php

All my posts about php.

laravel spatie best practices package testing

Prompt-Injection Guardrails in Laravel: Defend the Tools, Not the Prompt

Jun 11th 2026 – mujahidabbas.dev - submitted by Muhammad Mujahid Abbas

You can't out-prompt an attacker — to the model, your system instructions and a malicious support ticket are the same text. So stop defending the prompt and lock down the boundaries you actually control: tools scoped to the authenticated user server-side, middleware that screens and logs, output handled as untrusted input, a human in front of anything irreversible, and a fake-free test that fails CI the moment someone drops the auth scope.

Logging is here!

Jun 9th 2026 – flareapp.io

Flare now supports log collection for Laravel and PHP apps, with real-time filtering and search in the same polished interface. A nice overview of what logging adds and how to get started with the new SDK release.

The Reason I Love Tempest for APIs

Jun 3rd 2026 – www.juststeveking.com

Steve King explains why Tempest feels so nice for API work: typed request objects, declarative validation, route discovery, and a low-ceremony action flow. It is a good look at how the framework removes boilerplate without giving up clarity.

Using property hooks in PHP

Jun 1st 2026 – dyrynda.com.au

Michael Dyrynda shows how PHP 8.4 property hooks can replace simple computed getter methods with virtual properties. He makes the case for using them when you want a clean, property-based API for derived values.

Validating distinct data in requests

May 31st 2026 – dyrynda.com.au

Michael Dyrynda shows how Laravel's distinct validation rule can protect nested request payloads from duplicate reference values before they corrupt relationship mapping. He also highlights the strict and ignore_case options for cases where loose comparison is not enough.

The stack behind There There

May 30th 2026 – there-there.app

An inside look at the stack powering There There: Laravel, Inertia, React, TypeScript, Horizon, Reverb, and a bunch of Spatie packages and services. A nice overview of the pragmatic tooling choices behind the product.

An Update on Composer & Packagist Supply Chain Security

May 27th 2026 – blog.packagist.com

Composer and Packagist share a solid overview of the supply chain security work already in place, what is shipping now, and what is coming next. Worth reading if you maintain PHP packages or care about how the ecosystem is hardening against package compromise.

Using the ADR (Action/Domain/Responder) Pattern in Laravel

May 12th 2026 – wendelladriel.com - submitted by Wendell Adriel

Learn what the ADR (Action/Domain/Responder) pattern is and how to apply it in Laravel with a simple, practical example.

Flaky Test Retries in Pest v4.5.0

May 10th 2026 – laravel-news.com

Pest v4.5.0 adds first-class support for flaky tests with retries and a dedicated CLI filter. The release also brings a useful casing assertion for catching namespace and file path mismatches, plus a coverage option that hides uncovered files.

Idempotency: What, Why and How

May 7th 2026 – wendelladriel.com - submitted by Wendell Adriel

A deep dive into idempotency, from the theory behind safe retries to a practical Laravel implementation using the Laravel Idempotency package.

Searching multiple columns with one URL parameter in laravel-query-builder original

May 4th 2026 by Freek Van der Herten – 4 minute read

We just released v7.3.0 of laravel-query-builder, which adds a new way to group multiple filters under a single URL parameter. Before getting into the new feature, let me show you how the basics work, so the new bit makes sense in context.

RBAC in Laravel: A Practical Deep Dive

May 1st 2026 – wendelladriel.com - submitted by Wendell Adriel

A deep dive into Role-Based Access Control, from the theory behind roles and permissions to a practical, team-aware Laravel implementation without external packages.

Announcing laravel-sluggable v4 with self-healing URLs original

Apr 29th 2026 by Freek Van der Herten – 5 minute read

The spatie/laravel-sluggable package has been around for close to a decade. A slug is the readable part of a URL that identifies a record, like announcing-laravel-sluggable-v4-with-self-healing-urls in this post's URL. The package generates one for any Eloquent model when you save it, derived from a title or another text field, and most of the time you don't have to think about it.

We just released v4, which adds a few things worth talking about. Let me walk you through them.

Validating Array Inputs in Laravel Without the N+1

Apr 16th 2026 – daryllegion.com - submitted by Daryl Legion

Validate nested array inputs in Laravel form requests without the N+1. Prefetch lookup data in prepareForValidation and check items in memory.

Why use static closures?

Apr 14th 2026 – f2r.github.io

A clear walkthrough of how PHP closures implicitly capture $this, even when they don't use it, and how that can prevent objects from being garbage collected. Also covers what PHP 8.6 will change with automatic static inference.

Liminal - A full Laravel playground in your browser

Mar 25th 2026 – liminal.aschmelyun.com - submitted by Andrew Schmelyun

A static, free, and open-source Laravel playground that runs entirely in the browser! Comes with a sqlite db, artisan commands, two-way file syncing, github imports, and more.

What's new in laravel-activitylog v5 original

Mar 25th 2026 by Freek Van der Herten – 6 minute read

We just released v5 of laravel-activitylog, our package for logging user activity and model events in Laravel.

In Flare, Mailcoach, and Oh Dear we use it to build audit logs, so we can track what users are doing: who changed a setting, who deleted a project, who invited a team member. If you need something similar in your app, this package makes it easy.

This major release requires PHP 8.4+ and Laravel 12+, and brings a cleaner API, a better database schema, and customizable internals. Let me walk you through what the package can do and what's new in v5.

Moving from PHPStorm to Zed for Laravel development

Mar 23rd 2026 – x.com

Chris Mellor wrote a practical guide on setting up Zed as a Laravel IDE, covering PHP extensions, Pint formatting, Blade support, and how it compares to PHPStorm.

Chat with your documents: a practical guide to RAG using the Laravel AI SDK

Mar 20th 2026 – tighten.com

A thorough walkthrough of building a RAG system in Laravel using the new AI SDK, Postgres for vector storage, and Livewire 4 for a streaming chat UI. Covers everything from what RAG is and how semantic search works to embedding documents and querying them.

Build an MCP server with Laravel

Mar 19th 2026 – thunk.dev

Daniel Coulbourne walks through building an MCP server with the official laravel/mcp package. He built one for his blog in about 20 minutes, then used it to write and publish the post you're reading.