> ## Documentation Index
> Fetch the complete documentation index at: https://kawax.biz/llms.txt
> Use this file to discover all available pages before exploring further.

# October 2026 Laravel updates

> The October 2026 updates to Laravel 13 and the official products. Covers QUERY routes, avoiding stale replica reads, running schedules on one server, property-based fake assertions, the Resend integration in Cloud, and PHP update notices in Forge.

October 2026 added features for controlling how requests are expressed, where database reads go, and how schedules run across multiple servers. Laravel Cloud made sending mail and configuring scheduled commands simpler, and Forge made PHP security updates and provisioning failures easier to track.

This page is a monthly record based on the official blog post "Laravel October Product Updates" published on November 4 and the October entries of the official Framework changelog. The primary sources were checked on November 7, 2026, and the Framework section covers Laravel 13 only. Releases from November are not included.

Sources:

* [Laravel October Product Updates](https://laravel.com/blog/laravel-october-product-updates)
* [Laravel Framework changelog — October 2026](https://laravel.com/framework/docs/changelog#log-2026-10)
* [Laravel Framework changelog RSS](https://laravel.com/rss/oss-changelog)

## Laravel Framework

### Releases in October

In addition to the main features in the official changelog, the dates and versions below were checked against the release notes.

| Release | Published | Main changes |
| - | - | - |
| [v13.35.0](https://github.com/laravel/framework/releases/tag/v13.35.0) | October 6 | Property assertions for fakes, worker memory as a percentage, Markdown responses, `alwaysOnOneServer()`, QUERY routes. |
| [v13.36.0](https://github.com/laravel/framework/releases/tag/v13.36.0) | October 13 | OLAP execution on Vitess, builders for existing validation rules. |
| [v13.37.0](https://github.com/laravel/framework/releases/tag/v13.37.0) | October 16 | A strict option for `Rule::numeric()`, a fix for the race when `onOneServer()` and `withoutOverlapping()` are combined. |
| [v13.38.0](https://github.com/laravel/framework/releases/tag/v13.38.0) | October 20 | `PreventStaleDatabaseReads`, `Connection::usingWritePdo()`. |
| [v13.39.0](https://github.com/laravel/framework/releases/tag/v13.39.0) | October 27 | `RefreshDatabase` rolls back every transaction level after a test, a fix for `assertSeeText('0')` passing incorrectly. |

The sections below cover the nine items listed in the official changelog. For minor fixes and dependency changes, see each release note.

### Defining searches with a request body using QUERY routes

v13.35.0 added `Route::query()`, which supports the HTTP `QUERY` method. You can define routes that receive search conditions in the request body instead of the GET query string.

```php theme={null}
use App\Http\Controllers\SearchProductsController;
use Illuminate\Support\Facades\Route;

Route::query('/products/search', SearchProductsController::class);
```

`Route::any()` also matches QUERY requests, and the route list recognizes the method. The `SearchProductsController` above stands for an invokable controller in your application that implements the search.

> [!WARNING]
>
> QUERY routes in the `web` middleware group are subject to CSRF verification. Don't assume you can skip verification because it is a search like GET. Send the CSRF token.

Primary sources: [Register QUERY Routes](https://laravel.com/framework/docs/changelog#october-2026-register-query-routes), [Laravel 13 official routing.md](https://github.com/laravel/docs/blob/f7a20c401a30827991659174d48d958f92517a9e/routing.md#available-router-methods). Related pages: [Routing](https://kawax.biz/en/routing.md), [CSRF protection](https://kawax.biz/en/csrf.md)

### Avoiding stale reads in later requests after a write

With a read/write split database, a read right after an update can go to a read replica that has not synced yet. The existing `sticky` option only covers the same request. The `PreventStaleDatabaseReads` middleware added in v13.38.0 also protects later requests in the same session for a set period.

In `bootstrap/app.php`, import `Illuminate\Foundation\Http\Middleware\PreventStaleDatabaseReads` and add it inside the `withMiddleware()` callback with `$middleware->web(append: [PreventStaleDatabaseReads::class]);`. It is not enabled automatically.

The middleware records the time of writes to the default database connection in the session. By default, it sends reads on that connection to the write database for 2 seconds after a write. You can change the period by registering `PreventStaleDatabaseReads::for(5)` or similar instead of the class.

```mermaid theme={null}
sequenceDiagram
    participant User as User
    participant App as Laravel<br>app
    participant Session as Session
    participant Write as Write DB
    participant Read as Read replica
    User->>App: Update request
    App->>Write: Write data
    App->>Session: Record write time
    User->>App: Next request in the same session
    App->>Session: Check time since the write
    alt Within the 2-second window
        App->>Write: Read data
    else After the window
        App->>Read: Use the usual read connection
    end
```

Because it uses the session, it must run after `StartSession`. It does not switch reads for other sessions or other database connections, and it does not detect when the replica has finished syncing.

