Gates vs. Policies vs. Middleware: Understanding Laravel's Authorization Layers

Three different tools all answer "is this allowed?" in Laravel. Understanding why each exists keeps authorization logic from sprawling.

A new grant-funded team at the PHP Foundation is scanning the most-downloaded Composer packages for vulnerabilities using AI-assisted tooling.

Laravel 13.22.0 landed with QueueFake testing helpers, fewer cache hits when debouncing, and internal Stringable adoption.

Tag articles, products, and anything else through a single reusable table using a polymorphic many-to-many relationship.

Stop stuffing regex into strings. Build reusable, testable validation rules with invokable Rule objects and closures.

Calling ->get() on a giant table loads every row into memory at once. Laravel gives you chunk, chunkById, cursor, and lazy to process big result sets safely.

Who changed this record, and when? Build a reusable audit trail using Eloquent observers so every create, update, and delete is logged automatically.

Laravel Cloud now deploys fully managed Symfony applications with no code changes, detecting the framework from composer.json and configuring the runtime for you.

Laracon US came back for its 2026 edition on July 28 and 29, at the SoWa Power Station in Boston's arts district. Two days, one stage, and a lineup of eighteen speakers that ranged from Taylor Otwell himself down to independent educators, package authors, and engineers visiting from outside the Laravel world entirely. If you couldn't make it to Boston, or you were there and want the announcements in one place without re-watching eight hours of stream, here's what actually happened on stage.