This week in Laravel & Inertia: Markdown mail fix, Oct 26, 2026

A new user signs up with the name Taylor](https://evil.test). Your welcome email says “Hi Taylor”, and the link under that name now goes to a site you’ve never seen.

That one is fixed on Laravel 12 this week. So is a CDN serving your French page to German visitors, and a CSV export that turned into a redirect. Here’s everything that shipped in the Laravel and Inertia world since last Monday, in one short read.

The week at a glance#

Laravel 12.70.1: Markdown mail escaping fix#

Markdown mail has an opt-in mode called secured encoding. You turn it on with Markdown::withSecuredEncoding(), and every {{ $value }} in a Markdown mail view gets its Markdown characters escaped, so user input stays text.

It escaped [ but not ] or \. So a value could close the link it sat in and open a new one. 12.70.1 escapes both, the same change Laravel 13 got in 13.36.0.

Here’s a normal welcome mail with the user’s name inside a link:

<x-mail::message>
Hi [{{ $name }}](https://shop.test/account)

Thanks for signing up.
</x-mail::message>

We rendered that mailable on both versions with secured encoding on. Only 12.70.1 kept the link where you put it.

composer update laravel/framework
php artisan --version   # Laravel Framework 12.70.1
php artisan view:clear

<?php

namespace App\Providers;

use Illuminate\Mail\Markdown;
use Illuminate\Support\ServiceProvider;

class AppServiceProvider extends ServiceProvider
{
    public function boot(): void
    {
        Markdown::withSecuredEncoding();
    }
}

use App\Mail\Welcome;
use Illuminate\Mail\Markdown;

test('a name cannot rewrite the link in the welcome mail', function (string $name) {
    Markdown::withSecuredEncoding();

    expect((new Welcome($name))->render())
        ->toContain('href="https://shop.test/account"')
        ->not->toContain('href="https://evil.test');
})->with([
    'closing bracket' => 'Taylor](https://evil.test)',
    'escaped bracket' => 'Taylor\](https://evil.test)',
]);

Inertia Laravel 3.5.2: Vary, downloads and SSR#

Three bug fixes in the server adapter. No changes on the Vue side.

Your Vary header survives Inertia#

Inertia adds Vary: X-Inertia so a cache never serves the JSON page to a full page load, or the other way round. Until 3.5.2 it set the header, which wiped any Vary your app had already added.

That hurts on localized pages. You add Vary: Accept-Language, Inertia overwrites it, and your CDN caches one language for everyone. Now Inertia appends:

use Illuminate\Http\Request;
use Inertia\Inertia;

public function __invoke(Request $request)
{
    return Inertia::render('Pricing')
        ->toResponse($request)
        ->setVary('Accept-Language');
}

This matters when the header is set inside Inertia’s middleware: in the controller, or in a middleware that runs after HandleInertiaRequests. A middleware that wraps Inertia’s was never overwritten. X-Inertia is not added twice if you already set it.

Downloads and “0” no longer become redirects#

On an Inertia request, an empty 200 response is turned into a redirect back (the onEmptyResponse hook). The check used PHP’s empty(), which also matched two responses that aren’t empty:

• a streamed or file download (response()->streamDownload(), response()->download(), Storage::download()), whose content is false
• a body of "0"

Both came back as a 302. Now only a body that is exactly '' counts as empty.

Route::get('/orders/export', fn () => response()->streamDownload(
    fn () => print('id,total'), 'orders.csv'
));
// GET /orders/export with X-Inertia: true → 302 Found

Route::get('/orders/export', fn () => response()->streamDownload(
    fn () => print('id,total'), 'orders.csv'
));
// GET /orders/export with X-Inertia: true → 200, orders.csv

Controllers that return nothing still redirect back, as before.

SSR tests render the right page#

The SSR state cached the first server-rendered response so the head and body don’t call the SSR server twice. It never cleared that cache when the page changed. In feature or browser tests that make several requests in one test, every later page got the first page’s HTML. 3.5.2 resets it when the page changes. In production each request is fresh, so this mostly fixes confusing tests. More on SSR in Server-render a Laravel and Vue Inertia app.

composer update inertiajs/inertia-laravel
composer show inertiajs/inertia-laravel | grep versions   # * v3.5.2

laravel/ai 0.11.3: backports for the 0.x line#

The 0.x line still gets fixes while 1.x moves on. If you haven’t moved to 1.x yet, this release brings a lot of what 1.x users already have.