Primary sources: [Avoid Stale Reads After Database Writes](https://laravel.com/framework/docs/changelog#october-2026-avoid-stale-reads-after-database-writes), [Laravel 13 official database.md](https://github.com/laravel/docs/blob/f7a20c401a30827991659174d48d958f92517a9e/database.md#preventing-stale-database-reads). Related pages: [Database](https://kawax.biz/en/database.md), [Session](https://kawax.biz/en/session.md)

### Reading from the write database for specific operations only

`Connection::usingWritePdo()`, also added in v13.38.0, switches reads on that connection to the write database only while the callback runs. Use it when you want your application to mark exactly which reads are critical, rather than protecting a whole session.

```php theme={null}
use Illuminate\Support\Facades\DB;

$users = DB::connection()->usingWritePdo(
    fn ($connection) => $connection->table('users')->get()
);
```

It also applies to Eloquent queries and relationship queries that use the same connection. It returns the callback's result and restores the previous read setting even when an exception is thrown, so the switch does not leak into later code.

Primary sources: [Temporarily Read from the Write Database Connection](https://laravel.com/framework/docs/changelog#october-2026-temporarily-read-from-the-write-database-connection), [Laravel 13 official database.md](https://github.com/laravel/docs/blob/f7a20c401a30827991659174d48d958f92517a9e/database.md#using-the-write-connection-for-reads)

### Running schedules on one server by default

To reduce forgotten `onOneServer()` calls when the scheduler runs on multiple servers, v13.35.0 added `Schedule::alwaysOnOneServer()`. Call it in the `boot()` method of `AppServiceProvider` to apply it to all eligible scheduled tasks at once.

```php theme={null}
use Illuminate\Support\Facades\Schedule;

Schedule::alwaysOnOneServer();
```

This default only takes effect once you call it. Unnamed scheduled closures are excluded and still run on every server.

> [!NOTE]
>
> `onOneServer()` requires a central cache shared by all servers. The drivers listed in the official documentation are `database`, `memcached`, `dynamodb`, and `redis`. Adding the setting alone does not provide a cross-server locking backend.

Primary sources: [Run Scheduled Tasks on One Server by Default](https://laravel.com/framework/docs/changelog#october-2026-run-scheduled-tasks-on-one-server-by-default), [Laravel 13 official scheduling.md](https://github.com/laravel/docs/blob/f7a20c401a30827991659174d48d958f92517a9e/scheduling.md#running-tasks-on-one-server). Related pages: [Task scheduling](https://kawax.biz/en/scheduling.md)

### Asserting fake dispatches by their properties

Since v13.35.0, the Queue, Bus, Event, and Notification fakes accept an array of expected properties. You no longer need to write a callback every time just to compare attributes.

For example, with a `ShipOrder` job that has a public `order` property and an `$order` prepared in the test, you can assert like this:

```php theme={null}
use App\Jobs\ShipOrder;
use Illuminate\Support\Facades\Queue;

Queue::fake();

ShipOrder::dispatch($order);

Queue::assertPushed(ShipOrder::class, ['order' => $order]);
```

Every property you pass must match. Values are compared strictly, but Eloquent models are compared with `is()`, so a different instance representing the same model also matches. Fakes verify the dispatch, not the result of running the job itself.

Primary sources: [Assert Fake Dispatches by Their Properties](https://laravel.com/framework/docs/changelog#october-2026-assert-fake-dispatches-by-their-properties), [Laravel 13 official queues.md](https://github.com/laravel/docs/blob/f7a20c401a30827991659174d48d958f92517a9e/queues.md#testing). Related pages: [Queues](https://kawax.biz/en/queues.md), [Mocking](https://kawax.biz/en/mocking.md)

### Setting worker memory limits as percentages

Since v13.35.0, the `--memory` option of `queue:work` accepts a percentage of PHP's `memory_limit`. You can tune the worker's exit threshold to the PHP setting without recalculating a fixed MB value for each environment.

```shell theme={null}
php artisan queue:work --memory=60%
```

It is not a percentage of the host's or container's total memory. When PHP's `memory_limit` is unlimited (`-1`), use an MB value instead of a percentage. Restarting a worker that exited at the threshold is left to a process monitor such as Supervisor.

Primary sources: [Set Queue Worker Memory Limits as Percentages](https://laravel.com/framework/docs/changelog#october-2026-set-queue-worker-memory-limits-as-percentages), [Laravel 13 official queues.md](https://github.com/laravel/docs/blob/f7a20c401a30827991659174d48d958f92517a9e/queues.md#resource-considerations)

### Returning Markdown with a dedicated Content-Type

v13.35.0 added `markdown()` to the response factory. It returns a Markdown body as `text/markdown`, and you can also pass a status code and extra headers.

```php theme={null}
return response()->markdown("# Report\n\nMonthly summary", 200, [
    'Cache-Control' => 'no-store',
]);
```

You can combine it with logic that picks the response format, such as `wantsMarkdown()`. It does not convert Markdown to HTML. It is an API for serving the Markdown itself as the response.

