14 More PRs Merged Into Laravel — Serializable Closure, Cloud CLI, and More
Since my last post, another 14 pull requests have been merged across 5 Laravel repositories. That brings the total to 34 merged PRs across 16 repos since mid-March.
This time the focus shifted to a single package that needed serious attention: laravel/serializable-closure.
Serializable Closure (9 merged)
I found a chain of bugs in the v2.x closure serialization engine. Each fix uncovered the next one. Here's the full list:
#129 — Fix v2.0.9 regression: Bus::chain breaks with nested closures [severity: critical, size: medium]
This was the critical one. The v2.0.9 release introduced a regression that broke Bus::chain() when using nested closures. Queue jobs using closure chains were failing silently.
#128 — Fix crash with method-only attributes on serialized closures [severity: high, size: small]
PHP 8 attributes that target only methods were causing serialization to crash when applied to closures.
#135 — Fix SerializableClosure as class property being unwrapped during deserialization [severity: high, size: small]
When a SerializableClosure was stored as a class property, deserialization was unwrapping it prematurely, breaking the expected type.
#137 — Fix operator precedence bug in scope detection for class keywords [severity: medium, size: tiny]
An operator precedence issue in the AST analysis was causing incorrect scope detection when class keywords like self, static, and parent appeared in certain expressions.
#140 — Fix instanceof with parenthesized expressions [severity: medium, size: small]
instanceof checks with parenthesized expressions were being parsed incorrectly during serialization.
#141 — Add true to builtin types list for PHP 8.2+ [severity: medium, size: small]
PHP 8.2 added true as a standalone type. The serializer didn't recognize it, causing type resolution failures.
#146 — Bypass property hooks during serialization traversal on PHP 8.4+ [severity: high, size: medium]
PHP 8.4 property hooks were interfering with the serialization traversal. This fix bypasses them safely.
#139 — Remove dead code and fix docblock errors. [severity: low, size: tiny]
#143 — Register missing test in phpunit.xml.dist. [severity: low, size: tiny]
#153 — Update README caveats. [severity: low, size: tiny]
Cloud CLI (2 merged, more in progress)
#111 — Fix Font::load crash on Windows [severity: high, size: tiny]
The Cloud CLI was crashing on Windows because font loading assumed Unix paths.
#117 — Fix browser and file manager commands on Windows and Linux [severity: medium, size: small]
cloud open and cloud browse weren't working on Windows or Linux. Now they use the correct platform-specific commands.
I've put a lot of work into Cloud CLI. I originally opened a bunch of individual PRs, then consolidated them into one larger PR. A lot of the fixes were interconnected and didn't make sense in isolation, and having them together made it possible to run proper live integration tests against the Cloud API with all the changes in place. That turned out to be too much to review in one go, which is fair. So now I'm going back through the individual issues and PRs one by one, finding where I can help the maintainers with what they're already working on without getting in the way of their direction. It's their project and they know best how they want to build it. I'm just happy to see some of the same problems I flagged getting addressed in recent merges.
Telescope (1 merged)
#1710 — Fix npm audit vulnerabilities (lodash, axios, rollup) [severity: medium, size: large]
Security dependency updates for the Telescope frontend assets.
Installer (1 merged)
#497 — Fix Boost install on Windows: quote version constraint to protect caret [severity: high, size: tiny]
The ^ in version constraints was being interpreted as an escape character by the Windows shell. Quoting it fixes the install.
The bigger picture
34 merged PRs, 16 repos, three weeks. What started as a handful of bug fixes turned into a deep audit of serializable-closure — a package that underpins queued jobs, event listeners, and anything that serializes closures in Laravel. The v2.0.9 regression fix alone was affecting anyone using Bus::chain() with closures.
Beyond what's merged, there's still a lot in the pipeline. Right now I have 29 PRs open for review and 43 drafts across repos including cloud-cli, forge-cli, serializable-closure, framework, installer, reverb, horizon, echo, ai, cashier-paddle, and cashier-stripe. Each draft needs a fresh look against the latest code, updated tests, and sometimes a complete rework based on how the package has changed since I first opened it. I'm working through them one by one. It's not fast work, but it's worth doing right.
If you've got feedback on any of my PRs, good or bad, I genuinely appreciate it. And if any of my drafts cover something you want to take on yourself, go for it. I'd rather see the fix land than hold onto it. I've already got plenty to work through.
I'm going to keep contributing. There's always more to fix.