Laravel Slower Laravel Package

v3.2.0 — Safe capture foundation

The first phase of the 2026 roadmap: make Slower something you confidently leave on in production, and make every capture know what it is (a fingerprint) and where it came from (its origin). No breaking changes — additive migration, existing config/API untouched, synchronous analysis still the default.

Highlights

• Query fingerprints & the Grouped view. Every capture gets a versioned fingerprint from the parameterized SQL (literals/comments/whitespace/IN (...) normalized in a single lexer-style pass). The dashboard gains an Events | Grouped toggle — one row per query shape per connection, with occurrence count, avg/max duration and last-seen, drilling down to the underlying events. php artisan slower:fingerprint backfills pre-3.2 rows (chunked, idempotent).
• Origin context. Each capture records its origin — HTTP route/URI/Controller@action, queue job class, or artisan command — plus the first file:line of application code (taken only for threshold-exceeding queries, DEBUG_BACKTRACE_IGNORE_ARGS). Shown on the detail page and fed to the AI prompt. The authenticated user id is opt-in and never forwarded to the LLM.
• Production controls. capture.sample_rate, capture.max_per_execution, a 60s circuit breaker when storage itself fails, and a hardened self-capture guard.
• Privacy-first AI payload. Only the parameterized SQL (plus schema, origin, EXPLAIN) leaves the app — table names are extracted from the parameterized SQL so no inlined literal leaks through schema introspection. Raw SQL and bindings are explicit opt-ins; a configured PayloadRedactor covers every outbound path (raw SQL, bindings, and the EXPLAIN plan); a misconfigured redactor throws instead of silently passing secrets.
• Queued analysis. SLOWER_ANALYZE_QUEUE=<queue> runs analysis as unique-per-record background jobs (dashboard + slower:analyze --queue); unset stays synchronous, no worker required. Jobs drop cleanly if their record was pruned.
• Events, not lock-in. SlowQueryCaptured and SlowQueryFirstSeen (per-connection identity) — wire alerts to Slack/mail/webhook in a few lines. A throwing listener is reported but never breaks the app query, arms the circuit breaker, or suppresses the other event.

Three new config blocks total: capture, ai_payload, analyze_queue.

Design

Selected from a multi-model council roadmap. Deliberate choices: fingerprints from parameterized SQL (never raw), row-per-event storage kept (aggregate model deferred to v4.0), fingerprint normalizer favors a false split over a false merge (documented escaping tradeoff), origin backtrace paid only on slow queries.

Verification

• 211 tests / 445–449 assertions green on Laravel 11 (11.45.2), 12 (12.63.0) and 13 (13.19.0) (PHP 8.4). PHPStan level 5 clean, Pint clean.
• Three rounds of recursive review (inline → workflow → three independent adversarial agents) — each verified finding fixed test-first. Caught and fixed: a raw-SQL literal leak through schema extraction, an event/circuit-breaker coupling, a first-seen scoping mismatch, queued-job resilience, nested-origin attribution, and a build-tooling slip that had leaked dev dependencies into the production require block.
• Browser-tested with Playwright: events↔grouped toggle, occurrence badges, drill-down, origin panel, the analyze flow, dark/light — no console errors.

Upgrade

Publish and run the new migration, then optionally backfill fingerprints:

php artisan vendor:publish --tag="slower-migrations"
php artisan migrate
php artisan slower:fingerprint

Heads-up: GitHub Actions is still failing to provision runners account-wide (unrelated to this change), so the matrix was validated locally across Laravel 11–13 rather than by CI.

v3.1.1 — README modernization

A documentation-only release. No code, configuration, or behavior changes — the package, config surface, and public API are identical to v3.1.0.

What changed

• Per-provider LLM configs, one by one. OpenAI, Anthropic (Claude), Google Gemini, self-hosted / OpenAI-compatible (Ollama, LM Studio, OpenRouter, Groq), and a fully custom driver each get their own copy-paste .env block — the two required lines (SLOWER_AI_SERVICE + the provider's API key) up front, every optional override commented out with its real Prism default (URL, organization, project, API version).
• Richer usage examples. A capture → analyze → recommend flow, a provider/model-default table, and fuller programmatic usage (facade, counting pending, batch-analyzing the slowest queries).
• Modern presentation. Table of contents, PHP / Laravel / License badges, and GitHub note/tip/warning callouts.

