Find published research by company, product, platform or technology.
Showing 1–7 of 7 dossiers
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
The change moves maintenance work earlier in the contribution funnel: instead of filing a report and waiting for a maintainer to reproduce it, package users are being asked to arrive with an executable patch candidate. It is a real workflow experiment, but Otwell's prediction that this becomes the norm should remain a founder/maintainer view rather than an industry fact.
HIPAA support moves Laravel Cloud into a class of regulated workloads that shared application hosting could not safely claim. Private Cloud supplies dedicated tenancy, encryption, SSO/SAML, backups and a BAA path, while application-level access control, audit logging and PHI handling remain the developer’s responsibility.
Laravel now has a framework-native approval flow for AI tools: approvable tools can pause an agent, surface arguments and reasons, then resume the same persisted conversation after a human decision.
Inertia.js 3.9 flushes prefetch entries when history is cleared, preventing a previously visited protected page from reappearing from client cache after logout.