What's New in Laravel — July 2026: First-Party Images, Human-in-the-Loop Agents & Everything Laracon US Announced

The June roundup signed off with three promises: MySQL scale-to-zero was landing imminently, the AI SDK was still inching toward its 1.0, and the framework had more room to run. Two of the three paid off inside July. The third took a turn nobody had on their bingo card — we'll get to Laracon.

First, a confession about boilerplate. Somewhere in almost every Laravel application we've shipped in eleven years — e-learning platforms on Moodle LMS, SaaS backends, the avatar upload on a client portal — lives the same forty-odd lines: take the upload, constrain it, re-encode it, store it, and hope nobody feeds it a 40 MB drone photo. The packages behind those lines changed over the decade. The ritual never did. In July, Laravel absorbed the ritual into the framework.

That's the shape of the month: not one headline but the framework quietly claiming territory that used to belong to your composer.json — image handling, agent safety, even your database's sleep schedule. And then Laracon US opened in Boston, and the biggest thing on stage wasn't Laravel 14 or an AI SDK 1.0. It was a test runner.

In This Article

The short version — if you only read one section:

• Image processing became a framework primitive. The new first-party Image component (v13.20) handles resize, crop, and format conversion with a fluent API and swappable drivers — including Cloudflare Images, which moves the CPU cost off your servers entirely.
• Production agents got a stop button. The AI SDK's human-in-the-loop support pauses an agent before side-effectful tool calls and resumes durably after a human approves, edits, or rejects them.
• The last database learned to sleep. MySQL scale-to-zero shipped July 20, completing the story June started: compute, Postgres, Valkey, and now MySQL all idle to zero and wake together.
• Laracon's reveal was maturity, not majors. Pest 5 shipped live on stage — 19,000 tests in 5 seconds via Test Impact Analysis — alongside the Laravel LSP, CPX, and artisan doctor. No Laravel 14 date. No AI SDK 1.0.
• The one thing worth doing this week: pick one upload pipeline, port it to the new Image facade, and delete the service class it replaces. It's the fastest way to feel what "first-party" means here.

Images Are Now a Framework Concern

Every Laravel codebase of a certain age has an ImageService, a ProcessesUploads trait, or a job named something like OptimizeAvatar. Ours certainly do. They all do the same three things — constrain dimensions, re-encode to a sane format, store the result — and they all do it through whichever library the project happened to start with, wired up slightly differently every time.

As of v13.20 (July 14), that's a framework concern. The new Image component gives you a fluent, immutable API that starts from wherever your image actually is — an upload on the request, a path on a disk, raw bytes — and chains through to storage:

1$path = $request->image('avatar')
2    ->cover(400, 400)
3    ->optimize()
4    ->store('avatars');

The optimize() call re-encodes to WebP at a sensible quality; the example in the pull request takes a 2.1 MB PNG down to 75.8 KB. If you need more control, the API has it — contain() with a background fill, resize() with a single dimension to preserve aspect ratio, quality(), and direct format conversions including toWebp() and toAvif() (the AVIF, PNG, GIF, and BMP outputs arrived a week later in v13.21). You can also pull a processed image back out of storage and keep working on it:

1Storage::image($path)
2    ->contain(1200, 630, background: '#0B1120')
3    ->toWebp()
4    ->toBytes();

Why it matters: the interesting design decision isn't the fluent API — it's that image processing is now driver-based, exactly like cache, queue, and storage. A new config/image.php and an IMAGE_DRIVER env var select between GD, Imagick (both powered by intervention/image ^4.0, still installed as a suggested dependency), and Cloudflare Images, which does the manipulation remotely. That third driver is the quietly radical one: your production servers never spend a CPU cycle on image work, and the code doesn't change. Image processing just moved from "a library you picked in 2019" to "an infrastructure decision you can revisit per environment."

In practice, what changes for our team: the upload paths we maintain across e-learning platforms on Moodle LMS integrations, SaaS dashboards, and client portals converge on one API — and the hand-rolled service classes those apps carry become deletions. For anything already behind Cloudflare, the remote driver means a media-heavy app can stop budgeting compute for encoding entirely. The place you'd still reach for a package is model-attached media: spatie/laravel-medialibrary's collections and conversions solve a different problem than raw manipulation, and the two now compose rather than compete.

Your Agents Learned to Ask Permission

The AI SDK shipped four releases in July — v0.9.0 through v0.10.2 — and the thread running through them is not what you'd expect from a library racing toward 1.0. The headline feature makes agents less autonomous.

