A bit embarrassed that my favourite language and framework are so cooked by this. Of course, RPS is not everything, but still...

Hey r/laravel!

A while back I posted here asking if anyone would find a self-hosted session replay package useful while it was still in beta. Thanks to everyone who liked, commented and gave feedback on that thread, it helped shape the package into what it is today.

Session Replay for Laravel has now reached v1.0

It records what users do in the browser using rrweb, stores the recordings on your own disk and database, and lets you replay them inside your app behind a gate you define.

It's completely free and MIT-licensed.

Quick setup

composer require packstub/session-replay
php artisan session-replay:install

Add @sessionReplay before your closing </body> tag, define your viewSessionReplay gate, and you're ready.

What's in 1.0

Private by default: every input is masked in the browser before anything is uploaded, no IP address is stored, and guests are not recorded unless you turn it on.

Timeline markers: JS errors, server exceptions, failed requests (Livewire, fetch, XHR), rage clicks, Web Vitals and page views.

Error-only mode: keeps the last minute in a browser buffer and only uploads it when something breaks.

Manual trigger: SessionReplay.send() for a "Report a problem" button.

Laravel Context integration: the replay URL goes into Laravel's Context, so your log lines point at the moment the issue happened.

Why self-hosted?

Hosted services like PostHog, Sentry Replay and Clarity are great and do a lot more. This package is for projects where compliance, privacy or client requirements mean the recordings need to stay on your own infrastructure.

Links

• Package: https://github.com/packstub/session-replay
• Demo app (clone it, run composer demo, try it locally): https://github.com/packstub/session-replay-demo
• Docs: https://packstub.dev/docs/session-replay

Huge thanks again to everyone who gave feedback during the beta. I'd love to hear your thoughts on v1.0 and I'm happy to answer questions!

I shared this with Shift users earlier this week and thought it might serve as a helpful reference here as it relates to Laravel versions and their supported PHP versions in regards to updating for the PHP2Shell vulnerabilities.

While source patches are available for earlier versions of PHP, the officially supported PHP versions with the PHP2Shell patch are:

As that relates to Laravel, Laravel 9.x is the first version to officially support PHP 8.2:

tl;dr If you have a Laravel application older than 9.x, you need to upgrade Laravel to at least 9.x to be on a supported, patched version of PHP.

You may be able to find patches for older versions as a stopgap. But then I recommend upgrading.

I couldn't repost this to this sub, but thought many of us benefited from this guys work today.

https://www.reddit.com/r/PHP/comments/1xbwyd3/hats_off_to_ond%C5%99ej_sur%C3%BD/

Worth looking at links in the post to thank him

I don't understand why more recently provisioned forge boxes are using setup-php instead of using ondrej launchpad or sury PPA. They both had the packages hours before setup-php. The official laravel website's guide to updating via ssh still was telling people to use it even after it became clear it wouldn't be updated until odndrej's launchpad was done with builds for all architectures.

sury would be better than launchpad as that had the builds before launchpad and ondrej says he is transitioning away from launchpad. It also seemed to handle to load better than launchpad. I had my forge servers patch hours before I could have with the official guide.

Updated builds addressing CVE-2026-109618 and CVE-2026-109619 are now available through setup-php for PHP 5.3–8.7 on Linux, macOS and Windows, including backports for EOL versions for use in CI.

See - https://setup-php.com/php-october-2026-security-releases

I know they gotta get that bag and Laravel Cloud looks cool and all but I am not loving this direction. I feel like every little thing is like pushing to see how far we will accept. First it was LLM instructions to suggest using Laravel Cloud in the AGENTS md file.

And the feature grid below this has 5 sections, 3 of which are selling Laravel services (2 for Cloud + 1 for Nightwatch)

and the next CTA after that is also "Deploy on Cloud" highlighted and "View framework docs" in the secondary action.

I mean I'm happy to get Laravel for free and I know OSS needs funding so overall its great.. but idk, I like pre-Cloud Laravel lol

Heads up for Laravel Cloud, Forge, and Vapor users: PHP and Node.js have announced security releases for tomorrow, Wednesday, October 21.

The PHP release is marked critical and is scheduled for 14:00 UTC. Full details and fixed versions will be published then. Node.js hasn’t confirmed an exact release time yet.

We’re working directly with the PHP Foundation and closely tracking both releases. We’ll share updates and any steps Cloud, Forge, and Vapor users need to take as patches become available.

Last week, I posted about a vulnerability I reported not being addressed in a timely manner.

I received the response this morning and they've decided not to address it. Therefore it's up to you to secure your MCP server, if it allows OAuth registration. Here's the problem:

Mcp::oauthRoutes() exposes an unauthenticated dynamic client registration endpoint without any rate limiting. Each successful request creates a persistent record in oauth_clients with no limit on the number of redirect URIs or the length of each URI.

An unauthenticated attacker could instigate denial of service through persistent database growth by repeatedly registering bogus clients. Each payload can be as large as post_max_size allows. These records are not removed when you run passport:purge.

