Merge branch 'main' into replace_guidelines_from_vendor

Author: pushpak1300

.ai/pint/core.blade.php

@@ -4,9 +4,9 @@
 # Laravel Pint Code Formatter
 
 @if($assist->supportsPintAgentFormatter())
-- You must run `{{ $assist->binCommand('pint') }} --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
+- If you have modified any PHP files, you must run `{{ $assist->binCommand('pint') }} --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
 - Do not run `{{ $assist->binCommand('pint') }} --test --format agent`, simply run `{{ $assist->binCommand('pint') }} --format agent` to fix any formatting issues.
 @else
-- You must run `{{ $assist->binCommand('pint') }} --dirty` before finalizing changes to ensure your code matches the project's expected style.
+- If you have modified any PHP files, you must run `{{ $assist->binCommand('pint') }} --dirty` before finalizing changes to ensure your code matches the project's expected style.
 - Do not run `{{ $assist->binCommand('pint') }} --test`, simply run `{{ $assist->binCommand('pint') }}` to fix any formatting issues.
 @endif

CHANGELOG.md

@@ -1,6 +1,23 @@
 # Release Notes
 
-## [Unreleased](https://github.com/laravel/boost/compare/v2.1.7...main)
+## [Unreleased](https://github.com/laravel/boost/compare/v2.1.8...main)
+
+## [v2.1.8](https://github.com/laravel/boost/compare/v2.1.7...v2.1.8) - 2026-02-20
+
+### What's Changed
+
+* Fix read-only bypass in DatabaseQuery via CTE-wrapped writes by [@sulimanbenhalim](https://github.com/sulimanbenhalim) in https://github.com/laravel/boost/pull/588
+* Fix sendBeacon browser logs silently dropped on page unload by [@sulimanbenhalim](https://github.com/sulimanbenhalim) in https://github.com/laravel/boost/pull/590
+* Fix post-install Next steps URL by [@sulimanbenhalim](https://github.com/sulimanbenhalim) in https://github.com/laravel/boost/pull/587
+* Fix issue with Codex not automatically triggering the login flow by [@jessarcher](https://github.com/jessarcher) in https://github.com/laravel/boost/pull/592
+* Scope Pint guideline to PHP file changes only by [@pushpak1300](https://github.com/pushpak1300) in https://github.com/laravel/boost/pull/593
+* Allow overriding the browser log channel by [@pushpak1300](https://github.com/pushpak1300) in https://github.com/laravel/boost/pull/594
+
+### New Contributors
+
+* [@sulimanbenhalim](https://github.com/sulimanbenhalim) made their first contribution in https://github.com/laravel/boost/pull/588
+
+**Full Changelog**: https://github.com/laravel/boost/compare/v2.1.7...v2.1.8
 
 ## [v2.1.7](https://github.com/laravel/boost/compare/v2.1.6...v2.1.7) - 2026-02-18
 

src/BoostServiceProvider.php

@@ -117,6 +117,12 @@ protected function registerRoutes(): void
         Route::post('/_boost/browser-logs', function (Request $request) {
             $logs = $request->input('logs', []);
 
+            // Handle sendBeacon's text/plain content type.
+            if (empty($logs) && ! $request->isJson()) {
+                $decoded = json_decode($request->getContent(), true);
+                $logs = $decoded['logs'] ?? [];
+            }
+
             /** @var Logger $logger */
             $logger = Log::channel('browser');
 
@@ -175,6 +181,10 @@ private static function buildLogMessageFromData(array $data): string
 
     protected function registerBrowserLogger(): void
     {
+        if (config('logging.channels.browser') !== null) {
+            return;
+        }
+
         config([
             'logging.channels.browser' => [
                 'driver' => 'single',

src/Console/InstallCommand.php

@@ -136,7 +136,7 @@ protected function performInstallation(): void
 
     protected function outro(): void
     {
-        $url = 'https://boost.laravel.com/installed/';
+        $url = 'https://laravel.com/docs/boost';
         $link = $this->hyperlink($url, $url);
         $text = 'Enjoy the boost 🚀 Next steps: ';
 

src/Install/Agents/Codex.php

@@ -66,7 +66,8 @@ public function mcpConfigKey(): string
     public function httpMcpServerConfig(string $url): array
     {
         return [
-            'url' => $url,
+            'command' => 'npx',
+            'args' => ['-y', 'mcp-remote', $url],
         ];
     }
 

src/Mcp/Tools/DatabaseQuery.php

@@ -66,8 +66,14 @@ public function handle(Request $request): Response
         $isReadOnly = in_array($firstWord, $allowList, true);
 
         // Additional validation for WITH … SELECT.
-        if ($firstWord === 'WITH' && ! preg_match('/with\s+.*select\b/i', $query)) {
-            $isReadOnly = false;
+        if ($firstWord === 'WITH') {
+            if (! preg_match('/\)\s*SELECT\b/i', $query)) {
+                $isReadOnly = false;
+            }
+
+            if (preg_match('/\)\s*(DELETE|UPDATE|INSERT|DROP|ALTER|TRUNCATE|REPLACE|RENAME|CREATE)\b/i', $query)) {
+                $isReadOnly = false;
+            }
         }
 
         if (! $isReadOnly) {

tests/Feature/BoostServiceProviderTest.php

@@ -35,6 +35,22 @@
         expect(app()->bound(Laravel\Roster\Roster::class))->toBeTrue()
             ->and(config('logging.channels.browser'))->not->toBeNull();
     });
+
+    it('does not override an existing browser log channel', function (): void {
+        Config::set('boost.enabled', true);
+        Config::set('logging.channels.browser', [
+            'driver' => 'daily',
+            'path' => storage_path('logs/custom-browser.log'),
+        ]);
+        app()->detectEnvironment(fn (): string => 'local');
+
+        $provider = new BoostServiceProvider(app());
+        $provider->register();
+        $provider->boot(app('router'));
+
+        expect(config('logging.channels.browser.driver'))->toBe('daily')
+            ->and(config('logging.channels.browser.path'))->toBe(storage_path('logs/custom-browser.log'));
+    });
 });
 
 describe('environment restrictions', function (): void {

tests/Unit/Install/Agents/CodexTest.php

@@ -101,11 +101,12 @@
     expect($codex->skillsPath())->toBe('.agents/skills');
 });
 
-test('httpMcpServerConfig returns url-only config', function (): void {
+test('httpMcpServerConfig returns npx mcp-remote config', function (): void {
     $codex = new Codex($this->strategyFactory);
 
     expect($codex->httpMcpServerConfig('https://nightwatch.laravel.com/mcp'))->toBe([
-        'url' => 'https://nightwatch.laravel.com/mcp',
+        'command' => 'npx',
+        'args' => ['-y', 'mcp-remote', 'https://nightwatch.laravel.com/mcp'],
     ]);
 });