FormRequest Strict Mode and Queue Job Inspection in Laravel 13.4.0

Laravel 13.4 introduces a global strict mode for FormRequest that rejects input fields not declared in rules() , new queue facade methods for inspecting jobs by state, and full #[Delay] attribute support across the Bus Dispatcher and NotificationSender. It also includes validation rule fixes, Carbon overflow support, and several bug fixes.

• FormRequest strict mode to reject undeclared input fields
• Queue facade methods to inspect pending, delayed, and reserved jobs
• #[Delay] attribute now works in Bus Dispatcher and NotificationSender
• 碳 overflow option for plus and minus operations
• Multiple validation rule fixes for null values and type errors

# 什么是新的

# FormRequest Strict Mode

A new strict mode for FormRequest rejects any input field not explicitly declared in your rules() method. Laravel's form requests have always validated the 内容 of known fields, but silently ignored undeclared fields — meaning a client could send fields like is_admin 或者 role alongside a legitimate request without triggering a validation error.

Enable it globally from your AppServiceProvider :

使用

照亮\Foundation\Http\FormRequest
;
民众

功能

引导
（）
:

空白
{

表单请求
::
failOnUnknownFields
（
！

应用程序
（）
->
是生产
（））；
}

Or you can opt in per request class with the #[FailOnUnknownFields] 属性：

使用

Illuminate\Foundation\Http\Attributes\FailOnUnknownFields
;
#[
FailOnUnknownFields
]
班级

StoreUserRequest

延伸

表单请求
{

民众

功能

规则
（）
:

大批
{

返回
[

'姓名'

=>

'必填|字符串'
,

'电子邮件'

=>

'必填|电子邮件'
,
]；
}
}

With strict mode enabled, sending an is_admin field alongside name 和 email would fail validation. Individual request classes can opt out by setting the attribute to false :

#[
FailOnUnknownFields
（
错误的
）]
班级

WebhookRequest

延伸

表单请求
{

// Allows unknown fields even when global strict mode is on
}

The flag defaults to false , so existing behavior is unchanged unless you explicitly enable it.

拉取请求： #59430

# Queue Job Inspection Methods

Three new methods on the Queue facade let you inspect jobs by state:

队列
::
待处理职位
（）；
// jobs ready to be processed
队列
::
delayedJobs
（）；
// jobs waiting for their delay to expire
队列
::
reservedJobs
（）；
// jobs currently being processed by a worker

Each returns a Collection 的 InspectedJob 实例 uuid , name , attempts ， 和 createdAt properties:

队列
::
reservedJobs
（
'high-priority'
）
->
第一的
（）
->
姓名;
// => 'App\Jobs\SendEmail'
队列
::
待处理职位
（）
->
按计数
（
'姓名'
（英文）：
// => ['App\Jobs\SendEmail' => 1842, 'App\Jobs\ProcessOrder' => 43]

This is supported on the Database and Redis queue drivers. Other drivers return empty collections.

拉取请求： #59511

# Delay Attribute Support Across Dispatchers

这 #[Delay] attribute introduced in v13.3.0 now works across all dispatchers. Previously, it was only wired into the Event Dispatcher — the Bus Dispatcher read the delay property directly, ignoring the attribute.

使用

Illuminate\Queue\Attributes\Delay
;
#[
Delay
（
30
）]
班级

ProcessInvoice

实现

应该排队
{

使用

可调度
,
可排队
;
}
// Now correctly delayed by 30 seconds when dispatched via Bus or Notifications
ProcessInvoice
::
派遣
（）；

拉取请求： #59514 , #59513

# Carbon Overflow Option

新的 overflow option has been added to Carbon's plus 和 minus methods, giving you control over how date arithmetic handles month-end boundaries. Here's a few examples from the pull request tests:

$carbon
=

碳
::
解析
（
'2026-01-31'
（英文）：
$this
->
断言相同
（
'2026-03-03'
, $carbon
->
加
（
个月
:
1
,
溢出
:
真的
）
->
日期字符串
（））；
$carbon
=

碳
::
解析
（
'2026-01-31'
（英文）：
$this
->
断言相同
（
'2026-02-28'
, $carbon
->
加
（
个月
:
1
,
溢出
:
错误的
）
->
日期字符串
（））；

拉取请求： #59509

# 其他修复和改进

Validation:

• 固定的 TypeError 在 starts_with / ends_with rules on non-string values ( #59541 ）
• Fixed deprecation warnings in Contains 和 DoesntContain rules when values contain null ( #59561 ）
• Fixed deprecation warnings in In 和 NotIn rules when values contain null ( #59576 ）

队列和作业：

• 修复了缺失 Illuminate\Queue\Attributes\Delay 属性 （ #59504 ）
• Fixed runtime property overrides ( onQueue ) taking precedence over class attributes ( #59468 ）
• 固定的 #[WithoutRelations] queue attribute not being inherited by child classes ( #59568 ）

Models & Attributes:

• 固定的 CollectedBy attribute not resolving through abstract parent classes ( #59488 ）
• Fixed static closure binding in remaining manager classes ( #59493 ）

HTTP & Requests:

• 固定的 $request->interval() failing with very small float values ( #59502 ）
• Fixed null redirect handling in unauthenticated exception handler ( #59505 ）
• Allow null to be passed directly to redirectGuestsTo() （ #59526 ）

Strings:

• 固定的 Str::markdown() 和 Str::inlineMarkdown() crash on null input ( #59554 ）

Security:

• 额外 --ignore-scripts to yarn in install:broadcasting command ( #59494 ）

其他：

• 额外 pint.json to export-ignore ( #59497 ）
• Reverted SessionManager clone removal that caused duplicate Redis connections ( #59542 ）

升级说明

No breaking changes are expected for typical applications. The new FormRequest::failOnUnknownFields() 默认为 false , so existing behavior is preserved. Review the full changelog for complete details when upgrading.

参考

• 官方更新日志
• 全面比较
• GitHub 发布