A 100 MB limit on remote files#

Image::fromUrl(), Document::fromUrl() and the other remote files used to download the whole file with no limit, so a huge file filled worker memory. Now the download stops at 100 MB and throws an InvalidArgumentException that names the limit. A file whose Content-Length is too big fails before the body downloads.

The key is the same as on 1.3, ai.remote_files.max_size, in kilobytes. It isn’t in the published config, so add it yourself:

'remote_files' => [
    'max_size' => 25 * 1024, // kilobytes, so 25 MB
],

The full story, with the 1.x details, is in Laravel AI SDK 1.3: typed structured output and file limits.

Page through a stored conversation#

The conversation store could hand the model its latest messages, but without IDs, timestamps or tool state. To show a chat history you had to query the ConversationMessage model yourself.

0.11.3 adds three opt-in contracts, and the default database store implements all of them:

The paginator uses a cursor, not page numbers, because a chat grows while you read it. It plugs straight into Inertia’s infinite scroll:

use Illuminate\Http\Request;
use Inertia\Inertia;
use Laravel\Ai\Contracts\ConversationStore;

public function show(Request $request, string $conversation, ConversationStore $store)
{
    $user = $request->user();

    abort_unless($store->conversationBelongsTo($conversation, $user->getMorphClass(), $user->getKey()), 404);

    return Inertia::render('Chat/Show', [
        'messages' => Inertia::scroll(fn () => $store->paginateConversationMessages($conversation, perPage: 20)),
    ]);
}

<script setup lang="ts">
import { InfiniteScroll } from '@inertiajs/vue3'

defineProps<{
    messages: { data: { id: string; role: string; content: string }[] }
}>()
</script>

<template>
    <InfiniteScroll data="messages" reverse>
        <p v-for="message in messages.data" :key="message.id" :class="message.role">
            {{ message.content }}
        </p>
    </InfiniteScroll>
</template>

In our test, another user got a 404, and the owner got the newest messages first with a nextPage cursor in scrollProps. Each StoredMessage also has created_at, usage, meta, tool_calls, tool_results and attachments.

If you build tool approval flows, pendingApprovalsFor() gives a reloaded page the same calls the paused response had. The flow itself is in Approve an AI SDK tool before it runs.

Everything else in 0.11.3#

composer update laravel/ai
composer show laravel/ai | grep versions   # * v0.11.3

Upgrade notes#

• Laravel 12: update to 12.70.1, then turn on Markdown::withSecuredEncoding() if user input reaches Markdown mail. Run php artisan view:clear after the update.
• Inertia Laravel: no code changes. Purge CDN pages that should vary by another header, and check any code that relied on downloads redirecting (it shouldn’t have).
• laravel/ai 0.x: remote files over 100 MB now throw. Set ai.remote_files.max_size (kilobytes) if you need more. The new conversation contracts are opt-in.
• Then run your tests. Nothing else breaks this week.

Recap#

• Laravel 12.70.1 escapes ] and \ in secured Markdown mail, so user input can’t move your links. 13.x has had it since 13.36.0.
• Inertia Laravel 3.5.2 appends to Vary, lets downloads and "0" through, and resets the cached SSR page.
• laravel/ai 0.11.3 gives 0.x the 100 MB remote file limit, conversation pagination with an ownership check, and OpenRouter reranking and audio.

FAQ#

Next steps#

• Laravel AI SDK 1.3: typed structured output and file limits, the 1.x side of the file limit.
• Continue an AI SDK conversation you own
• Laravel 13.36: validation rule builders, Vitess olap() and sticky queue flushes, where the mail fix first shipped.
• Laravel docs: Markdown mailables

Sources#

• Laravel v12.70.1 release: PR #62027 (12.x backport), PR #61755 (13.x original), Laravel v13.36.0 release
• Inertia Laravel v3.5.2 release: PR #920 (Vary), PR #919 (empty responses), PR #924 (SSR state)
• Inertia docs: infinite scroll
• laravel/ai v0.11.3 release: PR #1151 (remote file limit), PR #990 (pagination), PR #991 (streamed sources), PR #992 (pending approvals), PR #993 (ownership), PR #999 (OpenRouter reranking), PR #998 and PR #1126 (OpenRouter audio)
• Laravel AI SDK docs: conversations