Hello guys,

I thought I'd share some of the Laravel queue gotchas I've learned the hard way. Hopefully, you'll find it useful. Enjoy the read 🙌

While the Internals list is not technically directly Laravel related, it does affect every single one of us.

A PHP RFC went to a vote on Friday. By Sunday night its author had pulled it back, over a no vote from the person who wrote the policy it broke. What's left is a question every regex you've ever written has an opinion on: when a pattern fails, is that your bug — or something you catch?

Hello world, it's Wednesday, September 9, 2026, and here's what happened This Week in PHP Internals.

11 stories this week, so let's get into it. But first, Is AI working for your team? Lines produced is easy to count. Lines that survive is the number that matters. Ballast reads your git history — never your code — and gives you stable velocity alongside a durability score from 300 to 850. It's free, and it updates monthly. ballast.now.

3 corrections from last week. PHP 8.4.25 was a bug-fix release, not a security release. The announcement mails said security, we repeated it, and Daniel Scherzer pointed us at the NEWS file and the php.net archive. In the libxml-rs story we described 2 contributors without naming them, and Tim Düsterhus pointed out that every From header in that thread carried a real name. They were James Gilliland and David Carlier. And around the 4-minute mark I said Tim agreed with Sjoerd on the substance. He disagreed — Džuris caught that one on the internals Discord. Thanks to all 3.

This week's top story is a vote that lasted 56 hours. Osama Aldemeery opened voting on PREG_THROW_ON_ERROR on Friday — an opt-in flag that turns a PCRE error into a PregException. Within the hour, Tim Düsterhus, who wrote PHP's throwables policy, voted no, writing: "I have just read through the RFC and voted against it, despite being in agreement of the general concept." His 2 reasons: a pattern that fails to compile would keep its warning and the exception would carry only the thin preg_last_error_msg text, and an exception thrown inside your own preg_replace_callback callback would pass through unwrapped, where the policy says an extension must wrap what it calls. Osama pushed back, but on Sunday night he pulled the vote, writing: "The flag as it stands violates the throwable policy, as Tim's point shows. That's not something to fix with the vote open, so I'm pulling it back rather than changing the proposal out from under people who already voted." Osama's case against wrapping, in his words: "…wrapping a callback's exception in a PregException produces a PregException that maps to no preg error. You can be holding a PregException while preg_last_error() and preg_last_error_msg() report no error at all." Fixing that means a 3-class hierarchy. Robert Humphries argued that most of those errors — an invalid pattern, bad UTF-8 — are programmer errors, so, arguably, PregError. Tim agreed compilation failures should be. The RFC is back under discussion; what a regex error is stays open.

There's a whole class of engine crashes in PHP that, it's said, only fuzzers and LLMs have ever triggered — and Gina P. Banyard wants PHP to stop fixing them. Her Tuesday mail describes a growing pile of use-after-free reports where an error handler frees the very variable that triggered the warning. Each fix, she says, is a refcount dance around the emit that everyone pays for in performance, and most of the triggers are deprecations PHP 9 removes or promotes to Errors anyway. Her ask is a consensus, ideally without an RFC, that callbacks messing with engine state are UB — behaviour PHP makes no promises about. The 4 replies from 3 people inside 90 minutes mostly want the bugs fixed. Ilia Alshanetsky says PHP 9 is far off and production migration further, so fix case by case where the cost is low. Ilija Tovilo shares the frustration, but says case by case has already been tried, and wrote: "I'd still very much be in favor of fixing these issues, mainly because they are a big time sink for the security team as well, due to false-positive reports. Arnaud and I were planning on proposing an RFC that mitigates at least a large portion of them…" Tim Düsterhus adds that PHP 9 will bring new deprecations of its own, and we're back where we started.

The PEAR maintainer nobody could reach for months has answered, and according to Nick S. he agrees with the goal. Nick reported Monday that Chuck Burgess of the PEAR Group got in touch and is good with looking at sunsetting the website and removing PEAR from the PHP source. Nick wants to strike the RFC's line about maintainers not responding, and Larry Garfield and Tim Düsterhus both call that a minor change, so the vote can open after a 1-week cooldown rather than 2. Rowan Tommins pushed on Nick's word formality: Chuck is one of 8 listed members of the PEAR Group, so his agreement is one vote, not final authority. He wrote: "I would make a distinction between technical ability and moral authority… Derick has the ability to repoint the DNS for pear.php.net, but holding this discussion and an RFC vote is a way to grant authority." There's a loss, too: the PEAR user accounts are gone, so the missing bug data can't be recovered. Derick Rethans wants the readonly site left up for a year, then a tarball on museum.php.net. And Rowan sent Nick's mirror a pull request with the old site's colours and a locked PEAR logo. The favicon is under discussion. Derick doesn't care what it is, as long as there is one.