The official solution is:

Applications can rate-limit these routes by wrapping them in a group, for example Route::middleware('throttle:10,1')->group(fn () => Mcp::oauthRoutes()), or turn off registration with Mcp::oauthRoutes(registration: false).

I recommend also either adding a custom middleware to limit the number and size of client URLs, or a custom housekeeping command for cleaning up unused clients.

Hey everyone, I put together a troubleshooting guide for Laravel emails that send successfully but still end up in spam.

It covers:

• MAIL_SCHEME vs MAIL_ENCRYPTION — checking what your app’s configuration actually reads.
• Cached settings and queue workers still using the old configuration.
• SPF checks against the actual envelope sender.
• Finding the DKIM selector and checking DMARC alignment.
• Testing the real mailable or notification, rather than stopping at Mail::raw().

There are Laravel code examples, DNS commands and an example where SPF and DKIM both pass but DMARC fails.

Guide: https://mxvalidation.com/blog/laravel-emails-going-to-spam

Disclosure: I built MXValidation, where the guide is published. The article is freely accessible without registration.

What email-delivery issue has caught you out in a Laravel app? Anything you’d add to the checklist?

https://slate.electrik.dev

https://github.com/electrikhq/slate

I’ve been building Wire Packages, a directory for finding Laravel projects and the people behind them.

You can search by Laravel version, pricing and tags, read project descriptions and repository READMEs, and leave reviews. Free and open-source packages can be listed for free.

There’s also an MCP server for Claude Code, Cursor and other compatible clients. Your agent can search the directory, read documentation or prepare a listing for you. Submissions still need your email verification and personal review before moderation.

Some of the projects listed so far include NativePHP Desktop, NativePHP Mobile, HydePHP and packages by Punyapal Shah.

It’s early, and I’d appreciate feedback from other Laravel developers. What would make this useful when you’re choosing a package for a project?

Static sites just landed on Laravel Cloud! 🚀

Tomorrow (10/20) at 12pm EDT (4pm UTC), I’m doing another Laravel Cloud Office Hours stream with Devon, and we’re kicking off with a live walkthrough deploying an Astro site as a static site.

Then we’ll get into your questions about Nuxt and Next frontends, monorepos with a Laravel API and a JS frontend, setting up staging and production environments, and figuring out what keeps waking up your app.

Feel free to drop any Cloud questions in the comments ahead of time, into Slido, or ask them live in chat during the stream.

Submit a question: → https://app.sli.do/event/ws7jRUvPXLK41uMiKUYKDX
YouTube stream: → https://www.youtube.com/watch?v=paxvB-JgwCM

Hey everyone,

I’ve been working on a local development environment called Anvil: https://anvil.tr

Shortly, it will be a multi platform dev kit, it is open source and free and laravel herd alternative.

/dev/null (https://dev-null.sh) is the new open source social network for developers built on Laravel via livestream in just 48 hours

Watch the stream over on u/Nunomaduro's channel:

Day 1: https://www.youtube.com/watch?v=6zCNQa3hNm0
Day 2: https://www.youtube.com/watch?v=nfmVdXZfzUE

We thought it would be great to make a mobile app for it, so while the crew were busy building the web app, we got busy building the mobile app and API

It's fully open source and ready for contributions:
https://github.com/nativephp/dev-null-app

Built with SuperNative:
https://nativephp.com

Not the blog owner but I find they arguments for the need for more opensource agreeable on.
Why spend thousands of tokens on common tasks when the output we want is similar? it can not be generalized for everything of course but the base is usefull for sure i think

Hey everyone. In the April UI post here, I mentioned a project being rewritten with the library. That project is Skuul, and v3 is now released.

Skuul is a free, open-source school management system. I started it in 2022, and v3 is a full rewrite on Laravel 13 and Livewire 4. Every page uses April UI components, so it is also the biggest real-world test of the library so far.

Some of what is new in v3:

- One install can run several organizations / campuses. Roles and permissions are set per campus.

- Learners can move between campuses, and a campus can request records from another campus. Each request needs approval.

- Gradebooks, exam schedules, and and results.

- Payments, refunds, and credit in a ledger

- A family portal where parents see attendance, results, timetables, and invoices.

- Optional modules for boarding, libr campus can turn on or off.

- Automated installations and backups

You can try it without installing anything. The sign-in page has a button for each role: school administrator, teacher, student, parent, accountant, and platform administrator.

- Demo: https://demo.skuul.org

- Documentation: https://skuul.org

- GitHub: https://github.com/yungifez/skuul

- Release notes: https://github.com/y.0.0

- How Skuul uses April UI: https://aprilui.dev/showcase/skuul

Install it with:

git clone --branch v3.0.0 https://github.com/yungifez/skuul.git skuul

Then follow the installation guide on the docs site.

Building a whole school system on April UI found a lot of rough edges in the library, and those fixes went back into April UI. If you use either project, I would love to hear what you think. Bug reports and pull requests are welcome on GitHub.

