Laravel Release Notes

Pull request by @LucasCavalheri

MailMessage in notifications now has attachFromStorage() and attachFromStorageDisk() methods, matching what Mailable has offered for a while. Attach invoices, reports, or any file from your storage layer without having to read the contents yourself first.

(new MailMessage)
    ->attachFromStorage('invoices/1.pdf')
    ->attachFromStorageDisk('s3', 'invoices/1.pdf', 'Invoice.pdf', [
        'mime' => 'application/pdf',
    ]);

Pull request by @pushpak1300

Illuminate\JsonSchema can now represent multi-type union schemas - schemas where the type field is an array like ['string', 'number', 'boolean']. This comes up frequently with third-party MCP tool schemas where mixed types are common. Previously these would throw an exception; now they deserialize, serialize, and round-trip correctly.

// Now works where it used to throw
JsonSchema::fromArray(['type' => ['string', 'number', 'boolean']]);

// Or build one directly
JsonSchema::union(['string', 'number'])->nullable();

Pull request by @hotmeteor

All-uppercase strings like CBOR or ALL_CAPS now have a path through Str::studly() and Str::pascal() that produces the expected output. Pass normalize: true and any fully-uppercased word segment gets lowercased before conversion - mixed-case strings are left alone as before.

Str::studly('CBOR', normalize: true)      // 'Cbor'
Str::studly('ALL_CAPS', normalize: true)  // 'AllCaps'
Str::studly('AllJersey', normalize: true) // 'AllJersey' (unchanged)

Pull request by @stevebauman

The HTTP client's Request object now has a uri() method that returns an Illuminate\Support\Uri instance, consistent with the uri() method already available on Illuminate\Http\Request. This makes Http::assertSent() callbacks a lot cleaner when you need to inspect the URL.

Http::assertSent(function (Request $request) {
    return $request->uri()->path() === '/api/users'
        && $request->uri()->query()->integer('page') === 2;
});

Pull request by @hectorgrecco

All three Echo framework adapters now ship a useSocketId() reactive hook that gives you the current socket ID and automatically updates when the connection reconnects with a new one. Pass it in an X-Socket-Id header to prevent your own broadcast events from being received back.

// React
import { useSocketId } from "@laravel/echo-react";
const socketId = useSocketId();

// Vue
import { useSocketId } from "@laravel/echo-vue";
const socketId = useSocketId(); // ComputedRef<string | undefined>

// Svelte
import { useSocketId } from "@laravel/echo-svelte";
const socketId = useSocketId(); // getter function

Pull request by @sydgren

Installing extra PHP extensions in Sail no longer requires publishing and hand-editing the Dockerfile. Pass a PHP_EXTENSIONS build argument in docker-compose.yml with a space-separated list of extensions, and Sail's Dockerfile will install them at build time.

services:
    laravel.test:
        build:
            context: ./vendor/laravel/sail/runtimes/8.4
            dockerfile: Dockerfile
            args:
                WWWGROUP: "${WWWGROUP}"
                PHP_EXTENSIONS: "gmp imagick"

Existing builds are unaffected - the argument defaults to empty.

Pull request by @imliam

Password managers like 1Password and Safari can read the passwordrules HTML attribute to generate passwords that satisfy your app's policy - no more rejected passwords and frustrated users at registration. The new toPasswordRulesString() method on the Password rule converts your validation constraints into the right format automatically.

<input
    type="password"
    autocomplete="new-password"
    passwordrules="{{ Password::defaults()->toPasswordRulesString() }}"
/>

The method maps directly from your existing validation rules:

Password::min(12)->max(64)->mixedCase()->numbers()->symbols()->toPasswordRulesString()
// 'minlength: 12; maxlength: 64; required: lower; required: upper; required: digit; required: special;'

Pull request by @hotmeteor

All-caps strings like CBOR or ALL_CAPS used to pass through Str::studly() unchanged - ucfirst has nothing to do when every letter is already uppercase. An optional normalize: true parameter lowercases all-uppercase word segments before conversion, giving you the expected output.

Str::studly('CBOR', normalize: true)      // 'Cbor'
Str::studly('ALL_CAPS', normalize: true)  // 'AllCaps'

Mixed-case strings are left untouched, and the default is false so existing behavior is preserved.

Pull request by @pascalbaljet

When a polled request takes longer than the configured interval, subsequent requests can pile up on the server. A new mode option on router.poll() and usePoll gives you control over how overlapping requests are handled - cancel aborts any in-flight request before starting the next, rest waits the full interval after each response so requests never overlap, and overlap preserves the existing behavior.

router.poll(2000, {}, { mode: "cancel" });
router.poll(2000, {}, { mode: "rest" });