Laravel 13.39.0 fixes a silent failure in Http::batch()
The HTTP client was treating retry() and throw() failures as successes. The same release also fixes a route leak under Octane and blocks the phar:// stream wrapper in two filesystem checks.
Laravel 13.39.0, released 27 October, fixes a correctness bug in the HTTP client: Http::batch() was treating failures as successes when combined with retry() and throw(). A batched request that exhausted its retries and failed should raise an exception, not report success.
The same release closes two other gaps. Under Octane, a stale route object could leak from one request into the next request’s 404 response, a side effect of Octane’s persistent worker model that a normal request-per-process setup never hits. And Filesystem::exists() and isFile() now block the phar:// stream wrapper, closing a known PHP object-injection route for any app that passes user input into a filesystem check.
Why it matters: if your code calls Http::batch() with retry() and throw() to catch failed requests, treat this as a correctness fix, not a nice-to-have. A batch call silently reporting success on failure is the kind of bug that only shows up later, as missing data nobody noticed was missing.