Laravel shipped version 13.40.0 of its framework on November 3, 2026. The release brings two monitoring hooks long requested by teams running queues in production, a batch of database connection fixes, and a security patch to the Concurrency facade, which now authenticates the result envelope of each process to prevent output injection into a concurrent task.
What’s in version 13.40
The release spans a wide surface: Eloquent, queues, the task scheduler and framework internals. Two additions stand out for back-end teams running large-scale asynchronous processing, alongside a dozen fixes across MySQL, MariaDB, PostgreSQL and SQL Server.
| Area | Change | Practical effect |
|---|---|---|
| Queues | Queue::whenJobRunsLongerThan() | Fires an alert when a job exceeds a defined duration threshold |
| Scheduler | Schedule::whenTaskRunsLongerThan() | Same mechanism for scheduled tasks |
| Security | Authenticated Concurrency envelope | Prevents output injection into a concurrent process |
| Database | Reconnect after a dropped transaction connection | Falls back to a savepoint on concurrency errors |
| Pagination | Fixed cursorPaginate() on union queries | Avoids inconsistent pagination results |
Watching jobs and tasks that run too long
Until now, catching an abnormally slow queue job meant instrumenting the worker yourself or reaching for a third-party monitoring service. Queue::whenJobRunsLongerThan() lets you wire a callback directly into application code, with no external dependency. Its scheduler counterpart, Schedule::whenTaskRunsLongerThan(), covers the same need for tasks driven by the Scheduler.
use Illuminate\Support\Facades\Queue;
use Illuminate\Support\Facades\Log;
Queue::whenJobRunsLongerThan(
threshold: now()->addMinutes(3),
callback: function ($job) {
Log::warning('Job running abnormally long', [
'job' => $job->resolveName(),
'queue' => $job->getQueue(),
]);
}
);The callback receives the running job instance, making it easy to pull its name, queue or payload before paging an on-call team. Combined with the new “released” status now shown in queue:work output, this alert closes a classic blind spot in high-volume Laravel deployments.
The Concurrency facade fix
The most sensitive change in this release touches the Concurrency facade, used to run several callbacks in parallel via separate processes. The core team added authentication to the envelope that carries each process’s result, preventing a forged process output from being injected and treated as a legitimate result by the parent process.
An unauthenticated result envelope in an inter-process concurrency mechanism amounts to trusting whatever data crosses the channel, regardless of where it came from.
The fix changes no public signature: applications using Concurrency::run() get the protection with no code changes required. It matters most in environments where concurrent process workers run inside shared containers or multi-tenant infrastructure, where the attack surface between processes is wider.
How to upgrade
The update follows Laravel’s usual patch cycle: a plain composer update laravel/framework is enough for projects already constrained to the 13.x branch. No database migration is required, and the changelog lists no breaking changes.
whenJobRunsLongerThan() right after upgrading rather than waiting for an incident: the threshold takes a few lines and plugs straight into existing alerting channels.Key takeaways
Laravel 13.40 adds two low-effort monitoring hooks for queues and the scheduler, and closes an injection flaw in the Concurrency facade with no compatibility break. The upgrade needs neither a code change nor a migration, making it a low-friction priority for any production application.
On projects where critical jobs run without dedicated monitoring, this kind of addition changes more than a loudly announced feature would. The Concurrency fix is welcome too: few applications use it yet, but those that do to parallelize heavy workloads gain protection that would have been risky to patch themselves. — Simon Janvier
Further reading: full release notes on GitHub.