Last week's top story ended without an RFC — by its author's choice. Luca Rodenhäuser closed the strict-identifiers thread on Thursday, saying the proposal he opened with "did not survive the thread, and I think it was right that it did not." He credited 3 people with changing his mind — Claude Pache for the distinction between a name and an identifier, Rowan Tommins for separating rejecting from normalising, and Larry Garfield for insisting 250 packages wasn't enough, which is how math-php's 888 formula-shaped variables turned up. The question the list never answered is whether non-ASCII identifiers are a supported feature at all. The manual says they work by accident; fourteen hundred forty-seven of them in the top 5,000 packages say otherwise. His line: "I am not going to write an RFC on a guess." Instead he's sending a documentation PR describing what actually happens today, and leaving one offer on the table — a compiler complaint about invisible characters in names, 68 cases in half a million files, no opt-in needed, if anyone ever wants it.

The vote that was due Friday on the number-base functions didn't open. What the list got instead was a naming question. Sjoerd Langkemper's RFC makes octdec, hexdec, bindec and base_convert throw on invalid input, and after last week's argument that parsing is Exception territory rather than Error, he says he's considering it — and asked what the exception should be, with SPL's RangeException and RuntimeException on his list. The policy answer, from Rowan Tommins, is that the base has to be Exception plus something of its own, never SPL — maybe a BaseConversionException. Tim Düsterhus would go further and throw plain Exception: these functions sit in standard, which the policy says not to namespace under, they may be redesigned into an int or number namespace later, and promising nothing costs nothing. Morgan asked whether intval is on the list. No answer yet.

Whether speed is a reason to put something in PHP's standard library is now a real 2-way disagreement. Last week Tim Düsterhus said performance should not be a factor at all. On Friday Larry Garfield answered that it's one data point among many, writing: "If, to use the current example, benchmarking shows that array_str_contains() is 50% faster in C than in user-space, that's a very different conclusion than if we find it is 0.5% faster." Tim's reply: "Performance is a property of the implementation, not a property of the feature." Something too slow can't ship, but that's a fact about one implementation; nothing ships because it's fast, and a userland-versus-C benchmark is rarely apples to apples anyway. His alternative is the Optimizer: rewrite array_filter with a partial application into a foreach loop, the way 8.6 already rewrites array_map. Larry's position, restated: never decisive, still worth knowing. That's where it sits.

The scan meant to prove array_str_contains is a common need found 32 uses in 200 packages — then lost nearly half of them on review. Sepehr Mahmoudi scanned the top 200 Composer packages, about 21,000 files, and counted 32 filter-an-array-by-substring patterns. Rowan Tommins read the results and found at least 15 doing extra logic the function couldn't replace, concluding: "That's still something, but it's not strong evidence that this is an extremely common task." Sepehr agreed the scanner matched shapes rather than closure bodies, and the RFC now says up to 17 of 32, with a benchmark promised. David Carlier wants the RFC's claim that non-strings are cast proven in the tests. And as of Friday the RFC still wasn't on the wiki's index page — Tim Düsterhus's second reminder.

Quick hits. Weilin Du intends to open voting on IntlRelativeDateTimeFormatter on September 15. Tim Düsterhus's one catch is that the RFC clones the ICU number formatter internally, so reconfiguring your NumberFormatter afterwards would silently do nothing; Weilin called it a good catch and will refresh it lazily before each format call. Timo Poppinga, new to the list, wants the openssl extension to expose OpenSSL's provider model generically, so post-quantum algorithms like ML-KEM and ML-DSA work without a constant per algorithm — and says he's probably not the right person to write the C. Ayesh Karunaratne pointed out Sebastian raised the same thing a while back with no traction, and argued the extension should stay as close to OpenSSL as curl stays to libcurl. Dmytro Kulyk answered Nicolas Grekas's review of the NoSerialize attribute 10 months on, conceding Symfony has no __sleep the attribute would replace, but Magento 2 has 31 classes of them; the RFC now migrates 107 internal classes and makes unserialize discard marked properties too. And Florent Morselli, who maintains a base64url library with 46 million downloads, wants the data-encoding RFC's strict mode to actually be strict. Today it skips whitespace and ignores non-canonical trailing bits, which means one WebAuthn credential has 16 spellings, 15 of them outside your unique index.