Human-in-the-loop tool approval, which landed in v0.10.0 (July 21), lets any tool declare that it needs a human's sign-off before it runs. An agent that decides to call an approval-gated tool doesn't execute it — it pauses, and your application gets the pending calls to surface however you like: a review queue, a Slack message, an admin panel button.

1$response = $agent->prompt('Clean up export files older than 30 days.');
2
3if ($response->awaitingApproval()) {
4    // $response->pendingApprovals holds the tool calls the agent
5    // wants to make — surface them to a human for review.
6}

The human's verdict comes back as a decision map, and the conversation resumes from durable history — approve one call, rewrite another's arguments, reject everything else with a wildcard:

1use Laravel\Ai\Approvals\Decision;
2
3$agent->continue($conversationId, as: $user)->prompt([
4    'call_abc' => true,
5    'call_def' => Decision::edit(['path' => 'exports/2026-06']),
6    '*' => false,
7]);

The engineering underneath is what makes this production-grade rather than a demo feature: approved results are recorded durably before execution continues, so a retried request can't double-run a side effect — a failed continuation retry comes back as a clean conflict instead of a second deletion. Tools opt in via the Approvable contract or a requireApproval() call, and — the detail that tells you where Laravel's head is — the SDK's own built-in filesystem tools (write, copy, delete) now require approval by default. Autonomy is something you now explicitly grant, not something you get.

The rest of the July run, briefly:

• Str::summarize() (v0.10.0) — one-line AI summarization as a string macro: str($incidentReport)->summarize() or Str::summarize($article, sentences: 5). It runs through a dedicated agent tagged to use the cheapest configured model, which is a nice pattern in itself: casual AI calls shouldn't ride your flagship model by default.
• Multimodal embeddings (v0.10.0) — image and audio embeddings for Gemini and VoyageAI, auto-cached.
• Tool-choice support (v0.9.1) — force or forbid specific tools across Gemini, OpenAI, and Anthropic.
• Default models moved — the Anthropic default is now Claude Sonnet 5 (v0.9.0), and Gemini's default got a July bump too. If you don't pin models explicitly, read your changelogs.
• The 0.x caveat earned its keep — v0.9.0 rearchitected every provider gateway onto a shared text-generation loop. It's the right foundation, and it was a breaking change with an upgrade guide. The SDK ended July at v0.10.2, still shy of 1.0.

In practice: the ops agent we sketched in our multi-agent systems post — the one that reads Nightwatch exceptions and posts summaries to Slack — gets exactly one upgrade from all this: the step where it does something now has a human in front of it. That's the difference between an agent you demo and an agent you give write access to production data, a line we drew the hard way in AI Agents in Production.

Laravel Cloud: The Whole Stack Sleeps Now

June's headline was checkpoint/restore scale-to-zero for compute and cache, with MySQL promised "in a few weeks." On July 20, that promise landed: MySQL Flex databases now sleep when idle, and the full stack — app, database, cache — can idle to zero and wake as a unit.

The mechanics follow the same philosophy as the compute work. Storage stays online the whole time; only database compute sleeps. Every cluster sits behind a proxy layer, and when a connection arrives at a sleeping database, the proxy holds it while compute resumes — so the first query after a quiet night runs a few hundred milliseconds slower instead of erroring. You pick the idle window (one minute to one hour, or never), and existing databases keep their current sizing and pricing unless you opt in.

July's Cloud run didn't stop there:

• Secrets Manager (July 16) — org-level secrets you write once and link to multiple environments, encrypted in the browser before they ever reach Laravel's servers, decrypted only at deployment. "Write once, read never" is the right default for a platform holding your production credentials.
• Monorepo support (July 8) — Cloud detects monorepos, lets each application pick its root directory, and multiple apps can deploy independently from one repo.
• The platform is quietly outgrowing "Laravel hosting." Symfony apps started running on Cloud unchanged in late June, and on July 28 — Laracon's opening morning — Next.js and Nuxt deployments followed: JavaScript frontend and Laravel backend in one monorepo, each with its own scaling and domains, one bill. "More languages and frameworks are coming soon" is doing a lot of quiet work in that announcement.
• Managed queues got rebuilt — isolated autoscaling workers that scale to zero on an empty queue, idle wake under one second (down from about thirty), FIFO queues, hour-long jobs on the Pro class, and scheduled pre-scaling for the traffic you can see coming.
• Private Cloud is now HIPAA-certified, joining SOC 2 Type II and GDPR — with a dedicated AWS account, VPC isolation, and static outbound IPs for the teams that need compliance to even start the conversation.

