freek.dev - all PHP blogposts

PHP version stats: July, 2026

2026-07-29T17:23:14+02:00

Brendt shares fresh Packagist-based PHP version stats for July 2026: PHP 8.4 is now the most-used version, while PHP 8.5 reached 16% adoption after six months. He also notes that package minimum requirements still lag behind, with relatively few popular packages requiring a version that still gets active bugfix support.

Building an order fulfilment workflow in Laravel

2026-07-25T14:30:28+02:00

Steve King builds a real order fulfilment flow to show how a workflow engine handles long-running processes in Laravel. The post covers steps, signals, retries, branching, human approval, compensation, and the surrounding tooling in one practical example.

Preventing SSRF in Laravel: Why Blocking Private IPs Fails

2026-07-22T15:24:24+02:00

I found there wasn't any good SSRF prevention libraries for Laravel, so I built one. Very comprehensive tests based on this paper: https://www.usenix.org/conference/usenixsecurity24/presentation/wessels

https://github.com/securized/laravel-ssrf

PHP Attributes: What, Why, How and When

2026-07-21T14:43:26+02:00

A deep dive into PHP attributes, from metadata and Reflection to practical design patterns, Laravel examples, performance, testing, and the cases where explicit code is better.

Supercharge your PHP apps with Go-powered PHP extensions

2026-07-17T14:30:31+02:00

A practical conference session on building PHP extensions with Go and FrankenPHP, then wiring them into Laravel and Symfony as native-feeling features. It uses an in-memory LRU cache as the example and offers a nice tour of framework flexibility and PHP internals.

New in PHP 8.6: Faster array_map with first-class callables

2026-07-15T14:30:27+02:00

In this video, Tideways shows how PHP 8.6 speeds up array_map when you use first-class callables.

The Laravel Scheduler Under the Hood

2026-07-14T14:02:25+02:00

A deep dive into the Laravel Scheduler, from event registration and cron evaluation to mutexes, background processes, sub-minute tasks, and production-safe scheduling.

Everything About the Context Facade

2026-06-29T14:13:28+02:00

A deep dive into Laravel Context, from request metadata and automatic log enrichment to hidden context, scoped values, queues, scheduled commands, and internals.

Improving Laravel Architecture With Expressive

2026-06-23T14:30:27+02:00

Learn how Expressive can improve a Laravel application by keeping Eloquent as the database layer while moving business logic to fully typed objects.

Eloquent Query Classes Pattern

2026-06-22T14:30:28+02:00

Learn how to use Eloquent Query Classes to organize important database logic in Laravel without adding a full repository layer.

Building RAG in Laravel: Four Ingestion Bugs That Silently Wreck Retrieval

2026-06-19T14:32:25+02:00

Every Laravel RAG tutorial builds the same ingestion pipeline (chunk, embed, store) and stops the moment the agent answers on screen. None of them check whether retrieval is any good. But retrieval quality is decided at ingestion, before the model runs once, and four decisions there fail with no error, no exception, no failed test:

Chunking that severs the answer mid-sentence, so answer@1 falls while source hit@1 still looks healthy.
An HNSW index built with vector_l2_ops while you query with cosine <=>. Postgres silently ignores the index and scans every row. Laravel 13's native whereVectorSimilarTo() hardcodes <=>, so it's easier to hit than ever. Shown with EXPLAIN.
The embedding dimension baked into the vector(1536) column type, so "shrink it to save storage" is a migration plus a full re-embed that quietly drops retrieval to 47%.
Ingesting and querying with different models, which turns every distance into noise.

Each bug is real code from a working repo, proven against an eval suite. It's the prequel to my earlier "Evaluating RAG in Laravel" post: build it, prove it, tune it. Every example verified against laravel/ai v0.7.2 and pgvector, with the full repo to clone.

How PHP Attributes Changed the Way I Write Livewire

2026-06-17T12:30:28+02:00

Bert De Swaef shows how PHP attributes made his Livewire components easier to read by attaching validation, URL sync, and event listeners directly to the properties and methods they belong to. Nice piece on how attributes reduce mental overhead, improve IDE support, and make components feel more self-documenting.

Rust Tutorial For PHP and JavaScript Developers

2026-06-16T14:55:29+02:00

#[RouteParameter] Does Not Bind Your Model

2026-06-12T14:30:26+02:00

Michael Dyrynda explains a subtle Laravel gotcha: #[RouteParameter] only reads the current route parameter value, it does not perform implicit model binding. Good reminder that the controller signature still matters when you expect a bound model inside a form request.

Prompt-Injection Guardrails in Laravel: Defend the Tools, Not the Prompt

2026-06-11T14:10:30+02:00

You can't out-prompt an attacker — to the model, your system instructions and a malicious support ticket are the same text. So stop defending the prompt and lock down the boundaries you actually control: tools scoped to the authenticated user server-side, middleware that screens and logs, output handled as untrusted input, a human in front of anything irreversible, and a fake-free test that fails CI the moment someone drops the auth scope.

Logging is here!

2026-06-09T14:30:28+02:00

Flare now supports log collection for Laravel and PHP apps, with real-time filtering and search in the same polished interface. A nice overview of what logging adds and how to get started with the new SDK release.

The Reason I Love Tempest for APIs

2026-06-03T14:30:27+02:00

Steve King explains why Tempest feels so nice for API work: typed request objects, declarative validation, route discovery, and a low-ceremony action flow. It is a good look at how the framework removes boilerplate without giving up clarity.

Using property hooks in PHP

2026-06-01T14:30:31+02:00

Michael Dyrynda shows how PHP 8.4 property hooks can replace simple computed getter methods with virtual properties. He makes the case for using them when you want a clean, property-based API for derived values.

Validating distinct data in requests

2026-05-31T14:30:37+02:00

Michael Dyrynda shows how Laravel's distinct validation rule can protect nested request payloads from duplicate reference values before they corrupt relationship mapping. He also highlights the strict and ignore_case options for cases where loose comparison is not enough.

The stack behind There There

2026-05-30T10:13:56+02:00

An inside look at the stack powering There There: Laravel, Inertia, React, TypeScript, Horizon, Reverb, and a bunch of Spatie packages and services. A nice overview of the pragmatic tooling choices behind the product.