🐘 FrankenPHP 1.13 is out, and it's a big one. @caddyserver 2.11.7 inside: - Slowloris protection with idle read/write timeouts - url_pattern matcher, using the URLPattern web standard - Incremental header (RFC 10036) for streaming responses - SSE behind encode now streams immediately @MercureRealTime 1.0, the stable real-time protocol, built in. Also, mercure_publish() now validates updates and throws on bad input. Config reloads are now validated before replacing the running one: no more 500s after a broken reload. 5 security vulnerabilities fixed, 2 rated high. Upgrade now, and read the upgrade notes first. github.com/php/frankenphp/re…

🥳 @laravel 13 will have native support for @MercureRealTime!! 🪽🤝 github.com/laravel/framework…

🚀 Mercure 1.0 alpha is here! The biggest release in the project’s history brings: 🎯 New matcher system built on top of the WHATWG URL Pattern ⚙️ Revamped authorization mechanism using OAuth 2.0 Rich Authorization Requests 🛠️ Brand-new UI debugger and dev playground 🔒 Security hardening 🔄 0.x compatibility mode for easy migration 📖 Read the announcement and try the updated demo: dunglas.dev/2026/08/mercure-…

Isolate deprecated code in dedicated files behind dedicated build tags. Years later you delete ~1,700 lines in one PR, zero issues. Thanks, past-me. github.com/dunglas/mercure/p…

🐘 FrankenPHP 1.12.4 is out: a security hardening release. Highlights: - Underscore header spoofing blocked at the server layer. The bundled @caddyserver 2.11.4 now ignores header names containing underscores, closing a class of $_SERVER spoofing. - Bundled @MercureRealTime 0.24.2 security fixes: SSE field injection (CWE-93), reserved-topic forgery, Last-Event-ID disclosure, DoS amplification caps. - Worker-mode crash and data-race fixes: ext-parallel, metrics, save/close handler. Every user should upgrade. github.com/php/frankenphp/re…

🔒 @MercureRealTime 0.24.2 is out, a security hardening release for the real-time hub. It rejects SSE field injection (CWE-93) via the id and type fields, blocks forgery of the reserved /.well-known/mercure namespace, fixes a Last-Event-ID metadata leak, and caps element counts to defang DoS amplification. Every hub operator should upgrade. github.com/dunglas/mercure/r…

🛰 @MercureRealTime 0.24.1 is out, riding on @caddyserver 2.11.3. We just contributed native OTLP metrics push to Caddy upstream. Mercure hubs can now ship metrics straight to your OpenTelemetry collector. No Prometheus scrape job needed. Drop metrics { otlp } into your Caddyfile and the standard OTEL_* env vars do the rest. Endpoint, protocol, headers, interval, all of it. Pairs nicely with the OTel tracing that landed in 0.24, so traces + metrics work end-to-end against any OTLP backend (Grafana Alloy, OTel Collector, Tempo/Mimir, Honeycomb, Datadog, …). Release notes: github.com/dunglas/mercure/r… Upstream Caddy PR: github.com/caddyserver/caddy…

🚀 Mercure 0.24 is out! @MercureRealtime gains native OpenTelemetry tracing for the Hub: dedicated spans nest under @caddyserver's tracing directive, with zero allocations when disabled. Also in this release: • file:// URLs for publisher_jwks_url and subscriber_jwks_url, so you can mount a JWK Set as a Kubernetes Secret instead of running a sidecar. • A @HelmPack chart that satisfies the restricted Pod Security Standard out of the box: rootless UID 1000, drop ALL caps, read-only rootfs. On the Enterprise side, all four production transports (Redis, PostgreSQL, Kafka, Pulsar) now emit OpenTelemetry spans too, with attributes and error recording matching the upstream pattern. github.com/dunglas/mercure/r…

🚀 @MercureRealTime v0.23.5 is out! This release focuses heavily on Helm chart hardening. After a recent cluster audit, we've shipped the necessary constraints directly into the OSS chart. Key highlights: 🔒 Opt-in NetworkPolicy & CiliumNetworkPolic 📁 readOnlyRootFilesystem works out of the box 🛡️ Restricted PodSecurity defaults I wrote a blog post breaking down the full story, the new security features, and how to configure them. Read it here: dunglas.dev/2026/05/mercure-… #Kubernetes #Helm #DevOps #MercureRocks

🚨 @MercureRealTime 0.23 is officially out! 🚨 This release brings a massive operational improvement for modern infrastructures, along with new Helm chart features. If you are running Mercure at scale, you'll want this update! 🚀 Here is what's new in v0.23.0: 🩺 Transport-aware Health Checks: Kubernetes (and other orchestrators) can now detect when a hub's transport connection is actually broken, rather than just checking if the Caddy process is alive. I’ve introduced new /mercure/health/{ready,live} endpoints. The old /healthz HTTP port endpoint is now deprecated. 🛥️ Helm Chart Upgrades: Added support for HTTProute as an alternative to Ingress for Gateway API-based clusters. In addition, you can now configure annotations directly on the Deployment resource. 🏢 Enterprise Goodies: All Enterprise transports (Redis, Postgres, Kafka, and Pulsar) fully implement the new health checks. Production clusters using managed brokers now get 100% accurate readiness/liveness signals out of the box. 🙏 Huge thanks to our new contributor vmignot for adding the deployment annotations feature! Read the full changelog and download the release: 🔗 github.com/dunglas/mercure/r… #Mercure #GoLang #Kubernetes #ServerSentEvents #OpenSource

We've just finalized our next-gen AI-powered security audit tool at @coopTilleuls! We used it to discover and patch a critical vulnerability in @MercureRealTime as well as in several of our clients' projects. The Mercure fix also made topic matching 38% faster! ⚡️ 1. Update Mercure and FrankenPHP immediately. (Using Mercure.rocks Cloud? You're already updated and protected! ☁️✅) 2. Want us to secure your stack? Contact us for a full security audit! ✉️ [email protected] #CyberSecurity #AI #Mercure #FrankenPHP #OpenSource

🔥 @MercureRealTime v0.21.10 is here! 🚀 Built with @golang 1.26 (10–40% reduction in GC overhead) 🛠 Includes @caddyserver 2.11 Faster, leaner, and ready for production. Upgrade now! 🥳 github.com/dunglas/mercure/r…

🎄 Merry Christmas #PHP developers! 🎁 FrankenPHP 1.11 is out now! 🔥 Native Hot Reload (HMR) 🪵 Structured Logging 🚀 Improved Performance 🧸 PLUS: "Le Monstre" plushies are available for @ApiPlatform Con attendees! (Everyone else: Early 2026!) Unwrap it here (blog post, including Hot Reload with WordPress video): dunglas.dev/2025/12/merry-ch…

🧟‍♀️ After days and nights of toil: FrankenPHP 1.10 is alive! 🧟‍♂️ The creature is awake and brings unprecedented power to your #PHP applications: 🐘 PHP 8.5 support 🪽 New mercure_publish() function for easy real-time broadcasting with @MercureRealTime ⚙️ Enhanced extensions & custom workers (hello high-performance gRPC and WebSockets servers!) Downloads and changelog, right from our laboratory: github.com/php/frankenphp/re…