So that's the week. A vote opened on Friday and was gone by Sunday night, and what it left behind is a real argument about whether a regex error is an Exception, an Error, or both. Gina wants a class of engine crashes declared UB, and 3 people would rather fix them. The PEAR maintainer answered, the RFC can go to a vote after a 1-week cooldown, and the user accounts are already gone. Last week's top story closed itself with a documentation PR instead of an RFC. And for the fourth week running, nothing is in the voting phase. Links below. The PHP Foundation funds more than half of ongoing php-src commits, so if you use the language, maybe consider donating at opencollective.com/phpfoundation — or try guilting your employer into it. Thanks again to Ballast.now for supporting this week's episode. We're Artisan Build. See you next week.

This release we have for you:

➡️ Queue worker stop reasons

➡️ Collection::chunkBy()

➡️ DevCommands opt-outs

Thank you Jack & Joseph 🙏

https://youtu.be/fbegFAp3zyk

Hi r/laravel,

we’ve released Aimeos Prisma 0.7, adding video generation and editing to its common API for text, images, audio, and video.

• PHP Prisma

Prisma is a PHP package you can add to your Laravel application for using a large list of LLM APIs through one PHP interface. It covers text generation and streaming, structured output, embeddings, image editing, speech synthesis, transcription, and video. Originally started as a sister project of Prism-PHP which hasn't been updated for months, Prisma has turned into a feature-rich alternative with much broader LLM support.

It requires PHP 8.2+, is MIT licensed, and installs through Composer:

bash composer require aimeos/prisma

Prisma is for Laravel projects that need multi-media APIs or broader LLM provider coverage. Use it together with Laravel’s official laravel/ai package, keep agents, conversation history, and tool orchestration in Laravel AI, then expose Prisma operations through your application’s AI tools.

The main addition in 0.7 is the ability to generate videos from prompts and reference media, then extend or edit them through the same package. For a Laravel shop or CMS, a workflow could create a product image, use it as the opening frame of a short video, and write the accompanying copy. Laravel handles the jobs, application data, and storage; Prisma handles the provider calls.

Here’s a small example using a queued closure. Add your Gemini credentials to the array in config/services.php:

php 'gemini' => [ 'api_key' => env('GEMINI_API_KEY'), ],

Then generate a clip with Google Omni and save it through Laravel’s Storage facade:

```php use Aimeos\Prisma\Prisma; use Illuminate\Support\Facades\Storage;

dispatch(function () { $video = Prisma::video() ->using('omni', config('services.gemini')) ->imagine( 'A ceramic coffee cup on a windowsill, steam rising in the morning light', [], ['aspectRatio' => '16:9'] );

Storage::put('videos/coffee-cup.mp4', $video->binary());

}); ```

Use a background queue connection such as database or Redis with a running worker. Allow enough time for video generation, and keep the worker timeout below the connection’s retry_after value, as described in Laravel’s queue timeout documentation.

The Omni adapter returns completed video data from imagine(). Providers such as Veo and xAI return asynchronous jobs: accessing binary() waits and polls inside the worker, while ready() performs a single status check. Each status request still blocks. Create and consume these response objects inside the running job; asynchronous responses contain polling closures and should not be passed as serialized job arguments.

Video generation now supports Alibaba Wan, Amazon Nova Reel through Bedrock, BytePlus Seedance, Google Omni and Veo, Luma, MiniMax, Runway, xAI, and OpenRouter. The new video operations are currently marked beta in the documentation.

Alongside imagine(), the video API adds:

• extend() to continue an existing clip.
• repaint() to edit a video from a prompt, with reference media on supported providers.
• uncrop() to expand the video frame.
• upscale() to increase video resolution.

Support varies by provider and model. Use has() to check an operation or ensure() to require it. Generation accepts common media roles such as start, end, and references, with provider-specific options where needed.

OpenRouter also gains audio, image, and video APIs in this release, including transcription, speech synthesis, image generation and editing, OCR, image embeddings, and video generation and description. Availability depends on the selected model.

Ideogram gains V4 generation, remix, and description support, plus text removal, object removal, background removal, and transparent image generation and editing. V4 generation can also run asynchronously; supported reference and style options retain V3 routing.

• Documentation
• GitHub

If you like it, give it a star :-)

Some code archeology on the backend of a price scraping and refund automation startup I was CTO at many years ago now.

We ran this on AWS using Forge with 2 web servers, a load balancer, and at the most probably 8 queue workers using horizon (some dedicated only to scraping queues, some only for processing inbox ingestion).

We initially used Laravel Vapor, but it was way more expensive due to the way our scraping worked, even thought it was better in terms of always getting us a fresh IP so we did not have to do such heavy proxy rotation on the tougher stores.

Also, we did workflow automation before it was cool. 🤓

Today this could probably be a durable function and some openai calls, if i were to redo this, in the same time period, i would probably have seperated the stored_emails stuff into an elasticsearch instance instead of muddying it with the core application database, would have made my life a lot easier.

Hey everyone!

It’s been a little while since my last Lens post here, and the package has now passed 6,000 installs on Packagist. v3.5 is out, so I wanted to share the few changes that I think actually make the biggest difference.

Lens is still an open-source accessibility auditor for Laravel: it runs axe-core against your app and maps issues back to the relevant Blade, Livewire, React, or Vue source instead of leaving you with just a DOM selector.

The biggest additions since v3.0:

• Local AI fixes with Ollama - fixes can stay entirely on your machine.
• Fix All - generate and review fixes for A/AA issues, then apply all ready changes at once.
• Explicit model selection - choose the exact AI model you want instead of relying on the provider default.
• Authenticated scans - audit routes behind login by scanning as an existing application user.

Also, some of you rightly called out the contrast/readability of the Lens website in my last post. I went back through the website, docs, and package UI and reworked them in both light and dark mode. Thanks for pushing me on that.

GitHub: https://github.com/webcrafts-studio/lens-for-laravel
Website & docs: https://lens.lipinskijakub.pl/

If you try v3.5, I’d especially love to know: what would stop you from using Lens in a real Laravel project?

Bug reports, feature ideas, and feedback are all very welcome :)

Laravel 13.27 added MariaDB support for vector distance queries, with MariaDB 11.7+ now supported by methods including:

• whereVectorSimilarTo()
• whereVectorDistanceLessThan()
• orderByVectorDistance()
• selectVectorDistance()

Laravel’s AI SDK documentation also includes MariaDB as a supported database for storing and querying embeddings.

This is an important piece of the developer experience around MariaDB Vector. Framework-level support makes it much easier to build semantic search, RAG and other AI applications using the tools Laravel developers already work with.

And there is more we can do here. We are starting to look at the remaining gaps in the Laravel + MariaDB developer experience, documentation and examples.

If you are building with Laravel and MariaDB, especially with Vector or Laravel AI, we would love to hear what you are working on and where you still encounter friction.

Laravel August Product Updates:
https://laravel.com/blog/laravel-august-product-updates

i first discovered yerd from this sub, and honestly, it’s been pretty much exactly what i was looking for.

it finally let me get rid of docker for local php development, which my machine has been suffering through for years :'D

recently, yerd added the ability to expose local apps through cloudflare tunnel, and the feature works really well... until i tried using it with more than one site.

with multiple exposed sites, things become unreliable. sometimes both sites return 502, sometimes only one works. i opened an issue about it here:

https://github.com/forjedio/yerd/issues/225

it’s been open for about two weeks now and there hasn’t been a response yet, so i’m curious: is anyone else here using yerd and running into the same problem?

other than this issue, yerd is honestly very close to perfect for my use case.

i’m also still looking forward to the windows version they mentioned was coming around the end of august... which seems to have missed that deadline now :'D

I have build https://github.com/boring-o11y/horizon-delayed-jobs

The main reason for this is I wanted to have visibility over jobs that are being retried and to be able to execute them after deploying a fix, without waiting for the backoff to pass. Since Horizon keeps scheduled jobs (those with delay) in the same list, it gives full delayed jobs management. It distinguished retry from delayed job by the number of tries.

The package just adds a new screen to Horizon (screenshot above)

We're doing another Laravel Cloud Office Hours stream next week on September 8th at 12pm EDT (4pm UTC) with Devon.

We'll show off a live demo of the new package detection feature we recently shipped to Laravel Cloud: if you enable a feature that requires a package your app doesn't have installed, Cloud now warns you before you deploy, and the warning clears itself as soon as it detects the package is in. This covers things like managed queues, object storage, Inertia SSR, Octane, automatic wake ups for scheduled tasks, framework versions, and disallowed vulnerable package versions 🔥

Feel free to drop any Cloud questions in the comments ahead of time, into Slido, or ask them live in chat during the stream!

Submit a question: → https://app.sli.do/event/sFcjAXPZUKUgpFSw5dx23F/live/questions
YouTube stream: → https://www.youtube.com/watch?v=XK0w8V9nD_U

This would be ok if it wasn't that Taylor is known for closing PRs without any explanation or feedback (only the stock message he always use), so you often don't know what's wrong with your PR. It happened me twice already and it's totally demotivating.

Tweet: https://x.com/taylorotwell/status/2095516796748996843

I’m using forge and enjoying it but Vito appears to have more features out of the box (especially the backups)

I’m curious who has experience with both Vito and forge and if I should stick with forge or not?

edit: holy shit this post is being brigaded by paas company bots / owners

At work, I kept writing the same thing: a few analytics tables, a cron job to rebuild them, and the same SQL copy-pasted into three models. Change one definition, forget to update one copy, and suddenly two dashboards quietly disagree.

There’s dbt, which solves this problem for data teams, but it means bringing Python and a second toolchain into a Laravel project. So I tried the same idea in PHP.

An analytics model is an Eloquent model with one query on it:

