Freek.dev

A schema viewer that had only ever read a live database connection was quietly relying on that connection being trustworthy. Letting people paste a mysqldump instead turned up three assumptions that broke silently: identifiers written straight into the diagram definition, unrecognised statements skipped without a word, and relationship inference presenting a guess as a fact. Plus a fourth bug that the regex-based tests could not see, because a regex has no concept of a tag still being open ten lines later.

A deep dive into modular monoliths, from module APIs and database ownership to cross-module communication, architecture tests, incremental migration, and the signals that justify microservices.

We just shipped Leaf 5 a lightweight PHP framework rebuilt around AI-assisted development, with errors that explain their own fix and docs designed to be cheap for agents to read.

Most AI slop is a context problem, not a model problem: the same model, given no rules file, no memory and no record of past decisions, invents something plausible instead of something consistent. This covers the four ways context fails, and three checks you can actually enforce: a line budget in CI, a drift check on your context files, and a small set of golden tasks you re-run.

A deep dive into immutability in PHP, from readonly properties and interior mutability to immutable value objects, collections, dates, cloning, boundaries, and testing.

July was LaraPlugins' busiest month yet: 3,734 human visitors, 4.5 million AI agent requests, a Reddit post that blew up, and a sneaky data drift bug I had to hunt down. Here’s a look behind the scenes at what we shipped, what broke, and why building for humans still matters most.

On August 14 auto mode becomes the default in Claude Code. Anthropic's own test found it catches 89% of dangerous commands versus 13.6% for human reviewers, and still calls it not risk-free. This is the practical playbook: the permission rules, the PreToolUse hook that blocks a push on red tests, and the review habits that keep it honest, with the actual config.

Every CMS tribe (WordPress, Drupal, Statamic, Sanity, pick your poison) has quietly cracked problems the others don't even know exist, but none of that wisdom leaks out because everyone's heads-down in their own bubble. AI just torched the cost of switching stacks, so staying fluent in only one CMS dialect isn't cozy anymore; it's a liability.

Laravel Truss 1.6 lets you theme the dashboard to match your app: your own palette under truss.theme, light and dark, with a live theme builder. It also adds truss:export, which writes your database structure to DBML, JSON, CSV, Markdown, or Mermaid, with a --check flag that fails CI when a committed schema file drifts. Structure only, never row data.

An essay on how AI-assisted development turns engineers into full-time reviewers. We spend our days evaluating AI-generated diffs instead of writing code, and that shift carries a new cognitive fatigue and may widen the senior/junior gap.

Truss 1.5 adds truss:doctor, a deterministic, structure-only review of your Laravel database: 13 rules flagging missing primary keys, unindexed foreign keys, type mismatches, money stored as a float, and more, with exit codes so a bad migration fails the build. No AI, no queries, no row data, safe to run in CI against a database you don't fully trust.

Learn about the new "clamp" function in PHP 8.6 and how it can be used with different data types. We also discuss how to use "clamp" in your PHP and Laravel projects before PHP 8.6 is released.

Skills look like the disk tier of the CLAUDE.md memory model. They aren't. The real model has four tiers: RAM, path-scoped rules, skills, and disk.

A live, zoomable ER diagram of your Laravel app's actual database schema, safe to run in production because it only ever reads structure, never rows.

Laravel is becoming the best choice for building full-stack web projects in the AI agentic coding era. But rewriting functionality from scratch each time wastes tokens. That is why Laraplugins.io curated plugins that integrate directly with the Laravel AI SDK, so your agent can hit the ground running on new projects faster

Favicon Fetcher v3.12.0 adds support for Guzzle 8 and includes security improvements for the GitHub Actions workflows.

I found there wasn't any good SSRF prevention libraries for Laravel, so I built one. Very comprehensive tests based on this paper: https://www.usenix.org/conference/usenixsecurity24/presentation/wessels https://github.com/securized/laravel-ssrf

A deep dive into PHP attributes, from metadata and Reflection to practical design patterns, Laravel examples, performance, testing, and the cases where explicit code is better.

This article explains how to introduce a ledger that tracks the movements of a column, to ensure that at all points, the final state of the column can be derived from all the movements that has happened over time.