Primary sources: [Return Markdown Responses](https://laravel.com/framework/docs/changelog#october-2026-return-markdown-responses), [Laravel 13 official responses.md](https://github.com/laravel/docs/blob/f7a20c401a30827991659174d48d958f92517a9e/responses.md#markdown-responses). Related pages: [Responses](https://kawax.biz/en/responses.md)

### Running analytical queries in OLAP mode on Vitess

v13.36.0 added `isVitess()` and `olap()` to MySQL connections. You can detect whether you are using Vitess or PlanetScale and run analytical queries with the OLAP workload.

```php theme={null}
use Illuminate\Support\Facades\DB;

$totals = DB::connection('mysql')->olap(
    fn ($connection) => $connection->table('orders')
        ->selectRaw('customer_id, sum(total) as total')
        ->groupBy('customer_id')
        ->get()
);
```

It sets the workload on both the read and write connections and switches back to OLTP when the callback finishes. The setting is also restored on exceptions, and on a regular MySQL connection that is not Vitess, the callback runs without changing the workload.

Primary sources: [Use OLAP Workloads with Vitess Connections](https://laravel.com/framework/docs/changelog#october-2026-use-olap-workloads-with-vitess-connections), [Laravel 13 official database.md](https://github.com/laravel/docs/blob/f7a20c401a30827991659174d48d958f92517a9e/database.md#running-analytical-queries-on-vitess)

### Discovering existing validation rules through builders

v13.36.0 added `Rule` builder methods for many rules that previously had to be written as strings. Methods such as `requiredWith()`, `acceptedIf()`, `regex()`, and `timezone()` are easier to find through IDE completion, and you can choose either style while keeping the existing validation behavior.

```php theme={null}
use Illuminate\Validation\Rule;

$rules = [
    'nickname' => [Rule::requiredWith('email'), Rule::regex('/^[a-z]+$/i')],
    'terms' => [Rule::acceptedIf('account_type', 'business')],
    'timezone' => [Rule::timezone()],
];
```

Method names are camel case. You can mix them with string rules, so there is no need to rewrite existing rules all at once.

Primary sources: [Discover More Validation Rules Through Builders](https://laravel.com/framework/docs/changelog#october-2026-discover-more-validation-rules-through-builders), [Laravel 13 official validation.md](https://github.com/laravel/docs/blob/f7a20c401a30827991659174d48d958f92517a9e/validation.md#rule-builders). Related pages: [Validation](https://kawax.biz/en/validation.md)

## Laravel Cloud

The official monthly blog post introduces the following three items.

| Feature | Update |
| - | - |
| Resend integration | When you connect a Resend account to your organization, Cloud imports your sending domains and shows the required DNS records and verification status. When you attach the email resource to an environment, Cloud issues an API key and sets `RESEND_API_KEY`, `MAIL_MAILER`, `MAIL_FROM_ADDRESS`, and `MAIL_FROM_NAME`. |
| Cloud scheduler | Applications in every language Cloud supports can run scheduled commands without installing cron or keeping a scheduler process running. You can use presets or your own cron expressions and check each run's output, exit code, and duration in Logs. |
| Domain health checks | Cloud checks every hour that connected domains' DNS points to Cloud and that SSL certificates are renewing. Problems appear on the environment canvas and are also sent by email and Slack. |

Primary sources: [Laravel October Product Updates — Laravel Cloud](https://laravel.com/blog/laravel-october-product-updates#laravel-cloud), [Laravel Cloud changelog](https://laravel.com/cloud/docs/changelog). Related pages: [Introducing Laravel Cloud](https://kawax.biz/en/blog/laravel-cloud.md)

## Laravel Forge

* **PHP security update notices**: Forge shows, for each server, which versions are affected by the October PHP security releases and whether fixed versions are available. **Recheck versions** checks the version that is actually installed. Rechecking the display and updating PHP are separate actions.
* **Handling provisioning failures**: Servers that cannot finish provisioning are shown in a failed state, with notifications, guidance on next steps, and a delete action. PHP and Nginx installs are also retried before the failure is confirmed.

The monthly post also mentions the publication of a post-mortem reviewing the October PHP and Node.js security response. For what was done and how to decide on updates, see the official announcements.

Primary sources: [Laravel October Product Updates — Laravel Forge](https://laravel.com/blog/laravel-october-product-updates#laravel-forge), [Laravel Forge changelog](https://laravel.com/forge/docs/changelog)

## Related articles

> [card] [September 2026 updates](https://kawax.biz/en/blog/changelog/202609.md)
>
> A look back at building AI providers at runtime, search extensions, Mercure, and isolated preview environments in Cloud.

> [card] [Database guide](https://kawax.biz/en/database.md)
>
> Review read/write splitting and the basics of database connections.


## Related topics

- [September 2026 Laravel updates](https://kawax.biz/en/blog/changelog/202609.md)
- [March 2026 Laravel updates](https://kawax.biz/en/blog/changelog/202603.md)
- [July 2026 Laravel updates](https://kawax.biz/en/blog/changelog/202607.md)
- [August 2026 Laravel updates](https://kawax.biz/en/blog/changelog/202608.md)
- [April 2026 Laravel updates](https://kawax.biz/en/blog/changelog/202604.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.