25 Laravel Bug Fixes — Tested, Verified, Ready to Merge
Updated 2026-03-18: Now 25 fixes (was 19). Added 6 more cross-platform fixes including data corruption in incrementEach(), duplicate Redis sessions, presence channel scaling, zero-downtime Octane deployments, Scout timeout jobs, and Wayfinder TypeScript generation bugs.
I found and fixed 25 bugs across the Laravel ecosystem — 10 Windows-specific and 15 cross-platform. Every fix has been tested on Windows 11 Pro and the first 19 were independently verified on macOS (Darwin 25.3.0, PHP 8.4.19) with bug reproduction, concurrency testing, and full test suite runs.
I'm currently blocked from the Laravel GitHub organisation, so I can't submit PRs or comment on issues. All patches are public and ready to use.
Full details and patches: GitHub Gist
The Fixes
Cross-Platform (Production Critical)
laravel/framework #57262 — incrementEach() updates ALL rows (DATA CORRUPTION). Calling $model->incrementEach() updates every row in the table, not just the model instance. Multiple people report near-production data loss. Fix adds explicit methods to Eloquent\Builder that apply scopes before forwarding. Patch
laravel/cashier-stripe #1759 — Webhook race condition creates duplicate subscriptions. When customer.subscription.created and customer.subscription.updated webhooks arrive simultaneously, both handlers insert a new row. Active data corruption in production. Fix catches UniqueConstraintViolationException and recovers gracefully. Verified with real concurrent processes on both SQLite and PostgreSQL — race triggered 10/10 times, fix recovered every time. Patch
laravel/framework #58207 — OOM jobs retry infinitely. When a job causes an out-of-memory kill, the exception counter never increments because the catch block never executes. Jobs with $maxExceptions retry forever. 31 comments. Fix uses optimistic increment — counter goes up before fire(), down on success. Verified with real OOM kills (PHP exit code 255). Patch
laravel/framework #56395 — Pipeline memory leak. Pipeline::then() retains references to job objects after completion, preventing garbage collection. Workers hold 254MB instead of 4MB after processing 50 jobs. Two-line fix. 22 comments. Patch
laravel/reverb #344 — TypeError crash. Operator precedence bug in isWebSocketRequest() means any non-null Upgrade header is treated as a websocket request. Plus no guard when reverse proxies strip headers. 17 comments, users switching to Soketi. All 126 tests pass including Redis. Patch
laravel/reverb #273 — Presence channels wrong user list at scale. Multiple Reverb instances behind a load balancer return inconsistent presence user lists. Fix routes presence events through Redis pub/sub. 237 tests pass. Patch
laravel/serializable-closure #126 — v2.0.9 regression breaks Bus::chain. Objects with __serialize skip closure wrapping entirely, causing serialization failures. Fix scopes the skip to only Closure-typed properties. 338 tests pass. Patch
laravel/cashier-stripe #1817 — swapAndInvoice gives free upgrades. When payment fails during a plan swap, users end up on the expensive plan for free. Fix adds pendingIfPaymentFails() as the default. Note: needs adjustment for tax_rates compatibility. Patch
laravel/horizon #1535 — Silent 60-second queue stalls. Memory-exceeded workers restart, die again, then cooldown for 60 seconds with zero logging. Impossible to diagnose. Fix adds logging at 3 critical points. 169 tests pass. Patch
laravel/pulse #461 — Multi-server deadlocks. Concurrent pulse:work processes read the same Redis stream entries and deadlock on MySQL upserts. Fix adds atomic Redis lock around digest. Patch
laravel/framework #57070 — Sub-minute scheduling skips. endOfMinute() mutates the Carbon instance used in the loop condition. Fix uses copy()->endOfMinute(). 68 scheduling tests pass. Patch
laravel/framework #58377 — SessionManager creates duplicate Redis connections. Every request opens 2 connections instead of 1, causing Connection limit reached. 12 comments. Fix removes unnecessary clone. 93 session tests pass. Patch
laravel/octane #1004 — No zero-downtime deployment. octane:reload doesn't work with symlink deployments. 23 comments. Fix adds ResolvesSymlinks trait + clearstatcache. 180 tests pass. Patch
laravel/scout #957 — Timeout jobs block queue forever. MakeSearchable jobs that timeout silently hang in Horizon. Fix adds $failOnTimeout = true. 211 tests pass. Patch
laravel/wayfinder #178, #161, #159 — Three TypeScript generation bugs. Broken .d.ts Inertia types, invalid identifiers from dashed routes, options parameter name collision. Patch
Windows-Specific
laravel/octane #1100 — FrankenPHP crashes on Windows. POSIX signal constants don't exist. PR
laravel/wayfinder #128 — Backslash import paths. DIRECTORY_SEPARATOR produces \ in TypeScript. Patch
laravel/sail #843 — Testing database never created. Bash shebang fails in MySQL containers. PR
laravel/sail #850 — Installation fails on Windows. Unrecognised OS. PR
laravel/installer #472 — laravel new crashes with Boost. No TTY support. Patch
laravel/vs-code-extension #575 — Symlinked packages break. Double path construction. Patch
laravel/prompts #191 — Terminal rendering glitches. PHP_EOL newline miscounting. Patch
laravel/octane #1034 — File watcher ignores --poll. FrankenPHP overrides parent watcher. PR
laravel/sail #815 — Headed browser tests fail. No virtual display. PR
laravel/vite-plugin-wayfinder #10 — Wayfinder fails in Vite. Working directory resolution. Patch
Verification
Every fix was tested on Windows 11 Pro 26200. Fixes #1–19 were additionally verified on macOS Darwin 25.3.0 (PHP 8.4.19) including:
- Bug reproduction with before/after proof
- Full test suite runs (2,500+ tests total across all repos)
- Concurrency testing with
pcntl_forkand barrier synchronisation - Real OOM kills (PHP memory limit exhaustion, exit code 255)
- Memory leak measurement (WeakReference + memory profiling)
- PostgreSQL and Redis integration testing via Docker
- Stripe API integration tests with test keys
All patches, verification data, and test results are in the gist.
If you're a Laravel maintainer, please unblock me so I can submit these properly — or feel free to use any of these patches directly.