In practice: in June we said we were auditing which of our staging, preview, and internal environments still deserved to run 24/7. The honest answer, then, still excluded the databases — compute could sleep but MySQL billed on. As of July 20 that asterisk is gone, and the audit math changes accordingly: a client preview environment that gets opened for a weekly review can now cost nearly nothing for the other six days, database included.

Laracon US: Pest 5 and a Wave of Tooling

Laracon US ran July 28–29 at the SoWa Power Station in Boston — 18 speakers, and a keynote stat worth repeating: 1,776 pull requests merged into the framework this year, 3,242 more across Laravel's other open-source repos, with 270 contributors landing their first-ever PR. Whatever else you think about the ecosystem's pace, it is not a one-company show.

The conventional wisdom going in was that Boston would deliver at least one of: a Laravel 14 date, or the AI SDK's 1.0. It delivered neither. What it delivered instead was shipping — starting with the biggest release of the conference, which wasn't from the framework at all.

Pest 5 shipped live on stage (July 28, during Nuno Maduro's opening keynote — v5.0.0 hit GitHub the same day). The marquee feature is TIA, Test Impact Analysis: Pest builds a dependency map of your codebase and, on each run, executes only the tests affected by what changed, replaying cached results for the rest. It understands Laravel-specific dependencies — migrations, Blade templates, Vite modules — not just PHP imports. The number Nuno put on screen: Laravel Cloud's own suite of 19,000+ tests went from 3 minutes to 5 seconds. Pest 5 requires PHP 8.4+ and PHPUnit 13, and 4.x continues to receive maintenance in parallel.

The rest of Pest 5 reads like a bet on how testing changes when AI writes half the code:

• An agent plugin gives AI coding agents a single command to verify their changes against your real suite — factories, database refresh, fakes and all — and with the browser plugin, to drive a real browser and assert backend side effects.
• An evals plugin scores LLM output quality with the same expect() API you already know — deterministic checks plus AI scorers, skipped by default so your CI isn't quietly billing an AI provider.
• PHPStan and Rector plugins are built in — static analysis that understands it() and expect(), and roughly sixty Rector rules for modernizing test suites.

Then came the framework-side reveals. Marking clearly what's announced versus what's shipped:

• Laravel LSP (announced) — a real Language Server Protocol implementation, generalizing what the VS Code extension does (route navigation, config autocomplete, inline docs) to NeoVim, Zed, and Sublime. The end of "the good tooling is only on VS Code."
• CPX (announced) — an npx-equivalent for PHP: cpx laravel/pint runs a package without touching your composer.json. It can even run code from a Gist URL, which is equal parts convenient and worth a security policy.
• Artisan doctor (announced) — one command that health-checks an application: APP_KEY, PHP version, extensions, environment config, auto-fixing what it safely can, with packages able to register their own checks. Laravel explicitly positions it as the final verification step for AI coding agents — hand the machine a machine-readable definition of "healthy."
• Head tag API (announced) — fluent PHP-side management of the document head: OG images, canonical URLs, PWA meta, without template gymnastics.
• Debounced jobs (announced) — collapse a burst of identical dispatches into a single job execution. Anyone who has fanned out webhook-triggered cache rebuilds knows exactly which incident this prevents.
• Pint now formats Blade (announced) — one formatter for PHP and templates both.
• Inertia DevTools (shipped) — a Chrome extension showing every Inertia request with its headers and hydrated props.

The stage tour also revisited work that had already landed quietly — artisan dev and refreshable cache locks among them — which is its own kind of tell: the gap between "announced at Laracon" and "already in your composer update" is shrinking.

In practice: two of these matter to us immediately. Pest 5's TIA changes the daily loop on large suites — our bigger client codebases are exactly the multi-thousand-test shape where a 3-minute feedback cycle quietly taxes every change. And the agent plugin plus artisan doctor form a pattern we've been building by hand: give AI coding tools a deterministic, machine-checkable definition of done. Laravel just made that pattern first-party.

The Framework Kept Moving: v13.18 to v13.23

Six releases landed in July, and beyond the Image component the drumbeat produced several features worth knowing cold.