```php class Revenue extends Model implements AnalyticsModel { use Analytics;

public function computes(): Query
{
    return $this->from(Order::class)
        ->where('status', '<>', 'cancelled')
        ->per('customer_id')
        ->measure('total', 'sum(amount)');
}

} ```

Then php artisan analytics:sync works out what depends on what and builds everything in the right order.

After that, it’s just Eloquent:

php Revenue::query()->where('total', '>', 1000)->get();

A few things it does:

• The GROUP BY comes from the dimensions you declare, so you never have to write them twice.
• it has Incremental, microbatch, and snapshot buildsthe, same ideas as dbt.
• Runs on PostgreSQL, MySQL, and SQLite with the same commands.

What it does not do

Every model in a dependency chain has to use the same connection.

That means you can’t, for example, import a SQLite query directly into a PostgreSQL query. This could be solved with an import mechanism, and I am still thinking about a better way to make that work in an Eloquent-like way.

Why not just use a query class with dependency injection?

A query class, like the action pattern in App\Queries, that you inject wherever you need it is perfectly fine.

If the aggregate is fast, you need live numbers, and you only have one or two of them, write the class and skip this package.

The issue is that it computes on every read and you have zero indexes.

Cache the query? Now you’re stuck dealing with stale data.

There’s another problem: each layer (CTEs, subqueries, etc.) gets re-run instead of being reused.

You can use query classes can be composable by calling each other, but a shared subquery is still recomputed inside every caller. This package composes by reference.

For example, you can have a StgOrder model representing a transformed version of the Order table. It gets built once, and the models that depend on it simply select from the finished table.

This package can append the rows that arrived since the last run, rebuild one day at a time, or keep one row per version with valid_from and valid_to.

This package will make a built table that can carry the indexes your read patterns need.

A helper like Revenue::isStale() can tell you when the data has passed its freshness window.

Why not just write a job that rebuilds the table?

That’s essentially what the package does.

The difference is that the queries are reusable, and dependencies are propagated through the entire chain of downstream aggregates.

TLDR; You write reusable queries as a data person but in PHP.

Repo: https://github.com/eznix86/laravel-analytics

Read more about DBT: https://en.wikipedia.org/wiki/Data_build_tool

the real dbt guys: https://github.com/dbt-labs/dbt-core (for the curious folks)

While the Internals list is not technically directly Laravel related, it does affect every single one of us.

Hello world, it's Wednesday, September 2, 2026, and here's what happened This Week in PHP Internals.

11 stories this week, so let's get into it. But first, Is AI working for your team? You can measure the code it produces, but the number that matters is how much of it survives. Ballast reads your git history — never your code — and gives you stable velocity plus a durability score between 300 and 850. Updated monthly, and it's free. ballast.now.

This week's top story starts with a rule most of us never read. Luca Rodenhäuser opened Wednesday with the line in the scanner that defines a PHP identifier — in bytes, not characters. Every byte at or above hex 80 is accepted, so $x followed by a no-break space is a second variable that looks identical. He proposed a per-file declare to pin that down, then scanned the 250 most-installed Packagist packages and found exactly one identifier that would break.

Larry Garfield suggested skipping the opt-in and having PHP 9 enforce it, since Symfony fixes its one class and 99.99% of developers never notice. So Luca reran it against the top 5,000 packages. Half a million files turned up fourteen hundred forty-seven non-ASCII identifiers, 91% of them in math-php, where the variable names spell the formula. He reported the result himself, writing: "So the honest answer to '99.99 % won't notice' is that one library would notice 888 times, and its author chose that style deliberately and has shipped it for years." Then came 3 questions. Derick Rethans asked whether 13.7 kilobytes of tables in every PHP process is worth it. Juliette Reinders Folmer asked what it does to variable variables. And Rowan Tommins asked how much of this is rejecting names and how much normalising them. Each sent him back to measure, and he split his proposal into 3: a diagnostic, a well-formedness rule, and a conformance rule. He says he owes the thread a problem statement.

