Posts tagged with spatie

Laravel Permission v7 has been launched

by Freek Van der Herten – 3 minute read

Laravel's built-in authorization is great when permissions are defined in code. With gates and policies, you can write logic like this:

// Defined in code, requires a deploy to change
Gate::define('edit-posts', function (User $user) {
    return $user->is_admin;
});

But in some projects roles and permissions are dynamic: created by users, managed through an admin panel, or changed at runtime without deploying code. Our Laravel Permission package can help you dynamically create roles and permissions.

We just released v7 which doesn't bring any new features, but cleans up the internal code and modernizes it. Let me walk you through what the package can do.

Read more

Join thousands of developers

Every two weeks, I share practical tips, tutorials, and behind-the-scenes insights from maintaining 300+ open source packages.

No spam. Unsubscribe anytime. You can also follow me on X.

Laravel PDF v2 has been released: adds support for Laravel Cloud and easy queuing

by Freek Van der Herten – 6 minute read

A while ago, we released laravel-pdf, a package to generate PDFs in Laravel apps.

Under the hood, it used Browsershot (and therefore Puppeteer/Chrome) to convert HTML to PDF. That approach works great, but it does require Node.js and a headless Chrome binary on your server.

Last week, my buddy Dries shared on X how to generate PDFs using Cloudflare services. This way doesn’t require Node or any binaries. Very neat! This unlocks PDF generation for environments where Node or Chrome cannot be installed easily, like Laravel Cloud.

To support this way of rendering a PDF, we’ve released a new major release (v2) of Laravel PDF. The package now ships with three drivers: Browsershot, Cloudflare Browser Rendering, and DOMPDF. You can also create your own driver. On top of that, we've added queued PDF generation and the ability to set PDF metadata. And to let your AI understand our package, we've added a Laravel Boost skill.

Let me walk you through all of it.

Read more

Introducing Spatie Guidelines for Laravel Boost

by Freek Van der Herten – 2 minute read

If you're using AI tools like Claude Code to help write code, you've probably noticed they don't automatically know your team's coding conventions. The AI might write perfectly valid PHP, but it won't follow your specific style guide unless you tell it to. That's the problem Laravel Boost solves. It…

Read more

Introducing Rich Text Laravel - Part 2

tighten.com - submitted by Kayla Helmick

This article continues the series on integrating Trix with Laravel by focusing on user mentions using the Rich Text Laravel package. It walks through adding a Tribute.js-powered mention picker in the editor, implementing back-end support via an AttachableContract and Signed Global IDs, and even scaffolds a notification system to email mentioned users.

Read more [tighten.com]

How to monitor your Laravel app for critical vulnerabilities

by Freek Van der Herten – 6 minute read

A critical security vulnerability was just disclosed for Livewire v3, as Stephen Rees-Carter wrote about on Securing Laravel. The vulnerability (CVE-2025-54068) allows unauthenticated attackers to achieve remote code execution in specific scenarios. What makes this particularly concerning is that exploitation doesn't require authentication or user interaction - just a component mounted and configured in a particular way.

This vulnerability affects all Livewire v3 versions up to 3.6.3. If you're running any version in that range, attackers could potentially run arbitrary PHP code on your server. Stephan warns us the open-source nature of the fix means attackers may already be reverse-engineering the patch to identify and abuse the exploit.

Many production apps are probably running vulnerable versions right now, with their developers completely unaware. This is where automated security monitoring becomes invaluable - using Laravel Health to check for vulnerabilities, and optionally services like Oh Dear to send you notifications when issues are detected.

Read more