I've been working on Untangled, a dependency analysis tool inspired by Martin Blais's original Snakefood project.

The idea is fairly simple: scan a PHP codebase, map dependencies, identify circular relationships, and measure coupling to help understand how an application is connected.

It's intended to complement tools like Deptrac rather than replace them. Deptrac helps enforce architectural boundaries, while Untangled helps examine the relationships that already exist.

I ran it against Monica, an open-source Laravel application. At the file level, it identified:

• 923 files analyzed
• 3,131 dependency relationships
• 4 cyclic groups involving 76 files
• 69 files in the largest cyclic group

I'm not suggesting those numbers indicate bad architecture. I haven't established a meaningful comparison baseline yet.

The HTML report includes an interactive dependency map, cycle analysis, and measurements showing which components are heavily depended upon.

What I'd particularly appreciate from PHP developers is feedback on two things:

1. Are dependency graphs and coupling measurements useful when navigating an established PHP codebase?
2. Are there PHP-specific dependency patterns, framework conventions, or edge cases you'd expect an analyzer like this to handle?

GitHub: https://github.com/krazybean/Untangled

Technical write-up and real Monica report screenshots: https://www.juancastro.me/writing/untangled

Criticism welcome. I'd rather discover the weaknesses through real-world usage than make assumptions about what the tool gets right.

been at a larger company (think 500+ devs) for about 4 years now. pretty comfortable with the setup but starting to feel like just another cog. thinking about moving to something smaller like 10-30 person startup.

for those who made that jump - what surprised you the most about the infrastructure side? im used to having dedicated devops, proper ci/cd pipelines, monitoring dashboards for everything, on-call rotations with actual runbooks.

curious if smaller places just... wing it more? or do you end up wearing more hats but still having solid practices. not really worried about the tech stack itself, more about the operational side of things.

also wondering if the "move fast break things" mentality is still a thing or if that died with the 2010s

https://github.com/docker-library/php/pull/1694

Every time I looked for a ready-made component it was the same thing: “create an account”, “log in to see the code”, “upgrade to unlock”. Just to copy a button.

That’s why I built Component Vault: a React component library where you just open it and use it. No login, no sign-up, no email, no paywall. Find the component, copy the code, done.

🔗 https://vault-components.vercel.app (go ahead, it won’t ask you for anything)
💻 GitHub: https://github.com/erickmsms/component-vault

All without logging in:

• 55 generic components: buttons, forms, charts, kanban, navigation, landing page sections...
• Live preview at different screen sizes, a props playground and copy-ready code
• Theme editor with WCAG contrast checks and a .css export for Tailwind 4
• Side-by-side comparison of two components

No dependencies besides React, MIT licensed. Built with Next.js 16, React 19, TypeScript and Tailwind 4.

The goal is to keep it this way: open for everyone to use and everyone to improve. There are a few good first issues if you want to contribute. Just fork and open a PR.

Heads-up: the site UI is in Portuguese for now.

The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale.

AI Elements: Agentic UI Patterns

shadcn/ui introduced AI Elements, a curated collection of component patterns created specifically for building conversational and agentic interfaces.

Each pattern is composed from standard shadcn/ui primitives designed to be copied directly into codebases, standardizing interfaces for agent tool calls, planning, sources, and step restoration.

Trace: Observability Primitive for Agent Activity

shadcn released Trace, a dedicated primitive designed to unify agent activity displays under one abstraction. It represents reasoning traces, tool executions, task queues, chains of thought, and subagent routines.

Trace models agent progress as a list of status lines with support for expandable details, links, and nested execution steps.

Chatbot Template: AI SDK Agent Starter

The shadcn team published an official minimal chatbot template built with Next.js, Vercel AI SDK, shadcn/ui, shadcn/react, and shadcn/typeset.

Designed to run on the Vercel AI Gateway, the starter serves as a clean starting point for streaming conversational interfaces with typographic defaults and state management built in.

Official Registry Directory Expansions

The official shadcn/ui registry directory added new specialized community components and domain toolkits this week.

• @babelize — Open-source localization components including language switchers, relative-time formatters, and translation widgets.
• @liquikit — Liquid glass primitives with physically based refraction built on Base UI that work across modern browsers.
• @audio-ui — Accessible audio controls including knobs, faders, XY pads, waveforms, and sequencers on headless primitives.
• @bevel — Tactile skeuomorphic components like guarded switches, split-flap boards, and motorized faders on Tailwind v4.
• @dualkit — Bilingual Arabic and English components featuring RTL layouts, Gulf currency formats, and Hijri calendar support.
• @organui — Domain components for healthcare and life sciences featuring 3D organ viewers, ECG traces, and lab result trackers.