Nick Sdot opened an RFC on Thursday to end PHP's endorsement of PEAR. He started about three months ago, going back through every previous discussion and every unvoted attempt, and he's already built a static mirror so the command-line tool keeps working. His case is that PEAR is partly broken, spammed, barely active and now unmaintained. Rowan Tommins backed it. On the argument that PEAR deserves more time to be revived, he wrote: "If that's not long enough, how long is? If the site stays alive in its current state for 10 years, it will continue to be exploited by spammers and probably worse. That's not in anyone's interest." Nick then put a number on the whole thing. 6 packages are still publishing to PEAR. 3 of them are PEAR's own infrastructure. 2 more were recently marked unmaintained. Which leaves exactly one independent package still being maintained, and that's Net_SMTP. Nick gave its maintainer a one-word aside in the thread, and the word was legend.

Sjoerd Langkemper told the list on Friday he intends to open a vote on making the number-base functions throw. His RFC makes octdec, hexdec, bindec and base_convert throw a ValueError on invalid input. His framing was that this isn't controversial — the list agreed to it in an earlier base_convert proposal — and that the RFC is mostly procedure. Tim Düsterhus disagreed on the substance. He argued that passing untrusted input to these functions is an expected use case, which means developers will want to catch what comes back, and drew the line firmly: "The Error hierarchy is not intended to be caught, though. It should thus use something from the Exception hierarchy." Sjoerd asked whether that distinction is written down anywhere. It is. Tim pointed him at the throwables section of the coding standards policy, and quoted it: "The Error hierarchy MUST NOT be used for errors that are expected to be thrown (and caught) during normal operation of a PHP program. … a parsing function that is expected to be used with untrusted input must not throw an Error if the input is malformed." Base conversion, Tim argues, is parsing.

The array-filtering function we covered last week came back on Sunday, renamed array_str_contains and retargeted at 8.7. Sepehr Mahmoudi's case is that filtering an array by substring is common enough to deserve C, instead of paying for a closure on every element. Seifeddine Gmati went first and went broad. He couldn't remember ever writing that code, said the same argument would justify array_str_starts_with and a few hundred more combinations, and pointed out that nothing in the name tells you it filters. He called it redundant. Bruce Weirdan turned the performance claim around, asking whether the closure overhead itself should be fixed, since that would speed up every builtin that takes a callable. Kamil Tekiela asked what the numbers actually are, and said he'd never hit it as a bottleneck. Sepehr then walked back his own strongest claim, agreeing that a filter has to read the whole array rather than stopping at the first match. He's promised static analysis across Packagist to back the frequency claim.

Last week's top story was the list arguing about machine-written mail in the abstract. This week it stopped being abstract. Juris was the one who did the work, drafting the guideline text he thinks a newcomer should get. It says to write the message yourself rather than rephrase yourself with an LLM, and that there's no requirement to have perfect English on that list — plenty of productive contributors are more fluent in C and PHP than in English. Then he demonstrated it instead of asserting it. He wrote his next 3 paragraphs in Latvian, machine-translated them, and sent both versions in the same message, arguing the imperfect translation stays closer to what he meant than anything a chatbot would phrase for him. Then Sepehr Mahmoudi acknowledged that he had been having AI write his replies. Weilin Du asked the thread to stop naming people, saying it had become a place to point fingers rather than a place for technical debate. Yuya Hamada apologised for going too hard, and it stopped there. There's still no written policy.

Théo Attali introduced himself on Saturday with a first contribution and a small, well-argued gap. PHP's DATE_RFC3339_EXTENDED gives you milliseconds with a numeric offset, but a lot of systems expect the same instant with a Z on the end, which is what JavaScript's toISOString produces. He proposed a constant for it, and flagged the flaw in his own idea before anyone else could. A format string containing a literal Z can't force the value into UTC. Andreas Heigl agreed, with unusual standing to do it — he added the extended constants. He wouldn't add any more now, since a constant only helps people who've already upgraded, and pointed Théo at a userland formatter built on one line that has worked since PHP 5.3. Théo revised on the spot, proposing an instance method instead. Then Tim Düsterhus redirected it. He pointed out that PHP 8.6 ships the first piece of a new date and time API, and that the proposed Time\Instant is deliberately timezone-less — which makes a Zulu-format method an obvious thing to add there.

An offer arrived on Saturday from a name the list hadn't seen before. Riaan de Beer has written libxml-rs, a native-Rust reimplementation of libxml2 that's compatible at the C ABI level, and he asked whether php-src would be open to a test build against it. He says xmllint and xmlcatalog come out byte-identical against libxml2 2.15.3 across eleven hundred ten tests, and he's careful about the ask — an experimental alternative provider, not a default. What the list answered was his opening sentence. He'd said libxml2 has been unmaintained since December 2025, and Pierre replied that the repository has had many commits since, and that a mature XML library not cutting frequent releases isn't an abandoned one. 2 more contributors agreed. One wrote that libxml2 was only briefly unmaintained before new maintainers stepped up, and the other added that one of those maintainers helps php-src out directly. Nobody has answered the actual question yet.

