Tailwind joins Shopify, Laravel MCP 1.0, Laravel Vet — A Day With Laravel #064

Laravel ecosystem news — September 16, 2026

EDITO

Hey Laravel artisans 👋

Back-to-school time, and we're returning with a packed issue! The biggest news may not come from Laravel itself: Tailwind Labs is joining Shopify, giving the CSS framework a stable home to keep growing. On the ecosystem side, laravel/mcp hits 1.0 and the brand-new Laravel Vet arrives to audit the code in your Composer dependencies before it lands in your vendor/.

And as always, the releases keep coming: Laravel 13.27 → 13.32, Livewire 4.4.5, Filament 5.8, PHP 8.6 around the corner… Personally, I have a soft spot for chunkBy(), which is going to simplify more than one of my CSV exports 😍

Happy reading and happy coding 💻

— Fred

P.S.: What do you think of the new newsletter banners?

P.S. 2: If you don't want to miss future news about the Laravel ecosystem, you can subscribe now!

🚀 Framework & Releases

Tailwind Labs is joining Shopify

Announced September 9, 2026 — Tailwind Blog

Big shake-up in the frontend ecosystem: Adam Wathan announced that Tailwind Labs is joining Shopify to give the framework "a stable long-term home."

Nothing changes for open source: Tailwind CSS (and Headless UI, Heroicons…) stays MIT-licensed, still maintained by the same team with Shopify's support.

The only concrete consequence is on the business side — sign-ups for Tailwind Plus and ui.sh are closed to new customers (existing subscribers keep their access) to focus on the framework. Shopify has used Tailwind at scale since early on and wants to lean on that work for its storefronts and "agentic commerce."

» Read the announcement

Laravel 13.27 → 13.32 — The back-to-school batch

Released August 25 – September 15, 2026

The framework shipped a run of minor releases over the summer. Highlights: refreshForUpdate() on Eloquent models and the return of orWhereKey()/orWhereKeyNot() (13.27), the AsVector cast and vector distance queries on MariaDB (13.28), totalSize()/totalXSize() on the Queue plus the new JobInterrupted event (13.31), and finally the Mercure broadcast driver alongside copyToDisk()/moveToDisk() on the Filesystem (13.32).

13.30 also brings the read-through filesystem (migrate between storage disks without downtime), semantic search in Scout (Turbopuffer, ->semantic(), ->hybrid()), and the Cloud facade. On the fix side: plenty of Redis/SQL Server hardening and a pass over validation edge cases.

» View release 13.32.0

Livewire v4.4.5 — View transitions wire:navigate and JSON sessions

Released September 14, 2026

The 4.4 branch keeps getting stronger: v4.4.5 backports JSON session serialization support and view transitions wire:navigate.

For developer comfort, it also adds custom x-cloak variants ([x-cloak="x-cloak"]), minute durations for wire:poll, continuous visibility timing for wire:intersect, and better island and lazy-loading handling.

Be careful, Livewire 4.4.5 requires Alpine 3.17.3.

» View release note

📦 Packages & Plugins

Laravel MCP 1.0 — The protocol for your AI tool servers

Published September 15, 2026 — Laravel News

The official package for building Model Context Protocol servers reaches 1.0.

On board: support for protocol revision 2026-07-28, stateless servers (each request handled independently), searchable tool catalogs (search_tools/execute_tools to expose only the tools the model needs — the tools/list payload stays at ~1,431 bytes whether the catalog holds 10 or 100 tools), cache hints to tell clients what they can reuse, and a reworked OAuth that now requires PKCE and adds Client ID Metadata Documents. Clients still using initialize keep working.

» Read the article

Laravel Vet — Review Composer code before it installs

Published September 15, 2026 — Laravel News

A new first-party arrival: Laravel Vet is a Composer plugin that shows the code composer update is about to write into vendor/, and records the packages you trust in a committed vet.json.

The idea (borrowed from Rust's cargo vet): every update brings code nobody has read. Vet walks you through it package by package, and can hand the review to your coding agent (Claude Code, Codex, Gemini, opencode), which answers PASS, FAIL (with the file and reason) or WARN.

An untrusted package makes the command exit non-zero — perfect as a CI gate. Requires PHP 8.4+, still in beta.

» Read the article

Filament v5.8 — Deferred schema loading and persisted grouping

Published September 7, 2026

Filament ships 5.8 (and 4.13 on the previous branch) with two headline changes: deferred schema loading for forms (components load on demand) and table grouping persisted in the user's session.

Also included: trait-named lifecycle hooks on pages and importers, a direction argument on defaultGroup(), empty-state behavior for Stats, and minHeight()/maxHeight() on RichEditor.

The 5.8.1/5.8.2 patches followed with fixes (TableSelect, enum casts, rich editor).

