Posts tagged with php

Join 9,500+ smart developers

Get my monthly newsletter with what I learn from running Spatie, building Oh Dear, and maintaining 300+ open source packages. Practical takes on Laravel, PHP, and AI that you can actually use.

No spam. Unsubscribe anytime. You can also follow me on X.

Building RAG in Laravel: Four Ingestion Bugs That Silently Wreck Retrieval

mujahidabbas.dev - submitted by Muhammad Mujahid Abbas

Every Laravel RAG tutorial builds the same ingestion pipeline (chunk, embed, store) and stops the moment the agent answers on screen. None of them check whether retrieval is any good. But retrieval quality is decided at ingestion, before the model runs once, and four decisions there fail with no error, no exception, no failed test:

  • Chunking that severs the answer mid-sentence, so answer@1 falls while source hit@1 still looks healthy.
  • An HNSW index built with vector_l2_ops while you query with cosine <=>. Postgres silently ignores the index and scans every row. Laravel 13's native whereVectorSimilarTo() hardcodes <=>, so it's easier to hit than ever. Shown with EXPLAIN.
  • The embedding dimension baked into the vector(1536) column type, so "shrink it to save storage" is a migration plus a full re-embed that quietly drops retrieval to 47%.
  • Ingesting and querying with different models, which turns every distance into noise.

Each bug is real code from a working repo, proven against an eval suite. It's the prequel to my earlier "Evaluating RAG in Laravel" post: build it, prove it, tune it. Every example verified against laravel/ai v0.7.2 and pgvector, with the full repo to clone.

Read more [mujahidabbas.dev]

Prompt-Injection Guardrails in Laravel: Defend the Tools, Not the Prompt

mujahidabbas.dev - submitted by Muhammad Mujahid Abbas

You can't out-prompt an attacker — to the model, your system instructions and a malicious support ticket are the same text. So stop defending the prompt and lock down the boundaries you actually control: tools scoped to the authenticated user server-side, middleware that screens and logs, output handled as untrusted input, a human in front of anything irreversible, and a fake-free test that fails CI the moment someone drops the auth scope.

Read more [mujahidabbas.dev]

Logging is here!

flareapp.io

Flare now supports log collection for Laravel and PHP apps, with real-time filtering and search in the same polished interface. A nice overview of what logging adds and how to get started with the new SDK release.

Read more [flareapp.io]

Announcing laravel-sluggable v4 with self-healing URLs original

by Freek Van der Herten – 5 minute read

The spatie/laravel-sluggable package has been around for close to a decade. A slug is the readable part of a URL that identifies a record, like announcing-laravel-sluggable-v4-with-self-healing-urls in this post's URL. The package generates one for any Eloquent model when you save it, derived from a title or another text field, and most of the time you don't have to think about it.

We just released v4, which adds a few things worth talking about. Let me walk you through them.

Read more