October 2026 Laravel updates

October 2026 added features for controlling how requests are expressed, where database reads go, and how schedules run across multiple servers. Laravel Cloud made sending mail and configuring scheduled commands simpler, and Forge made PHP security updates and provisioning failures easier to track. This page is a monthly record based on the official blog post “Laravel October Product Updates” published on November 4 and the October entries of the official Framework changelog. The primary sources were checked on November 7, 2026, and the Framework section covers Laravel 13 only. Releases from November are not included. Sources:

Laravel Framework

Releases in October

In addition to the main features in the official changelog, the dates and versions below were checked against the release notes.

Release	Published	Main changes
v13.35.0	October 6	Property assertions for fakes, worker memory as a percentage, Markdown responses, `alwaysOnOneServer()`, QUERY routes.
v13.36.0	October 13	OLAP execution on Vitess, builders for existing validation rules.
v13.37.0	October 16	A strict option for `Rule::numeric()`, a fix for the race when `onOneServer()` and `withoutOverlapping()` are combined.
v13.38.0	October 20	`PreventStaleDatabaseReads`, `Connection::usingWritePdo()`.
v13.39.0	October 27	`RefreshDatabase` rolls back every transaction level after a test, a fix for `assertSeeText('0')` passing incorrectly.

The sections below cover the nine items listed in the official changelog. For minor fixes and dependency changes, see each release note.

Defining searches with a request body using QUERY routes

v13.35.0 added Route::query(), which supports the HTTP QUERY method. You can define routes that receive search conditions in the request body instead of the GET query string.

use App\Http\Controllers\SearchProductsController;
use Illuminate\Support\Facades\Route;

Route::query('/products/search', SearchProductsController::class);

Route::any() also matches QUERY requests, and the route list recognizes the method. The SearchProductsController above stands for an invokable controller in your application that implements the search.

QUERY routes in the web middleware group are subject to CSRF verification. Don’t assume you can skip verification because it is a search like GET. Send the CSRF token.

Primary sources: Register QUERY Routes, Laravel 13 official routing.md. Related pages: Routing, CSRF protection

Avoiding stale reads in later requests after a write

With a read/write split database, a read right after an update can go to a read replica that has not synced yet. The existing sticky option only covers the same request. The PreventStaleDatabaseReads middleware added in v13.38.0 also protects later requests in the same session for a set period. In bootstrap/app.php, import Illuminate\Foundation\Http\Middleware\PreventStaleDatabaseReads and add it inside the withMiddleware() callback with $middleware->web(append: [PreventStaleDatabaseReads::class]);. It is not enabled automatically. The middleware records the time of writes to the default database connection in the session. By default, it sends reads on that connection to the write database for 2 seconds after a write. You can change the period by registering PreventStaleDatabaseReads::for(5) or similar instead of the class. Because it uses the session, it must run after StartSession. It does not switch reads for other sessions or other database connections, and it does not detect when the replica has finished syncing. Primary sources: Avoid Stale Reads After Database Writes, Laravel 13 official database.md. Related pages: Database, Session

Reading from the write database for specific operations only

Connection::usingWritePdo(), also added in v13.38.0, switches reads on that connection to the write database only while the callback runs. Use it when you want your application to mark exactly which reads are critical, rather than protecting a whole session.

use Illuminate\Support\Facades\DB;

$users = DB::connection()->usingWritePdo(
    fn ($connection) => $connection->table('users')->get()
);

It also applies to Eloquent queries and relationship queries that use the same connection. It returns the callback’s result and restores the previous read setting even when an exception is thrown, so the switch does not leak into later code. Primary sources: Temporarily Read from the Write Database Connection, Laravel 13 official database.md

Running schedules on one server by default

To reduce forgotten onOneServer() calls when the scheduler runs on multiple servers, v13.35.0 added Schedule::alwaysOnOneServer(). Call it in the boot() method of AppServiceProvider to apply it to all eligible scheduled tasks at once.

use Illuminate\Support\Facades\Schedule;

Schedule::alwaysOnOneServer();

This default only takes effect once you call it. Unnamed scheduled closures are excluded and still run on every server.

onOneServer() requires a central cache shared by all servers. The drivers listed in the official documentation are database, memcached, dynamodb, and redis. Adding the setting alone does not provide a cross-server locking backend.

Primary sources: Run Scheduled Tasks on One Server by Default, Laravel 13 official scheduling.md. Related pages: Task scheduling

Asserting fake dispatches by their properties

Since v13.35.0, the Queue, Bus, Event, and Notification fakes accept an array of expected properties. You no longer need to write a callback every time just to compare attributes. For example, with a ShipOrder job that has a public order property and an $order prepared in the test, you can assert like this:

use App\Jobs\ShipOrder;
use Illuminate\Support\Facades\Queue;

Queue::fake();

ShipOrder::dispatch($order);

Queue::assertPushed(ShipOrder::class, ['order' => $order]);

Every property you pass must match. Values are compared strictly, but Eloquent models are compared with is(), so a different instance representing the same model also matches. Fakes verify the dispatch, not the result of running the job itself. Primary sources: Assert Fake Dispatches by Their Properties, Laravel 13 official queues.md. Related pages: Queues, Mocking

Setting worker memory limits as percentages

Since v13.35.0, the --memory option of queue:work accepts a percentage of PHP’s memory_limit. You can tune the worker’s exit threshold to the PHP setting without recalculating a fixed MB value for each environment.