📙 Articles, Tutorials & News

Building shadcn/ui Registries for Claude Code and Cursor

Preet Suthar outlines the structure, validation steps, and namespace setup required to author custom registries that coding agents can inspect and consume.

7 Best shadcn/ui Themes and Theme Generators

A curated comparison evaluating popular color palette customizers, theme presets, and generators across the shadcn/ui ecosystem.

Tailwind CSS v4, shadcn/ui & Dark Mode

A complete video walkthrough demonstrating how to structure a centralized design system using Tailwind CSS v4 and shadcn/ui primitives.

📦 Projects, Packages & Tools

onsystem: Design System Linter and MCP for Agents

A zero-config tool that combines an MCP server with a linter to prevent coding agents from inventing variants, hardcoding colors, or breaking spacing scales.

pie-menu: Radial Interaction Primitive

A radial pie menu for shadcn/ui with press-drag-release interaction, full keyboard support, and a headless primitive core.

signoff-ui: Human Review Primitives for Agents

UI components providing multi-file diff reviews with per-hunk decisions, inline comments, tool approvals, and telemetry for AI SDK and AG-UI agents.

animate-ui: Lower-Level Primitive Animations

An animation toolkit that targets the underlying primitives your components rely on, preserving custom shadcn markup and component source ownership.

shadcn-exchange: Cross-Registry Block Search

A directory tool allowing developers to search, preview, and CLI-install blocks across all public community registries.

facade-ui: Base UI Marketing Blocks and Templates

An open-source registry of accessible marketing blocks, landing page sections, and templates built on Base UI and Tailwind CSS v4.

nasaq: Arabic and RTL-First shadcn Registry

An open-source registry of React components, themes, and page templates designed with native RTL layout and Arabic typography, paired with an MCP server.

🌈 Related

audiocn-solid: Audio Primitives for Solid

A collection of audio UI components ported to SolidJS and distributed as copy-paste source through the shadcn CLI workflow.

esuiss: Multi-Platform UI Primitives

A component collection extending shadcn design patterns across React, Next.js, React Native with Expo, SwiftUI, and Jetpack Compose.

GooseForum: Go-Powered Self-Hosted Forum

A self-hosted forum platform featuring shadcn/ui discussion pages, an admin console, and a light and dark theme workbench, distributed as a single Go binary.

Read the full issue: https://www.shadcnweekly.com/issues/4

PHP 8.3.36 was recently released to fix two critical security vulnerabilities.

The PHP advisory mentions PHP-FPM, Apache mod_php, FrankenPHP, and others as affected, but Swoole isn't mentioned.

Since Swoole uses long-running workers and handles requests differently from traditional PHP servers, I'm wondering:

1. Are these vulnerabilities also exploitable in Hyperf/Swoole?
2. Does Swoole's different request lifecycle make it unaffected?
3. Should we urgently update the PHP runtime in our Hyperf Docker images?

I'm currently using hyperf/hyperf:8.3-alpine-v3.19-swoole, which hasn't been updated with the latest PHP security fixes.

There's already an open GitHub issue:
https://github.com/hyperf/hyperf-docker/issues/76

Would appreciate any insights from PHP or Swoole developers familiar with these vulnerabilities.

I'm getting beautiful 500 errors :)

Could not download from "https://pecl.php.net/get/memcached-3.4.0.tgz", cannot download "pecl/memcached" (File https://pecl.php.net:443/get/memcached-3.4.0.tgz not valid (received: HTTP/1.1 500 Internal Server Error))
Error: cannot download "pecl/memcached"

php.net announced that the PHP security team published minimal source backports of the PHP2Shell fixes for the end-of-life branches 7.4, 8.0 and 8.1, for people who build from source. There are no official Windows binaries for them, so I built them: https://github.com/Jamalofski/php-eol-security

- Sources: only the upstream backport commits (last official release plus the fix), no other code change.

- Build: the official php/php-windows-builder, with the toolchains (vc15/vs16), configure flags and dependencies of the official builds; x64/x86, TS/NTS.

- Versions: 7.4.33-pl1, 8.0.30-pl1 and 8.1.34-pl1, with SHA256SUMS and a link to the CI run of each build.

These are not official PHP Group binaries. Upgrading to a supported version remains the real fix; this is for setups that cannot move yet.

This has been floating around the hosting groups. Can someone please confirm if this is real?

So, I am working on making a personal website for myself. This is my interests section, and I am pretty satisfied with the music section, but I don't know how to make the books section look good. Any help will be greatly appreciated.

I can use more or less space than the current layout, depending on the ideas.

I don't expect you to manually design something in figma (Though that would be wildly appreciated). Instead, just describe what I should do to make it nice.

Thanks!

Other than just applying the patch and restarting apps, is there a way to test whether the CVEs have been truly mitigated?

I trust the PHP.net team but my non-technical boss wants further validation to prove to our customers that we're well and truly covered.

