freek.dev newsletter #208: typed routes, the effect of the PHP exploit, and much more
Hi there!
Welcome to the 208th freek.dev newsletter!
It's been a busy month again. Next to improving There There, and guiding the Spatie team to improve Flare and Mailcoach, I found the time to build two small sideprojects.
The first one is Plaat Club. “Plaat” is Dutch for a record, an album on vinyl. Hence Plaat Club: a place for people who love records. Now that AI is overwhere, and I spent a lot of time online, I value offline things more then I used to. When I was a student I collected vinyl records, and the past months I picked it up again. Most collectors use Discogs to keep track of their collection, but sharing it is an all or nothing things. Either is it private, or public for anyone. Plaat Club syncs your Discogs collection and allows it to share it with just friends.
My friends and I use it, and we can now see each others new items, very nice! If you have a collection too, feel free to friend me on plaat.club, my username is "freek".
A second small side quest that I did is called Daydreaming. This is a Mac app that modifies your desktop picture to the current daytime and weather conditions. I built it for myself, it's free, I don't have any monitization plans for it.
Something small, but I also made arrangements to travel to Laracon India. I'll be one of the speakers there. Usually I have talk ideas well ahead before such an event, but given that our industry is changing this much, I'll probably only put some thought work on this a bit closer to the conference.
That being said, here are a couple of links I hope you'll enjoy as much as I did.
⭐ Typed routes from Laravel to React with Wayfinder
I've been writing about There There a lot lately. It's a helpdesk we're building at Spatie, born from two decades of running our own customer support for our open source work and SaaS apps. After all that time being the customer of other helpdesks, we finally started on the one we actually wanted to…
⭐ The last 24 hours in PHP land, as observed by a monitoring service
At Oh Dear, we saw the effect of how the recent critical PHP vulnerabilities rippled through the ecosystem, with site outages peaking at 18.8 percent and down alerts rising to 25 times the normal level.
How to Stop an AI Agent from Destroying Your Laravel App
A practical post on hardening Laravel projects against destructive AI agent behavior. It walks through the PocketOS incident and shows concrete safeguards like deny rules, credential isolation, and production guardrails.
I don't write code anymore
Jason McCreary explains how he went from using AI for tedious snippets to letting agents handle nearly all coding, testing, and review work. It is a clear account of the guardrails, workflow shifts, and mindset changes that got him there.
Laravel Context: The Hidden Information That Follows Your Code
A clear walkthrough of Laravel's Context feature and how it lets execution-scoped information travel through your app. It also explains why that matters for logging, queued jobs, and keeping trace data available without threading it through every method call.
Do I want it the most?
A short video by Justin Jackson on ambition, motivation, and the question of how much you really want something. It looks like a thoughtful prompt for anyone building or creating over the long term.
Laravel Deadlocks: Queue Jobs That Already Ran End Up in failed_jobs
Below MySQL 8.0.1, or on a server Laravel misreads, workers reserve jobs with a plain FOR UPDATE and can deadlock on the DELETE. One tinker line shows which lock yours use.
Why I think we should write our own PR descriptions
Ryan Chandler makes a strong case for keeping PR descriptions human-written, even when agents handle most of the implementation. The piece focuses on ownership, review context, and why a concise explanation from the person driving the change is more useful than a long AI-generated summary.
When Retries Make Things Worse: Protecting Your System From Overload
How a slow dependency becomes an outage, and how deadlines, concurrency limits, retry budgets, and jitter protect useful work. A practical deep dive with PHP examples and a controlled overload test design.
Community links
In this section you'll find links submitted by others. Let me know if you wrote or stumbled across a blog post, tutorial or video that might be interesting to appear in this section.
Migrate WordPress Users to Laravel Without a Password Reset (submitted by Mozex)
The Sound of Silence: What Your AI Agent Does Not Tell You (submitted by Alberto Arena)
https://mattstauffer.com/blog/introducing-php-news/ (submitted by Kayla Helmick)
PHP2Shell: you patched, but were you hit? A read-only triage script for your server (submitted by Zacharias Creutznacher)
Old posts
Here are a couple of links from a while ago!
Deferred Queue Driver in Laravel 12.35
A cartoonist's review of AI Art
Maybe You're Not Sick of Programming
Building a procedurally generated game with PHP
Convenient Content Security Policies with Spatie Laravel CSP 3 Presets
Seven Real-World Examples of Using the Pipe Operator in PHP 8.5
Enjoy this newsletter? Help it grow!
If you found this edition useful, here are two quick ways to support the newsletter:
👉 Write a short recommendation. Approved recommendations appear on the newsletter page for others to see.
👉 Forward this email to a colleague or friend who might be interested.
Alternatively, you could consider picking up one of the paid products my team and I have worked on:
If you have any questions, remarks or thoughts about this newsletter, simply hit reply!
Thank you so much for reading!
Freek
P.S. Know someone who'd enjoy this newsletter? Send them here to subscribe.