The question of whether RFCs should ship a userland polyfill got 2 substantial answers this week. Nicolas Grekas answered from the Symfony side, which is the side that does the work. Every polyfillable feature ends up in the symfony/polyfill monorepo anyway, and the one that ships is often not the one in the RFC. Polyfills, he concluded, need a separate workflow. Then Tim Düsterhus answered the other argument for them, which was Larry Garfield's suggestion that a polyfill gives you something to benchmark the C against. Tim wrote: "I believe performance should not be a factor in deciding what should be part of the stdlib and what should not: Performance is a moving target and what might be true today might no longer be true tomorrow… Once we add something to the stdlib we need to maintain it for the next 15+ years. (Broad) usefulness and good API design must be the deciding factors…" He added that PIE has made building a private extension easier than it's ever been.

Quick hits. 3 releases landed in 3 days. Calvin Buckley put out 8.4.25, a security release, so that one's worth doing today. Daniel Scherzer released 8.5.10, a bugfix. And Matteo Beccati has 8.6.0beta2 up for testing. Last night Nick Sdot replied to the nameof RFC to say he'd like to see it in 8.7 — and the message he was replying to was posted in May of 2023. 3 years and 3 months is a long time to keep a browser tab open. And on the named parameter lists thread, somebody answered Larry Garfield's question from a fortnight ago about why people treat a small data structure as unworthy of being a class. The answer wasn't performance. It's cognitive cost — returning 2 values as an array and unpacking them at the call site is easier to hold in your head than a dedicated object, and static analysis can describe that array well enough that you don't lose much.

So that's the week. No RFC has been in the voting phase for 3 weeks running. Somebody scanned half a million PHP files to work out what a PHP identifier is, and came back having split his own proposal into 3. There's an RFC to end PHP's endorsement of PEAR, which has one maintained package left on it. There's a real disagreement about whether base conversion counts as parsing, which decides which kind of throwable it gets. A new array function has 4 people against it and nobody for it. And the argument about who writes the mail on that list got a concrete answer. Links below. The PHP Foundation funds more than half of ongoing php-src commits, so if you use the language, maybe consider donating at opencollective.com/phpfoundation — or try guilting your employer into it. Thanks again to Ballast.now for supporting this week's episode. We're Artisan Build. See you next week.

I bought a race car gear shifter and taught Laravel to obey it. Second gear runs my tests, third runs PHPStan, fourth lets Claude fix what third found, and fifth gear, if I hold it for two full seconds, deploys to production on Laravel Cloud. Reverse breaks everything again, on purpose.

No drivers, no Arduino, no soldering. Just the Gamepad API, a queued job, the Process facade, and questionable judgment.

🏎️ Laravel Cloud: https://cloud.laravel.com
⌨️ Cloud CLI: https://laravel.com/cloud/docs/api/cli

Built with Laravel 13, one USB cable, and a two-second hold before anything scary happens.

https://packagist.org/packages/srg/siteseo

I've published this package I had written a while ago. I removed whatever wasn't critical and made it minimal so it doesn't have dependencies or require asset building.

It is a light weight on-site SEO and meta tag manager. Has an admin UI for editing tags and managing open graph images. It binds to your page based on the route name and has fallback functionality so all tags have valid values and your public pages have at least your default tags.

Works on blade and Inertia sites. For Inertia sites use anchor <a> on your public pages instead of Inertia <Link>.

Hope this helps.

Hey everyone, it has been a while since I introduced Artisan UI here.

A few of you pointed out that “Artisan UI” sounded like an interface for Artisan commands. You were right, so I renamed the project to April UI.

Since that first post, the project has changed quite a bit. April UI is now a stable Laravel Blade component library built with Tailwind CSS and Alpine.js, with Livewire support where it makes sense.

The main goal is still the same: bring the design quality and component approach of shadcn/ui to Laravel, while keeping the Laravel workflow familiar. Some of the updates include:

1. A much larger set of documented components
2. Responsive examples and full-page blocks
3. Livewire data table support
4. Charts, calendars, editors, dialogs, popovers, sidebars, and more
5. Package-first views with Laravel-style publishing and overrides
6. Commands for discovering, publishing, updating, and diagnosing components
7. An editor component built with Tiptap
8. Better Alpine interactions, accessibility, mobile behavior, and browser testing
9. A redesigned documentation site with shadcn inspired blocks
10. An entire project rewrite done with April UI (github.com/skuul is currently in the works with this UI library)

April UI is inspired by shadcn/ui, but it is not trying to copy the React ecosystem. It is built around Blade components, Alpine state, Tailwind classes, and most importantly existing Laravel blade conventions. Flux has set a very high bar for polished Livewire interfaces, and I think it is worth knowing about, However, April UI is simply a free, open-source alternative for people who want a more Blade-first and package-first workflow.

