laravel/framework
Laravel is a web application framework with expressive, elegant syntax.
How framework is put together
This repository contains the core code of the Laravel web application framework, organized as a large set of decoupled components under src/Illuminate/<Component> (Auth, Broadcasting, Bus, Cache, Collections, Concurrency, Config, Console, etc.), each shipped with its own composer.json so pieces can be used standalone or together via the laravel/framework package. It is written almost entirely in PHP, with a small Node/Vite build for the Foundation exception-page renderer assets. The framework provides routing, a dependency-injection container, multi-backend session/cache storage, database-agnostic migrations, background job processing, and real-time event broadcasting; applications built on it wire these components together through service providers and configuration arrays in config/. Data flow is request -> HTTP kernel/routing -> controllers guarded by Auth middleware -> services backed by swappable drivers (cache, queue, session, broadcast) selected at runtime from configuration.
Languages
Frameworks
Datastores
Infrastructure
Major components
Auth
Provides authentication guards (SessionGuard, TokenGuard, RequestGuard), user providers (EloquentUserProvider, DatabaseUserProvider), password recaller cookies, and email verification support.
Broadcasting
Implements event broadcasting over public/private/presence/encrypted-private channels, including BroadcastController for channel authorization and BroadcastManager for driver selection.
Bus
Job dispatching and batching, with Dispatcher, PendingBatch, and batch repositories persisted to databases (DatabaseBatchRepository) or DynamoDB (DynamoBatchRepository).
Cache
Multi-driver cache repository (Array, File, APC, Memcached, Redis, DynamoDB, Database, Null, Failover, Memoized) plus distributed locking primitives and a RateLimiter.
Collections
The Collection/LazyCollection data-manipulation layer with Arr helpers and higher-order collection proxies used throughout the framework.
Concurrency
Runs closures concurrently via selectable drivers: ForkDriver (pcntl fork), ProcessDriver, and SyncDriver behind ConcurrencyManager.
Config
Repository abstraction holding application configuration values loaded from the config/ directory.
Console
Artisan command infrastructure: Command base class, GeneratorCommand scaffolding, command mutexes, and the Symfony-console-based Application.
Version 13.27.0 shipped with a new Cloud facade, security-tightened validation rules, and a batch of image and database fixes.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
Version 13.27.0 shipped with a new Cloud facade, security-tightened validation rules, and a batch of image and database fixes.
Week of 2026-08-17
A busy 47-commit week delivered MariaDB vector search support, smarter file handling on fallback disks, and two patch releases.
Week of 2026-08-10
The framework gained a read-through filesystem, Queue::forward(), Guzzle 8 support, and stronger protection against loose-comparison validation bypasses.
Week of 2026-08-03
Image handling got major upgrades including HEIC dimension fixes and streaming support, alongside timeout improvements for notifications and jobs.
Week of 2026-07-27
A 61-commit week focused on PHP 8.5 readiness, faster validation for large arrays, and richer image capabilities like dominant color detection.
Over the past five weeks the Laravel framework team shipped a steady mix of new features and bug fixes, culminating in the v13.27.0 release. Major themes included hardening validation rules against security bypasses via loose comparisons, a brand-new read-through filesystem capability, new image handling tools, and significant queueing improvements like debounced jobs, Queue::forward(), and shared AWS credentials. Alongside features, there was continuous test cleanup, performance tuning, and preparation for PHP 8.5 compatibility.
Week by week
2026-08-24Version 13.27.0 shipped with a new Cloud facade, security-tightened validation rules, and a batch of image and database fixes.latest6 changes
Feature
New Cloud facade introduced
A new Cloud facade was added, giving developers a cleaner entry point to cloud-related functionality.
Fix
Validation rules hardened against loose-comparison tricks
The 'contains', 'doesnt_contain', and 'in_array' validation rules now use strict comparison so attackers can't sneak values past them with type-juggling.
Fix
Images from streams no longer fail on second read
Fixed a bug where an image created from a data stream would break if it was read more than once.