php artisan queue:work --memory=60%

It is not a percentage of the host’s or container’s total memory. When PHP’s memory_limit is unlimited (-1), use an MB value instead of a percentage. Restarting a worker that exited at the threshold is left to a process monitor such as Supervisor. Primary sources: Set Queue Worker Memory Limits as Percentages, Laravel 13 official queues.md

Returning Markdown with a dedicated Content-Type

v13.35.0 added markdown() to the response factory. It returns a Markdown body as text/markdown, and you can also pass a status code and extra headers.

return response()->markdown("# Report\n\nMonthly summary", 200, [
    'Cache-Control' => 'no-store',
]);

You can combine it with logic that picks the response format, such as wantsMarkdown(). It does not convert Markdown to HTML. It is an API for serving the Markdown itself as the response. Primary sources: Return Markdown Responses, Laravel 13 official responses.md. Related pages: Responses

Running analytical queries in OLAP mode on Vitess

v13.36.0 added isVitess() and olap() to MySQL connections. You can detect whether you are using Vitess or PlanetScale and run analytical queries with the OLAP workload.

use Illuminate\Support\Facades\DB;

$totals = DB::connection('mysql')->olap(
    fn ($connection) => $connection->table('orders')
        ->selectRaw('customer_id, sum(total) as total')
        ->groupBy('customer_id')
        ->get()
);

It sets the workload on both the read and write connections and switches back to OLTP when the callback finishes. The setting is also restored on exceptions, and on a regular MySQL connection that is not Vitess, the callback runs without changing the workload. Primary sources: Use OLAP Workloads with Vitess Connections, Laravel 13 official database.md

Discovering existing validation rules through builders

v13.36.0 added Rule builder methods for many rules that previously had to be written as strings. Methods such as requiredWith(), acceptedIf(), regex(), and timezone() are easier to find through IDE completion, and you can choose either style while keeping the existing validation behavior.

use Illuminate\Validation\Rule;

$rules = [
    'nickname' => [Rule::requiredWith('email'), Rule::regex('/^[a-z]+$/i')],
    'terms' => [Rule::acceptedIf('account_type', 'business')],
    'timezone' => [Rule::timezone()],
];

Method names are camel case. You can mix them with string rules, so there is no need to rewrite existing rules all at once. Primary sources: Discover More Validation Rules Through Builders, Laravel 13 official validation.md. Related pages: Validation

Laravel Cloud

The official monthly blog post introduces the following three items.

Feature	Update
Resend integration	When you connect a Resend account to your organization, Cloud imports your sending domains and shows the required DNS records and verification status. When you attach the email resource to an environment, Cloud issues an API key and sets `RESEND_API_KEY`, `MAIL_MAILER`, `MAIL_FROM_ADDRESS`, and `MAIL_FROM_NAME`.
Cloud scheduler	Applications in every language Cloud supports can run scheduled commands without installing cron or keeping a scheduler process running. You can use presets or your own cron expressions and check each run’s output, exit code, and duration in Logs.
Domain health checks	Cloud checks every hour that connected domains’ DNS points to Cloud and that SSL certificates are renewing. Problems appear on the environment canvas and are also sent by email and Slack.

Primary sources: Laravel October Product Updates — Laravel Cloud, Laravel Cloud changelog. Related pages: Introducing Laravel Cloud

Laravel Forge

PHP security update notices: Forge shows, for each server, which versions are affected by the October PHP security releases and whether fixed versions are available. Recheck versions checks the version that is actually installed. Rechecking the display and updating PHP are separate actions.
Handling provisioning failures: Servers that cannot finish provisioning are shown in a failed state, with notifications, guidance on next steps, and a delete action. PHP and Nginx installs are also retried before the failure is confirmed.

The monthly post also mentions the publication of a post-mortem reviewing the October PHP and Node.js security response. For what was done and how to decide on updates, see the official announcements. Primary sources: Laravel October Product Updates — Laravel Forge, Laravel Forge changelog

September 2026 updates

A look back at building AI providers at runtime, search extensions, Mercure, and isolated preview environments in Cloud.

Database guide

Review read/write splitting and the basics of database connections.

Changelog

Laravel 13

Products

Package Introductions

New Repository Research

Upgrade Guides

Authentication

Frontend

Environment Setup

Laravel Framework

Releases in October

Defining searches with a request body using QUERY routes

Avoiding stale reads in later requests after a write

Reading from the write database for specific operations only

Running schedules on one server by default

Asserting fake dispatches by their properties

Setting worker memory limits as percentages

Returning Markdown with a dedicated Content-Type

Running analytical queries in OLAP mode on Vitess

Discovering existing validation rules through builders

Laravel Cloud

Laravel Forge

Related articles

September 2026 updates

Database guide

​Laravel Framework

​Releases in October

​Defining searches with a request body using QUERY routes

​Avoiding stale reads in later requests after a write

​Reading from the write database for specific operations only

​Running schedules on one server by default

​Asserting fake dispatches by their properties

​Setting worker memory limits as percentages

​Returning Markdown with a dedicated Content-Type

​Running analytical queries in OLAP mode on Vitess

​Discovering existing validation rules through builders

​Laravel Cloud

​Laravel Forge

​Related articles

September 2026 updates

Database guide

Laravel Framework

Releases in October

Defining searches with a request body using QUERY routes

Avoiding stale reads in later requests after a write

Reading from the write database for specific operations only

Running schedules on one server by default

Asserting fake dispatches by their properties

Setting worker memory limits as percentages

Returning Markdown with a dedicated Content-Type

Running analytical queries in OLAP mode on Vitess

Discovering existing validation rules through builders

Laravel Cloud

Laravel Forge

Related articles