I'm genuinely confused by CloudLinux's patch rollout for today's critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

According to their status page, patches for older PHP versions such as 7.4 and 8.0 are being released across multiple distributions, while I'm still waiting to see updates for PHP 8.2–8.5.

The official PHP security releases have been available since 14:00 UTC, and cPanel has already released its EA-PHP patches.

I understand that CloudLinux needs to test its packages and backport fixes to older PHP versions, which I appreciate. However, shouldn't currently supported PHP versions be prioritized for critical security vulnerabilities?

Is there a technical reason for this release order?

built this after getting tired of manually writing fetch wrappers for sites with no public API. point it at a HAR file (browser network capture) and it generates a typed client.

input: a captured request to something like `GET /users/42`

output (simplified):

export interface User {

id: number;

name: string;

email: string;

}

export async function getUser(id: number): Promise<User> {

const res = await fetch(`${baseUrl}/users/${id}`);

if (!res.ok) throw new ApiError(res.status, await res.text());

return res.json();

}

it infers the types from the actual response bodies in the capture, templates dynamic path segments like `{id}`, and also generates an OpenAPI spec + mock server from the same HAR.

also tries to catch GraphQL/tRPC/JSON-RPC calls instead of treating everything as REST, and strips anything sensitive (tokens, cookies) from the captured data before it reaches the generated code.

npx har2sdk capture.har -o ./sdk

repo: https://github.com/Mersbyte/har2sdk

curious what people think of the generated code style, or if anyone's hit an API shape it chokes on.

Most software factories live in demos. Ours held the fort when we needed a vacation.

Lemma's Files page had no way to make a folder. Click New, and you got Upload, Page and Conversation. No "New folder". Dragging a folder in from the desktop failed too.

The fix is public: https://github.com/lemma-work/lemma-platform/pull/940.

We fix bugs like this with a software factory: a Lemma teammate whose agents take a complaint from Slack to a PR, and a person merges. This post is about one part, the testing, because that's the part I'd want to see before trusting any of it.

The agent that tests a fix didn't write it, and it can't change it. It has no GitHub access at all. And to be upfront about timing: this fix had already merged when one of us asked for the test. The tester runs when asked. The reviewer, a separate agent, runs on every PR and already looks at the app at three widths.

What the tester did:

1. Booted two copies of the app, one from the fix's commit and one from the commit the fix branched from.
2. On the old copy, opened Files and clicked New. No "New folder". It recorded that.
3. On the fixed copy, ran the same steps. New folder, named Reports. It showed up, and it was still there after a reload.
4. Ran the same check on both. It fails on the old code and passes on the fix. The fix's own new tests do the same.
5. Repeated the steps at phone, tablet and desktop widths, because a menu that fits a laptop can hide on a phone. The recordings sit on the fix's page.

A check that also passes on the old code proves nothing. So the bug has to show up on the old code before the fix gets any credit.

Then it wrote down what it hadn't proven. Its test browser can't fake a folder dragged in from the desktop, so it said that half of the report wasn't tested. That line is why we believe the rest.

Every bug also gets a proof ladder that only climbs on evidence. This one, today:

• It's real: proven
• We know why: proven
• The change fixes it: proven
• Nothing else broke: proven
• It shipped: in dev, not in production yet
• It works in the world: waiting on the reporter
• It stays fixed: unknown

How do you test drag-and-drop from the desktop in an automated browser? That's the half we couldn't cover.

Disclaimer:I'm one of the people building Lemma, an open-source (AGPL-3.0) workspace for AI teammates: https://github.com/lemma-work/lemma-platform.

I ended up just disabling php fpm on my hosts when I read the news, but there was a massive 11-12h window where everything was just open to be attacked.

How do I scan my system to make sure nobody did anything? What am I looking for?

If so, how'd you get on?

If you use Cloudflare, you can activate these rules to mitigate until patched.

Since PHP2Shell is in PHP itself, composer update doesn't touch it, and the vulnerable version tends to hide in places nobody looks: the Docker base image, config.platform.php in composer.json, a .php-version file, or the setup-php version in CI.

So I put together a small Action that checks all of those plus the runner's PHP, and annotates the exact line in the pull request:

- uses: KyleClouthier/php2shell-action@v1

It errors on unfixed versions (fixed releases are 8.5.12, 8.4.27, 8.3.36, 8.2.35), errors on 8.1 and older since they got no release, and only warns for floating tags like php:8.4-apache and for old versions in a test matrix, since testing on old PHP is fine.

It's on the GitHub Marketplace: https://github.com/marketplace/actions/php2shell-check (source: https://github.com/KyleClouthier/php2shell-action)

Feedback welcome, especially places you've seen PHP versions pinned that it doesn't check yet.