FormRequest Strict Mode and Queue Job Inspection in Laravel 13.4.0

Laravel 13.4 introduces a global strict mode for FormRequest that rejects input fields not declared in rules(), new queue facade methods for inspecting jobs by state, and full #[Delay] attribute support across the Bus Dispatcher and NotificationSender. It also includes validation rule fixes, Carbon overflow support, and several bug fixes.

• FormRequest strict mode to reject undeclared input fields
• Queue facade methods to inspect pending, delayed, and reserved jobs
• #[Delay] attribute now works in Bus Dispatcher and NotificationSender
• Carbon overflow option for plus and minus operations
• Multiple validation rule fixes for null values and type errors

#What's New

#FormRequest Strict Mode

A new strict mode for FormRequest rejects any input field not explicitly declared in your rules() method. Laravel's form requests have always validated the content of known fields, but silently ignored undeclared fields — meaning a client could send fields like is_admin or role alongside a legitimate request without triggering a validation error.

Enable it globally from your AppServiceProvider:

use Illuminate\Foundation\Http\FormRequest;
 
public function boot(): void
{
    FormRequest::failOnUnknownFields(! app()->isProduction());
}

Or you can opt in per request class with the #[FailOnUnknownFields] attribute:

use Illuminate\Foundation\Http\Attributes\FailOnUnknownFields;
 
#[FailOnUnknownFields]
class StoreUserRequest extends FormRequest
{
    public function rules(): array
    {
        return [
            'name' => 'required|string',
            'email' => 'required|email',
        ];
    }
}

With strict mode enabled, sending an is_admin field alongside name and email would fail validation. Individual request classes can opt out by setting the attribute to false:

#[FailOnUnknownFields(false)]
class WebhookRequest extends FormRequest
{
    // Allows unknown fields even when global strict mode is on
}

The flag defaults to false, so existing behavior is unchanged unless you explicitly enable it.

Pull Request: #59430

#Queue Job Inspection Methods

Three new methods on the Queue facade let you inspect jobs by state:

Queue::pendingJobs();    // jobs ready to be processed
Queue::delayedJobs();    // jobs waiting for their delay to expire
Queue::reservedJobs();   // jobs currently being processed by a worker

Each returns a Collection of InspectedJob instances with uuid, name, attempts, and createdAt properties:

Queue::reservedJobs('high-priority')->first()->name;
// => 'App\Jobs\SendEmail'
 
Queue::pendingJobs()->countBy('name');
// => ['App\Jobs\SendEmail' => 1842, 'App\Jobs\ProcessOrder' => 43]

This is supported on the Database and Redis queue drivers. Other drivers return empty collections.

Pull Request: #59511

#Delay Attribute Support Across Dispatchers

The #[Delay] attribute introduced in v13.3.0 now works across all dispatchers. Previously, it was only wired into the Event Dispatcher — the Bus Dispatcher read the delay property directly, ignoring the attribute.

use Illuminate\Queue\Attributes\Delay;
 
#[Delay(30)]
class ProcessInvoice implements ShouldQueue
{
    use Dispatchable, Queueable;
}
 
// Now correctly delayed by 30 seconds when dispatched via Bus or Notifications
ProcessInvoice::dispatch();

Pull Requests: #59514, #59513

#Carbon Overflow Option

A new overflow option has been added to Carbon's plus and minus methods, giving you control over how date arithmetic handles month-end boundaries. Here's a few examples from the pull request tests:

$carbon = Carbon::parse('2026-01-31');
$this->assertSame('2026-03-03', $carbon->plus(months: 1, overflow: true)->toDateString());
 
$carbon = Carbon::parse('2026-01-31');
$this->assertSame('2026-02-28', $carbon->plus(months: 1, overflow: false)->toDateString());

Pull Request: #59509

#Other Fixes and Improvements

Validation:

• Fixed TypeError in starts_with/ends_with rules on non-string values (#59541)
• Fixed deprecation warnings in Contains and DoesntContain rules when values contain null (#59561)
• Fixed deprecation warnings in In and NotIn rules when values contain null (#59576)

Queue & Jobs:

• Fixed missing Illuminate\Queue\Attributes\Delay attribute (#59504)
• Fixed runtime property overrides (onQueue) taking precedence over class attributes (#59468)
• Fixed #[WithoutRelations] queue attribute not being inherited by child classes (#59568)

Models & Attributes:

• Fixed CollectedBy attribute not resolving through abstract parent classes (#59488)
• Fixed static closure binding in remaining manager classes (#59493)

HTTP & Requests:

• Fixed $request->interval() failing with very small float values (#59502)
• Fixed null redirect handling in unauthenticated exception handler (#59505)
• Allow null to be passed directly to redirectGuestsTo() (#59526)

Strings:

• Fixed Str::markdown() and Str::inlineMarkdown() crash on null input (#59554)

Security:

• Added --ignore-scripts to yarn in install:broadcasting command (#59494)

Other:

• Added pint.json to export-ignore (#59497)
• Reverted SessionManager clone removal that caused duplicate Redis connections (#59542)

Upgrade Notes

No breaking changes are expected for typical applications. The new FormRequest::failOnUnknownFields() defaults to false, so existing behavior is preserved. Review the full changelog for complete details when upgrading.

References

• Official Changelog
• Full Comparison
• GitHub Release