Posts tagged with laravel

Join 9,500+ smart developers

Get my monthly newsletter with what I learn from running Spatie, building Oh Dear, and maintaining 300+ open source packages. Practical takes on Laravel, PHP, and AI that you can actually use.

No spam. Unsubscribe anytime. You can also follow me on X.

Building RAG in Laravel: Four Ingestion Bugs That Silently Wreck Retrieval

mujahidabbas.dev - submitted by Muhammad Mujahid Abbas

Every Laravel RAG tutorial builds the same ingestion pipeline (chunk, embed, store) and stops the moment the agent answers on screen. None of them check whether retrieval is any good. But retrieval quality is decided at ingestion, before the model runs once, and four decisions there fail with no error, no exception, no failed test:

  • Chunking that severs the answer mid-sentence, so answer@1 falls while source hit@1 still looks healthy.
  • An HNSW index built with vector_l2_ops while you query with cosine <=>. Postgres silently ignores the index and scans every row. Laravel 13's native whereVectorSimilarTo() hardcodes <=>, so it's easier to hit than ever. Shown with EXPLAIN.
  • The embedding dimension baked into the vector(1536) column type, so "shrink it to save storage" is a migration plus a full re-embed that quietly drops retrieval to 47%.
  • Ingesting and querying with different models, which turns every distance into noise.

Each bug is real code from a working repo, proven against an eval suite. It's the prequel to my earlier "Evaluating RAG in Laravel" post: build it, prove it, tune it. Every example verified against laravel/ai v0.7.2 and pgvector, with the full repo to clone.

Read more [mujahidabbas.dev]

Prompt-Injection Guardrails in Laravel: Defend the Tools, Not the Prompt

mujahidabbas.dev - submitted by Muhammad Mujahid Abbas

You can't out-prompt an attacker — to the model, your system instructions and a malicious support ticket are the same text. So stop defending the prompt and lock down the boundaries you actually control: tools scoped to the authenticated user server-side, middleware that screens and logs, output handled as untrusted input, a human in front of anything irreversible, and a fake-free test that fails CI the moment someone drops the auth scope.

Read more [mujahidabbas.dev]

Logging is here!

flareapp.io

Flare now supports log collection for Laravel and PHP apps, with real-time filtering and search in the same polished interface. A nice overview of what logging adds and how to get started with the new SDK release.

Read more [flareapp.io]

Our hackathon project: Live at Spatie

spatie.be

At our latest hackathon, we built Live at Spatie, a Laravel and React wrapper around Owntone that lets the whole team queue music, see what's playing, and control the office speakers. The nicest touch is the Slack bot: thanks to an MCP server powered by laravel/mcp and OpenClaw, you can ask it to queue music right from Slack.

Read more [spatie.be]