagnostics read the raw source from getStringContentsText(). The fix skips diagnostics for string arguments containing an interpolated expression, and the same shape covered env, route, view, asset, and middleware keys.
Fix Gemini file import operation handling laravel/ai
Gemini's fileSearchStores.importFile returns a long-running operation, but the gateway treated its operation name as the imported document ID, so Store::add() returned the operation ID and later document operations targeted the wrong resource. The change waits for the operation to finish before returning the real document ID.
Key routes that share a URI by verb laravel/wayfinder
Two routes pointing at the same invokable controller on the same URI but different HTTP verbs produced generated action files that would not compile: both landed in one __invoke group and Wayfinder's URI-only dictionary key was written twice. Keys now account for the verb.
Resolve middleware aliases when inferring URL defaults laravel/wayfinder
wayfinder:generate never resolves the HTTP kernel, so middleware aliases like organization.user arrived as raw strings, class_exists() failed, and URL defaults were inferred from the wrong middleware. The generator now resolves aliases before inferring defaults.
Fix barrel self-import when a route name is both a leaf and a prefix … (#317) laravel/wayfinder
A barrel child named index was written to index/index.ts while the generated import referenced ./index, so route names that are both a leaf and a prefix of index produced a self-import. The barrel generator now resolves the sibling directory correctly.
Add memoryLimit Feature Option. laravel/lsp
Laravel LSP gains a memoryLimit feature option so developers can set the process memory limit themselves instead of hitting out-of-memory output. The accompanying VS Code extension change wires the option through to the client.
Ignore commented-out entries when checking for existing MCP servers laravel/boost
boost:install --mcp reported success but wrote nothing when the server key appeared only in a commented-out line inside mcpServers, which is what happens after you disable a server and later rerun install. serverExistsInContent() now ignores commented-out entries.
$ ls laravel/week/ # the briefings behind this review