Bartłomiej Gajda

PHP developer with 10+ years of experience. Specialized in Laravel & Filament, focused on scalable systems and high-quality packages.

[Wendell Adriel @wendell_adriel]

Check the repository, and don't forget to support the project with a star!

https://t.co/Vt9QZREBBG

[Tomas Votruba @VotrubaT]

Does your #phpstan level increase in time,
but number of ignored cases grows allong with it?

This PHPStan rule is one solution 😉
https://t.co/fAztMoCCb8

[Roman Pronskiy @pronskiy]

@pushpak1300 https://t.co/nDsoHwNDIt
https://t.co/4asKMmIUWT
https://t.co/VYdX273Ps1

And this one is pretty but insane application of FFI:
https://t.co/4VsFVUFws2

[Bartłomiej Gajda @thewebard]

@TablePlus Version 7 looks beautiful! One thing that would be extremely helpful: please fix remote Redis connections, e.g. for Laravel Cloud environments.

[Alexandre Daubois @alexdaubois]

Timing attacks are real, and most devs don't protect against them.

When you compare two strings with === or strcmp(), #PHP stops at the first different byte. If the first character matches, it takes slightly longer than if it doesn't.

An attacker can measure response times to guess a secret character by character. HMAC token, API key, CSRF token... byte by byte, statistically.

hash_equals() was added in PHP 5.6 specifically for this. It always compares ALL bytes, regardless of where the first mismatch is. Constant time.

Same applies to #golang: use crypto/subtle.ConstantTimeCompare().
Same in #nodejs: crypto.timingSafeEqual().

If you're comparing secrets with == or ===, you may be leaking information through time!

[Packagist @packagist]

🔒An update on Composer & Packagist supply chain security: what's in place, what ships this week with Composer 2.10 (dependency policies, immutable versions), and what comes next.
If you maintain PHP packages, enable MFA now!
#php #phpc #composerphp

[Punyapal Shah @MrPunyapal]

Laravel devs, Wanna see directory of undocumented features?

[Packagist @packagist]

🚨 Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages.
Update now (composer self-update) or disable affected Actions workflows.
#composerphp #phpc #php

[Alexandre Daubois @alexdaubois]

#PHP integers are not "just ints": they're zend_long, a platform-dependent C type.

64-bit system, 64-bit signed integer. But what if it overflows? Well, PHP silently converts to float. No exception, no error.

So PHP_INT_MAX + 1 is a float: not a crash, not a wrap-around.

[Dipak Gajjar @dipakcgajjar]

PHP 9.0 will ship under the 3-clause BSD license. 🎉

After 25+ years, the dual PHP/Zend Engine licenses are out. The new license is OSI-approved, GPL-compatible, and removes the legal gray area that made chunks of PHP technically non-OSI.

No rights change for devs - just cleaner, simpler, and more compatible.

Custom licenses create friction. Standard ones don't.

[Akhilesh Mishra @livingdevops]

Kubernetes is beautiful.
Every Concept Has a Story, you just don't know it yet.

In k8s, you run your app as a pod. It runs your container. Then it crashes, and nobody restarts it. It is just gone.

So you use a Deployment. One pod dies and another comes back. You want 3 running, it keeps 3 running.

Every pod gets a new IP when it restarts. Another service needs to talk to your app but the IPs keep changing. You cannot hardcode them at scale.

So you use a Service. One stable IP that always finds your pods using labels, not IPs. Pods die and come back. The Service does not care.

But now you have 10 services and 10 load balancers. Your cloud bill does not care that 6 of them handle almost no traffic.

So you use Ingress. One load balancer, all services behind it, smart routing. But Ingress is just rules and nobody executes them.

So you add an Ingress Controller. Nginx, Traefik, AWS Load Balancer Controller. Now the rules actually work.

Your app needs config so you hardcode it inside the container. Wrong database in staging. Wrong API key in production. You rebuild the image every time config changes.

So you use a ConfigMap. Config lives outside the container and gets injected at runtime. Same image runs in dev, staging and production with different configs.

But your database password is now sitting in a ConfigMap unencrypted. Anyone with basic kubectl access can read it. That is not a mistake. That is a security incident.

So you use a Secret. Sensitive data stored separately with its own access controls. Your image never sees it.

Some days 100 users, some days 10,000. You manually scale to 8 pods during the spike and watch them sit idle all night. You cannot babysit your cluster forever.

So you use HPA. CPU crosses 70 percent and pods are added automatically. Traffic drops and they scale back down. You are not woken up at 2am anymore.

But now your nodes are full and new pods sit in Pending state. HPA did its job. Your cluster had nowhere to put the pods.

So you use Karpenter. Pods stuck in Pending and a new node appears automatically. Load drops and the node is removed. You only pay for what you actually use.

One pod starts consuming 4GB of memory and nobody told Kubernetes it was not supposed to. It starves every other pod on that node and a cascade begins. One rogue pod with no limits takes down everything around it.

So you use Resource Requests and Limits. Requests tell Kubernetes the minimum your pod needs to be scheduled. Limits make sure no pod can steal from everything around it. Your cluster runs predictably.

[Povilas Korop | Laravel Courses Creator & Youtuber @PovilasKorop]

Laravel tip.

Did you know `CarbonPeriod` can generate every date in a range?

No more missing days in your charts.

[Oliver Prompts @oliviscusAI]

someone built a web-based System Design Simulator.

you drag and drop components (api gateways, dbs, caches) and it actually simulates real-time traffic.

you can watch latency, bottlenecks, and failures happen live...

[Steve Bauman @heystevebauman]

If you’re using Spatie’s Activity Log to capture changes to models, you can easily miss attribution of model changes to a user who dispatched a job from an authenticated request. This is of course because the job is executed outside the HTTP request lifecycle

To resolve this across all your jobs, you can add a causedBy property to a base queued job class, then set it using a listener on the JobQueueing event -- effectively capturing the authenticated user into all your queued jobs (if there is one)

Then, when the job is unserialized from the queue, you can restore the causer captured within, effectively attributing model changes that occurred within it to the authenticated user who caused the dispatch of the job

[Alexandre Daubois @alexdaubois]

CallbackFilterIterator is #PHP array_filter() but lazy.

Wrap any iterator. Pass a callback. Only matching elements come through.

No intermediate array, no memory spike, works on generators, files, anything Traversable!

The filter nobody imports.

[Datastar Cult Leader @DelaneyGillilan]

Even PHP can be fast y'all

https://t.co/XeKAmkVNB2

[Seifeddine / ⵙⵢⴼ 🐘 🦀 @azjezz]

After nearly 7 years, PSL has a new home:

https://t.co/PBG6VQFGzX

[Alexandre Daubois @alexdaubois]

Closure::bind() lets you break into any #PHP object's private scope.

Bind a closure to an object, access private props, call private methods.

It can even replace reflection sometimes, and it certainly is faster.

The testing tool nobody taught you 😉 (please don't do that)

[Alexandre Daubois @alexdaubois]

php://memory is a stream that lives in RAM.
php://temp starts in RAM, spills to disk after 2MB (configurable, see below!).

No tmpfile(). No temp directory. No cleanup.

Perfect for building files in memory before sending in #PHP!

Did you know the "maxmemory: " trick?

[Seifeddine / ⵙⵢⴼ 🐘 🦀 @azjezz]

PSL 5.0 is out! The biggest release of the PHP Standard Library yet.

10 new components: Crypto, Binary, Terminal, Process, TLS, UDP, CIDR, Socks, Ansi, and Interoperability.

Plus a complete networking stack rewrite.

https://t.co/1tmY2uSv7i

#PHP