The HTTP QUERY verb arrived (v13.19, July 7). QUERY is the IETF's new method for the awkward middle ground between GET (safe and cacheable, but URL-length-limited) and POST (body-carrying, but semantically "change something"): it's safe, cacheable, and carries a body. Laravel's HTTP client and test suite now speak it:

1$results = Http::query('https://search.internal/products', [
2    'category' => 'ai-hardware',
3    'in_stock' => true,
4]);

Test helpers (query(), queryJson()) shipped in the same release, and the community turnaround was remarkable — Laravel News had a full Scout-powered search endpoint tutorial out within eight days, using Route::match(['QUERY'], ...) and noting that first-class Route::query() routing is headed for Laravel 14. That's the first concrete Laravel 14 signal we've seen, for what it's worth. In practice: complex search and filter endpoints are the immediate win — the ones whose query strings kept hitting URL limits and got awkwardly POSTed instead.

Collections learned reduceInto (v13.19). Reduce-by-mutation, borrowed from Swift and Ruby, for the accumulator patterns where classic reduce() forces you to return the accumulator on every line:

1$totals = $orders->reduceInto([], function (&$totals, $order) {
2    $totals[$order->status] ??= 0;
3    $totals[$order->status] += $order->total;
4});

Queues had a quietly excellent month. A declarative Release middleware sends a job back to the queue without hand-rolling the logic (v13.18); SQS bulk dispatch now uses SendMessageBatch, cutting API round trips for the Bus::bulk() pattern June introduced (v13.19); and the queue fake finally lets tests inspect delayed and reserved jobs, plus beforePushing/afterPushing hooks (v13.18–v13.20). In practice: that last one closes a real testing gap — asserting "this job was scheduled for later, not now" used to require ugly workarounds.

Routing and requests got sharper edges. A #[RouteKey('slug')] attribute on a model replaces the getRouteKeyName() override ceremony (v13.21); a RequestAttribute contextual attribute injects middleware-resolved values straight into controller signatures (v13.21); and schedule:work now shuts down gracefully on SIGTERM (v13.18) — small, unless you run the scheduler in Kubernetes, where it's the difference between clean rollouts and killed mid-run tasks.

And the steady accumulation: a strict RFC 4648 base64 validation rule, Str::counted() for count-prefixed labels, incrementEachQuietly() on Eloquent, separate Redis session prefixes, a #[WithoutMiddleware] controller attribute, and #[SensitiveParameter] sweeps keeping secrets out of stack traces. Releases v13.22 and v13.23 closed the month on July 24 and 27, holding the weekly cadence right up to the conference.

The community kept pace, too — July's package crop included Laravel Time Machine (a request-lifecycle profiler with a Gantt-style phase timeline) and Laravel SMS Catcher (Mailpit, but for SMS notifications), both the kind of small sharp tool that ends up in every local stack.

What This Means for Teams Shipping Laravel

Three threads from July are worth carrying into your planning.

The framework is absorbing the stack, deliberately. Images in July; the Head API, doctor, and LSP announced for the months ahead; artisan dev and route metadata earlier this year. Each one converts a "which package?" debate into a framework primitive with a driver or an extension point. The practical consequence: revisit your default composer.json — some of it is now dead weight, and the first-party replacements are the better-integrated option.

AI tooling is shifting from capability to control. July's agent story was approval gates, durable audit trails, evals, and machine-checkable definitions of done — not bigger models or flashier demos. If you're building agents on a PHP stack, the primitives for doing it responsibly are arriving faster than most teams' willingness to use them. Get the approval flow into your agent designs now, while your agents are still small enough to retrofit easily.

Cloud economics keep compounding. With MySQL asleep, the full always-on tax we described in June is now optional across the whole stack — and the Symfony and Next.js/Nuxt moves signal that "Laravel Cloud" increasingly means "Cloud, by the Laravel team." If your infrastructure review didn't happen after June's post, July removed its last excuse.

August has plenty queued: the AI SDK's 1.0 watch continues (v0.10.2 and counting), the first concrete Laravel 14 signal is on the board with native QUERY routing, and the real-world Pest 5 adoption reports — the ones with other people's test suites — are about to roll in. We'll cover all of it in the August roundup.

Related reading

• What's New in Laravel — June 2026: Scale to Zero, AI Agents Get MCP & Route Metadata
• Building Multi-Agent Systems in Laravel: Sub-Agents, Orchestrators & AgentTool Internals
• AI Agents in Production: Architecture, Tools & Lessons Learned
• Laravel API Development: Best Practices for 2026

About the Author

Ritesh Patel

Co-Founder & CTO, Treesha Infotech

Co-founded Treesha Infotech and leads all technology decisions across the company. Full-stack architect with deep expertise in Laravel, Next.js, AI integrations, cloud infrastructure, and SaaS platform development. Ritesh drives engineering standards, code quality, and product innovation across every project the team delivers.

LinkedInUpwork