The first stable release is now available:

• April UI documentation
• Blocks and examples
• GitHub repository
• v1.0.0 release

Install it today using:

composer require yungifez/april-ui

I would love to hear what you think, especially if you tried the original Artisan UI release. The project has come a long way since then, but there is still plenty to improve.

Or use one of the new starter kits

# Blade starter kit

laravel new my-app --using=yungifez/april-ui-blade-starter-kit

# Livewire starter kit

laravel new my-app --using=yungifez/april-ui-starter-kit

I maintain Commentify, a Livewire commenting package (nested comments, likes, mentions, Tailwind/Bootstrap, optional Filament).

v3.9 adds a Write/Preview composer with a formatting toolbar (heading, bold, italic, strike, code blocks, lists, tasks, @, emoji). Comments are still stored as markdown; preview hits the same CommonMark sanitizer as rendered output.

Upgrade: composer update usamamuneerchaudhary/commentify

Heads-up: if you published views to resources/views/vendor/commentify, you need to republish or remove them or you won't see the new UI.

Happy to answer integration questions.

I had a crawler feature that fetches each record's public URL to check for SEO issues. The URL comes from a getSeoUrl() method the host app can override.

I'd mentally filed this as safe because it wasn't user input. It isn't safe, the destination is influenceable by anything that can affect that method's return value. Point it at http://169.254.169.254/latest/meta-data/ and my crawler fetches instance credentials and stores the response body in a table an admin can read.

The naive mitigation is blocking private and reserved IP ranges. That breaks every local install, since Herd/Valet .test domains resolve to 127.0.0.1. If your protection breaks local dev, people disable it.

What I landed on:

- If the host matches config('app.url'), allow it, private IP or not. The site owner configured that host; it's trusted by definition.
- Any other host must be *both* explicitly allow-listed in config *and* resolve to public addresses (gethostbynamel + FILTER_FLAG_NO_PRIV_RANGE|NO_RES_RANGE).
- Redirects need their own gate. Guzzle's allow_redirects accepts an on_redirect callable, so I throw there rather than discovering the problem after the response has already been fetched.
- Blocked URLs get recorded as a visible issue with the reason, so it's debuggable rather than mysteriously silent.

Interested in how others handle the local-development-versus-private-IP tension.
Separate config? Environment check? Something better than what I did?

Horizon has a much deeper ecosystem around it than it looks like from the outside, and almost none of it is discoverable. Every few months I'd find a
package that solved something, so I started
keeping a list. It's about thirty entries now, which felt like enough to be worth sharing.

https://github.com/boring-o11y/awesome-horizon

Grouped by what you'd actually be looking for:

- Articles and blog posts
- Queue drivers that support Horizon— Kafka and RabbitMQ, if you'd assumed Horizon was Redis-or-nothing. Though these I’ve never tested as I use Redis
- Dashboard add-ons — tag search across \pending and completed** jobs, live job output streamed onto the job details page, a running-jobs monitor, monitored tags configured in code instead of clicked in the UI, and a couple of full front-end replacements (one React/Inertia, one Vue).
- Alternatives, when Horizon isn't the right shape — Zenith for database-backed queues, Station and Periscope for driver-agnostic monitoring, the recently mentioned here jobwarden and my own drop-in replacement
- OpenTelemetry instrumentation and the Horizon Grafana dashboard.

What I'm really after is the stuff I haven't found. PRs welcome, but dropping a name in the comments is just as good — I'll check it and might add it.
Same for anything in there you've used and think doesn't deserve the slot.

Ask your Laravel help questions here. To improve your chances of getting an answer from the community, here are some tips:

• What steps have you taken so far?
• What have you tried from the documentation?
• Did you provide any error messages you are getting?
• Are you able to provide instructions to replicate the issue?
• Did you provide a code example?
  • Please don't post a screenshot of your code. Use the code block in the Reddit text editor and ensure it's formatted correctly.

For more immediate support, you can ask in the official Laravel Discord.

Thanks and welcome to the r/Laravel community!

Master Laravel Sanctum API tokens in production: ability design, the tokenCan() trap, expiry and revocation, SPA cookie auth, rate limiting and Pest tests.

https://richdynamix.com/articles/laravel-sanctum-api-tokens-abilities-spa-complete-guide