Laravel 13.31 hardens cookie-based auth and makes Redis queues cluster-safe

Laravel 13.31.0 shipped on 8 September 2026. Behind a minor version number, this release closes a security gap in the “remember me” cookie flow, makes Redis queues cluster-safe and refines several Eloquent behaviours. Around forty fixes round out the set, from the HTTP client to migrations.

#A security fix in cookie-based authentication

The most sensitive change concerns the “remember me” mechanism. Laravel now ensures that the password hash matches the one stored in the recaller cookie before authenticating the user. The fix, first backported to the 12.x branch, closes a window in which a recaller cookie could remain usable after a password change.

In the same area, a TypeError that occurred in userFromRecaller() when the cookie matched no user has been fixed. Applications that rely heavily on persistent login should apply the upgrade promptly.

#Cluster-safe Redis queues

The Redis queue driver gains a cluster-safe implementation: the MULTI and KEYS operations are reworked to behave correctly when keys are spread across several nodes. On infrastructures that run Redis in cluster mode, this removes a class of bugs that were hard to reproduce.

Two additions accompany the work. A Queue::totalSize() method exposes the size of a queue, and a new JobInterrupted event fires when a job is interrupted. The WorkerStopping event now carries the connection and queue name when a worker is killed, which makes supervising production workers easier.

use Illuminate\Support\Facades\Queue;
use Illuminate\Queue\Events\JobInterrupted;
use Illuminate\Support\Facades\Event;

// Nouveau en 13.31 : lire la taille d'une file
$taille = Queue::totalSize('default');

// Reagir a l'interruption d'un job
Event::listen(function (JobInterrupted $event) {
    logger()->warning('Job interrompu', [
        'connexion' => $event->connectionName ?? null,
    ]);
});

#Eloquent, lazy queries and the HTTP client

On the ORM side, chaperone support arrives for BelongsToMany pivot models: models loaded from a pivot table keep their parent relation without an extra query, avoiding the classic N+1 problem. The closure scope passed to wherePivot() has also been fixed.

Two long-standing regressions disappear. The lazy() and lazyById() methods now respect limit() and offset(), which they used to ignore. The HTTP client sees a memory leak fixed, and the RateLimited middleware now actually blocks jobs that hit the limit.

A minor version number can carry a security fix: upgrading is not a cosmetic operation.

#Upgrading: what to check

13.31 stays on the 13.x branch: the update is a composer update, with no major version jump. The table below sums up the changes to know before deploying.

#What to take away

Laravel 13.31.0 is a maintenance release that is at once ordinary and important: ordinary in its format, important for its cookie-authentication security fix and for making Redis queues cluster-safe. Teams that use “remember me” or distributed workers should deploy it without delay, testing queues on a staging environment first.

Further reading: the full Laravel 13.31.0 release notes on GitHub.