Feature
Cached AWS credentials shared across processes for SQS
SQS queue workers can now reuse cached AWS login credentials across processes instead of re-fetching them repeatedly.
Feature
Option to mask query bindings in error messages
Developers can now hide sensitive database query values (like passwords or tokens) from exception messages.
Chore
Release v13.27.0
The version number and changelog were bumped to ship all of this week's work as v13.27.0.
2026-08-17A busy 47-commit week delivered MariaDB vector search support, smarter file handling on fallback disks, and two patch releases.6 changes
Feature
MariaDB support for vector distance queries
Vector similarity searches now work on MariaDB databases in addition to other supported engines.
Fix
Files that only exist on a fallback disk can now be moved or copied
Read-through filesystem disks can now properly move or copy files that only live on their backup storage.
Fix
Redis mget/hmget no longer break on false returns
Guards were added so Redis batch-read commands handle unexpected 'false' responses gracefully instead of erroring.
Feature
New queue size-check methods
New 'allXSize' methods let developers check how many jobs are waiting across multiple queues at once.
Feature
orWhereKey and orWhereKeyNot added back
After an initial revert, these query-builder shortcuts returned with safer method signatures for combining key-based filters.
Chore
Releases v13.26.0 and v13.26.1
Two version bumps shipped during the week, including a quick follow-up patch that rolled back one feature.
2026-08-10The framework gained a read-through filesystem, Queue::forward(), Guzzle 8 support, and stronger protection against loose-comparison validation bypasses.6 changes
Feature
Read-through filesystem introduced
A new filesystem layer automatically falls back to a secondary disk when a file isn't found on the primary one, optionally caching copies locally.
Feature
Queue::forward() added
Jobs can now be forwarded from one queue to another with a single call, simplifying requeue workflows.
Feature
Guzzle 8 supported
The HTTP client now works with version 8 of the popular Guzzle library, keeping dependencies current.
Fix
'in' validation rule hardened against loose-comparison bypass
The 'in' rule was tightened so values can't slip through via PHP's loose type comparisons.
Feature
Debounceable queued listeners
Queued listeners can now be debounced so rapid-fire events collapse into a single job execution.
Fix
Paused queues now visible in worker output
The queue worker's console output now shows when queues are paused, making debugging easier.
2026-08-03Image handling got major upgrades including HEIC dimension fixes and streaming support, alongside timeout improvements for notifications and jobs.6 changes
Fix
Correct dimensions for HEIC images
Fixed incorrect width/height reporting when working with Apple's HEIC photo format.
Feature
Image::fromStream and public toFormat()
Images can now be created directly from data streams, and converting between formats became a publicly available method; images also became directly usable as HTTP responses.
Feature
Fail-on-timeout support for notifications
Notifications can now opt into being marked as failed when they run too long, matching existing job behavior.
Fix
Timeout recorded on timed-out jobs
Jobs that time out now correctly record which timeout value caused them to stop.
Fix
Enum keys fixed in typed cache
Using PHP enums as cache keys no longer causes type errors.
Chore
v12.65.0 release and minimum version bumps
The 12.x series picked up a release while 13.x raised its minimum dependency versions ahead of launch.
2026-07-27A 61-commit week focused on PHP 8.5 readiness, faster validation for large arrays, and richer image capabilities like dominant color detection.6 changes
Fix
PHP 8.5 deprecation warnings resolved
Several code paths were updated to avoid deprecation notices that PHP 8.5 raises for null array offsets.
Refactor
Validation no longer stalls on large arrays
Fixed a performance issue where validating big arrays could freeze requests for minutes at a time.
Feature
Dominant color detection in the image driver
The image system can now detect an image's dominant color, useful for generating placeholder backgrounds.
Feature
Expanded HEIC and AVIF image support
More variants of modern HEIC and AVIF image formats are now handled correctly.
Fix
Multibyte string fixes in Str::replace and Str::remove
Case-insensitive text replacement now works correctly for non-Latin characters like accented letters.
Fix
Appended accessors no longer receive null in toArray()
Custom model accessors included in array output no longer break when receiving unexpected null values.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required