Laravel Release Notes

Pull request by @dwightwatson

Cloudflare's Email Service joins the list of first-class mailers in Laravel. Drop your credentials into config/services.php:

'cloudflare' => [
    'account_id' => env('CLOUDFLARE_ACCOUNT_ID'),
    'token' => env('CLOUDFLARE_TOKEN'),
],

Then point your mailer at it and send like usual. Same Symfony HTTP Client setup the existing transports use, so there's nothing new to learn.

Pull request by @timmylindh

If you've ever fought a CROSSSLOT error on AWS ElastiCache Serverless or any Redis Cluster setup, this one is for you. Laravel's Redis queue and ConcurrencyLimiter now wrap queue names in hash tags automatically when they detect a cluster connection, so all related keys land on the same slot:

queues:{default}            -> slot for "default"
queues:{default}:delayed    -> slot for "default"
queues:{default}:reserved   -> slot for "default"
queues:{default}:notify     -> slot for "default"

Different queues still distribute across the cluster, the same pattern Sidekiq and BullMQ use. The PhpRedis cluster connector also picks up ACL auth and retry/backoff parity with standalone connections, which matters during ElastiCache scaling events. Standalone users see zero change. The full breakdown is in the queue documentation.

Pull request by @jackbayliss

Three new methods on the Queue facade let you peek at what is actually sitting on your queues without reaching for DB::table() and decoding payloads by hand:

Queue::pendingJobs();
Queue::delayedJobs();
Queue::reservedJobs();

Each returns a collection of InspectedJob instances exposing the uuid, job name, attempts, and creation time. That opens up some genuinely useful patterns:

Queue::reservedJobs('high-priority-queue')->first()->name;
// => 'App\Jobs\SendEmail'

Queue::pendingJobs()->countBy('name');
// => ['App\Jobs\SendEmail' => 1842, 'App\Jobs\ProcessOrder' => 43]

Perfect for deployment scripts that need to wait for specific jobs to finish, dashboards, and ad-hoc debugging. Works with the Redis and Database drivers; other drivers return an empty collection.

Pull request by @NurullahDemirel

Strict mode lands in form requests, mirroring the spirit of Model::shouldBeStrict(). Flip it on in your AppServiceProvider and any incoming field that isn't declared in rules() will fail validation instead of silently slipping through:

use Illuminate\Foundation\Http\FormRequest;

public function boot(): void
{
    FormRequest::failOnUnknownFields(! app()->isProduction());
}

Need to opt a single request out (say, a public webhook with unpredictable payloads)? Set the property on the class:

class PublicWebhookRequest extends FormRequest
{
    protected ?bool $failOnUnknownFields = false;

    public function rules(): array { /* ... */ }
}

It's fully backward compatible, off by default, and a great safety net during development. Learn more in the validation documentation.

Pull request by @me-shaon

Wondering what skills are actually available in your project? A new Artisan command shows you:

php artisan boost:skill-list

You get a clean table of skill names alongside their source (the package they came from, or local if it's yours), with custom skills called out so they're easy to spot. Pass --json for machine-readable output if you're scripting around it:

[
    {
        "name": "livewire-development",
        "description": "Build dynamic interfaces using Livewire",
        "package": "livewire/livewire",
        "custom": false
    },
    {
        "name": "my-custom-skill",
        "description": "A custom skill for my project",
        "package": "user",
        "custom": true
    }
]

Pull request by @joetannenbaum

Svelte 5 developers can now use Laravel Echo with the same ergonomics React and Vue have enjoyed. The new useEcho rune lets you subscribe to channels and react to events with full reactivity:

<script>
    import { useEcho } from '@laravel/echo-svelte';

    const { channel } = useEcho('orders', 'OrderShipped', (e) => {
        console.log(e.order);
    });
</script>

Real-time features in Svelte are now a single import away.

Pull request by @pushpak1300

MCP tools were text-only until now. With MCP UI App support, a tool can render a self-contained HTML app inside a sandboxed iframe in the host. Scaffold one with a single command:

php artisan make:mcp-app-resource DashboardApp

The default handle() auto-infers the Blade view from the class name, so the PHP side stays minimal:

class DashboardApp extends AppResource
{
    public function handle(Request $request): Response
    {
        return Response::view('mcp.dashboard-app', [
            'title' => $this->title(),
        ]);
    }
}

The view is the entire app, HTML, JS, and CSS in one file with the bundled SDK already inlined:

<x-mcp::app title="Dashboard">
    <x-slot:head>
        <script type="module">
            createMcpApp(async (app) => {
                const result = await app.callTool('get-data');
                document.getElementById('output').textContent = result.content[0]?.text;
            });
        </script>
    </x-slot>
    <div id="output"></div>
</x-mcp::app>

Link a tool to the app with the #[RendersApp] attribute, optionally hiding helper tools from the model so only the UI can call them. No npm, no Vite, just Blade.

Laravel now ships a full passkey story instead of asking you to assemble WebAuthn by hand.

Pull request by @nunomaduro

When agents run Pint alongside other tooling, consistent output matters. Pint's agent reporter now mirrors the PAO format, adding a tool key and using passed instead of pass:

{"tool":"pint","result":"passed"}
{"tool":"phpstan","result":"passed","errors":0}
{"tool":"pest","result":"passed","tests":52,"passed":52,"assertions":90,"duration_ms":534}

Small change, much easier to parse in agent workflows.

Pull request by @N1ebieski

The VS Code extension now understands Laravel 13's new attributes. You get autocompletion, hover tooltips, navigation, and diagnostics for routing attributes like Authorize, Middleware, and RedirectToRoute, plus model attributes like Fillable, Guarded, Hidden, Visible, and Appends. Writing controllers and Eloquent models with attributes feels just as smooth as the array syntax did.