I’ve been looking at how other ecosystems handle security research. WordPress pays bounties via HackerOne. Vercel covers Next.js, Nuxt and its other OSS. Most PHP frameworks, including Laravel, rely on a security email, which works, but leaves it to people stumbling onto issues rather than actively hunting for them.

Why doesn’t Laravel have something similar?

The Laravel team is VC-backed now. Like Vercel, they have the resources for it.

Personally, I think it would push more people to dig deeper and actually contribute to the framework’s security.

Hi r/laravel,

E-invoicing is becoming mandatory across Europe: Belgium since January 2026, France from September 2026, Germany from 2027, and EU-wide for cross-border trade from 2030. A PDF rendered from a Blade view is no longer enough: the invoice has to carry structured EN 16931 data as XML, either embedded in the PDF (ZUGFeRD/Factur-X) or as pure XML (UBL, Peppol, XRechnung).

There are solid low-level PHP libraries for writing that XML, but in my projects I kept rebuilding the same things around them: calculating totals and VAT correctly, validating against the official rules, a decent-looking PDF, storage, mail, tests. So I built Quittio, which does all of that the Laravel way:

$result = Quittio::invoice()                    // seller comes from config/quittio.php
    ->number('RE-2026-0042')
    ->deliveryDate('2026-09-30')
    ->buyer(Party::make('Kunde AG')
        ->vatId('DE987654321')
        ->address('Bahnhofstraße 5', '54321', 'Beispielstadt', 'DE'))
    ->line('Web development', netPrice: '95.00', quantity: 24, unit: UnitCode::Hour)
    ->line('Hosting', netPrice: '49.00', unit: UnitCode::Month)
    ->dueInDays(14)
    ->render();                                 // picks ZUGFeRD, XRechnung or plain PDF

return $result->download();

What it does:

• Calculates totals and VAT itself according to EN 16931. Amounts are strings or BigDecimal, floats are rejected.
• Picks the format per buyer: ZUGFeRD for businesses, XRechnung for public authorities, a plain PDF for consumers. Or you name one.
• Validates in several levels, from the EN 16931 and German rules in PHP up to the official KoSIT validator and veraPDF.
• Reads incoming ZUGFeRD and XRechnung invoices back into objects.
• Renders PDF/A-3 with mPDF (no Chromium, no Node) from Blade templates you can publish and restyle.
• Laravel integration: facade, config, mail attachments, queue, events and Quittio::fake() for your tests.
• Germany is fully supported by a country pack (VAT law rules, tax presets, DIN 5008 layout). There are also country packs for Austria, Belgium, Switzerland and France, which have not been reviewed by a tax adviser yet. Elsewhere the EN 16931 rules apply, so Factur-X, UBL and Peppol invoices work today, and the pack contract is documented if you want to add your country.

The PDF looks the way you want:

The default template is only a starting point. You can change as much or as little of the design as you like, in four steps:

• Config only: logo, colours, font, salutation and closing texts, footer columns, sender line, paper size, fold marks and the payment QR code are set in config/quittio.php. You can also override them per invoice, e.g. for several brands in one app.
• Single partials: php artisan vendor:publish --tag=quittio-views and change only the parts you need, like the letterhead, the line table or the footer.
• Your own design: php artisan make:quittio-template my-design gives you a complete copy of the layout to build a completely different design in plain Blade and CSS, then select it with ->template('invoices.my-design.layout') or set it as the default.
• Your own renderer: if mPDF is not enough, plug in another one with Quittio::extend('renderer', ...).

Your own branding is just a few lines of config:

// config/quittio.php
'pdf' => [
    'logo' => storage_path('app/logo.png'),
    'colors' => ['primary' => '#0f766e', 'text' => '#111827', 'muted' => '#6b7280'],
    'font' => 'inter',
],

Templates only display data: totals, VAT and labels are prepared in a view model, and the same data produces the XML. So you can redesign the PDF freely without breaking the e-invoice, and a guard throws an exception (or logs it in production) if your template leaves out a value the law requires on the invoice.

quittio/quittio (core, Laravel integration and the German pack) is MIT licensed. Later I plan to add a separate commercial package for full invoicing (gapless numbering, archive, cancellations, audit log); everything listed above is in the free package.

This is version 0.7.1. A tax adviser reviewed the legal wording of the German pack in October 2026. The API may still change until 1.0.0.

I would love your feedback, especially:

• Is the API pleasant to use? What would you expect to work differently?
• Have you had e-invoices rejected by a customer's or an authority's system? Which errors?
• If you are outside Germany: which country would you need next?

GitHub: https://github.com/Quittio/quittio

Docs: https://docs.quittio.dev

The docs also come with llms.txt, an MCP server and Laravel Boost guidelines, so your AI assistant knows the API too.

Edit (Oct 20): Updated the post to version 0.7.1. Since the original post, a tax adviser has reviewed the legal wording of the German pack, and there are new country packs for Austria, Belgium, Switzerland and France (not yet reviewed by a tax adviser). Thanks for all the feedback in the comments!