» View release note

📘 Articles & Tutorials

PHP 8.6 — What's coming on November 19

Published September 15, 2026 — Laravel News

PHP 8.6 lands on November 19, 2026 (feature freeze on September 22).

On the menu: the long-awaited partial function application (str_replace(' ', '-', ?)), the clamp() function, a nanosecond-precision Time\Duration class, default values on readonly properties, DocComments directly on parameters, a new polling API (Io\Poll), a global SortDirection enum, and safer session defaults.

» Read the article

🎥 Videos & Talks

Laracasts — Practical Progressive Web Apps

Published August 18, 2026 — Laracasts

For those of you here who subscribe to Laracasts, a new 20-episode (~5 hour) series on turning a Laravel app into a robust PWA, built for field workers on unreliable connections: service workers, dynamic precache, IndexedDB, offline notifications, and an Alpine store around navigator.onLine.

» Watch the series

If you haven’t subscribed yet, you can do so via my affiliate link.

🔧 Tips & Tricks

chunkBy() to group adjacent items

Laravel 13.30 — Laravel News

Laravel 13.30 adds chunkBy() to collections and lazy collections: a shorthand for the most common chunkWhile() use case. Where you used to write $items->chunkWhile(fn ($v, $k, $chunk) => $v->order_id == $chunk->last()->order_id), you now write $items->chunkBy('order_id'). Careful: it groups adjacent items (unlike groupBy()), and it streams over a cursor() — ideal for exporting millions of rows without loading everything into memory.

LineItem::query()
    ->orderBy('order_id')->orderBy('id')
    ->cursor()
    ->chunkBy('order_id')
    ->each(fn ($items) => Storage::disk('exports')->put(
        "orders/{$items->first()->order_id}.csv",
        $items->map(fn ($i) => "{$i->sku},{$i->quantity},{$i->unit_price}")->implode(PHP_EOL)
    ));

» Read the article

🛡️ Security

Security roundup — Socialite, Laravel Excel, and masking SQL bindings

August–September 2026

Three fixes not to miss:

Socialite — an auth bypass on the Facebook provider via OIDC nonce replay (CVE-2026-73683, CVSS 9.2), fixed in 5.29.0;

Laravel Excel (maatwebsite/excel) — arbitrary file overwrite through path traversal in Disk::copy() (CVE-2026-84374, CVSS 7.5), fixed in 3.1.70;

and Filament — reuse of a still-valid TOTP MFA code (CVE-2026-84306), fixed in 4.12.6/5.7.6. While we're on data: Laravel 13.27 adds mask_bindings_in_exception_messages (per connection, enabled via DB_MASK_BINDINGS=true) to keep emails, names, and tokens out of your logs, failed_jobs table, and APM traces.

» Socialite advisory · Laravel Excel advisory · Masking bindings

🌐 Community

Taylor disables GitHub Issues and State of Laravel 2026 opens

Published September 4, 2026 — Laravel News

Taylor Otwell disabled GitHub Issues on most Laravel packages: "If you hit a bug, describe it to a coding agent and open a PR." The main laravel/framework repo is unaffected. The move sparked plenty of debate — especially as other PHP projects are going the opposite way.

Meanwhile, the State of Laravel 2026 survey (6th edition, by Tobias Petry) is open: profile, stack, tooling, AI, production, and opinions.

» Read the article · Take the survey

🛠️ Tools & Services

Laravel Cloud & Forge — What shipped in August

Published September 3, 2026 — Laravel Blog

The monthly Laravel product roundup.

Cloud: managed queues rebuilt with Flex/Pro compute classes and FIFO (exactly-once, in-order delivery), pre-deploy package checks that read your composer.lock before deploying, API tokens scoped per permission/application, and Private Cloud now HIPAA-compliant (BAA + dedicated, audited infrastructure).

Forge: multiple source control accounts per provider, Ubuntu 26.04 LTS, in-app notifications, and Brotli compression on new servers.

» Read the roundup · Private Cloud & HIPAA

This newsletter needs your support 🙏

If you’ve found this newsletter useful, I’d be more than happy if you could pop a small coin into my piggy bank (ko-fi or PayPal)

Any other ways to support me? Of course!

• Your next Amazon order via my affiliate link
• Subscribe to Laracasts, the go-to resource for Laravel
• Subscribe to OpenCode Go for 5$ and get extra 5$ with my referral link
• I use Starlink at home and I’m more than happy with it. If you’re interested, let’s both enjoy a free month

The objective of this newsletter?

🎯 Regularly deliver to you, recent or important resources (videos, articles, GitHub repositories, packages, tutorials, ...) that I could find on Laravel and its ecosystem.

See you soon for the next edition. If you haven't already done so, subscribe!