Accuracy

Every environment variable and model default is verified against config/prism.php and AiServiceManager — not guessed.

Verification

• All table-of-contents anchors resolve (checked against GitHub's slug rule); code fences and HTML tags balanced; every prior section preserved across the rewrite.
• No CI/build badge added — GitHub Actions is still failing to provision runners account-wide (unrelated to this change).

v3.1.0 — all major LLM providers (OpenAI, Anthropic, Gemini + custom)

Slower now works with every major LLM provider through Prism, with fewer config variables than before — provider credentials move out of Slower's config entirely.

Highlights

• Pick a provider with one variable: SLOWER_AI_SERVICE=openai|anthropic|gemini|ollama|…. Any Prism provider works; a fully custom backend registers via AiServiceManager::extend().
• Credentials delegated to Prism (config/prism.php / OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY) — Slower's own open_ai config block is gone.
• Sensible low-cost default model per provider (gpt-5.4-mini, claude-haiku-4-5, gemini-2.5-flash), overridable with SLOWER_AI_RECOMMENDATION_MODEL.

Design

• Replaced openai-php/laravel with prism-php/prism — one official package for all providers. The entire integration lives behind a single PrismDriver; the AiServiceDriver contract and AiServiceManager::extend() seam are unchanged, so Prism (and its pre-1.0 API) is isolated to one class.
• AiServiceManager maps ai_service → any Prism provider (Provider::tryFrom), with extend() taking precedence and unknown names throwing a helpful error.
• Provider/transport exceptions propagate (a null return means only "no usable text"), so failed analyses stay retryable exactly as before.

Backward compatibility

Existing OpenAI users need no changes — Prism reads OPENAI_API_KEY, and a boot-time bridge still honors a legacy slower.open_ai.api_key. Minor release.

Verification

• 126 tests / 268 assertions green on Laravel 11, 12, and 13 (PHP 8.4); PHP 8.5 covered by CI. PHPStan 2 level 5 clean, Pint clean.
• PrismDriver tested with Prism::fake() (provider/model/prompt routing, empty→null); manager resolution, custom extend (via the real singleton path), the create{Name}Driver() BC path, and config all covered.
• Architecture selected by a multi-model council (Prism won decisively; per-provider SDKs rejected) plus Fable 5's independent opinion.
• Hardened through four rounds of recursive review, which caught and fixed real bugs a single pass would have missed: a critical extend()-singleton failure (custom LLMs silently ignored), wrong per-provider model defaults (OpenAI model sent to other providers), a dropped create{Name}Driver() extension convention, and misleading error messaging. Two residual items were reasoned design choices, not defects: key validation is deferred to call-time (an eager guard would break keyless providers like Ollama), and the 30s request timeout is a sane default (raise PRISM_REQUEST_TIMEOUT if needed).

Heads-up: GitHub Actions is currently failing to provision runners account-wide (unrelated to this change), so CI hasn't validated the matrix here — it was validated locally across Laravel 11–13.

Laravel Slower v3.0.0 — Laravel 11–13 & PHP 8.5

Platform modernization. No public API, config, or database changes — only the supported runtime and the dev toolchain moved forward.

Requirements changed

• Now requires PHP 8.3+ and Laravel 11, 12, or 13. Laravel 10 and PHP 8.2 support are dropped. The package already relied on the Laravel 11+ casts() model method, so Laravel 10 was effectively unsupported — this makes the constraint honest.

Changed

• openai-php/laravel raised to ^0.20.0 — the previous ^0.18.0 capped at Laravel 12 and silently blocked Laravel 13 installs.
• Modernized the dev/test toolchain to a single stack: Pest 4, pest-plugin-laravel 4 (first line to support Laravel 13), PHPStan 2 / larastan 3 (resolving the PHPStan 1-vs-2 dependency conflict), testbench 9–11.
• CI now covers PHP 8.3–8.5 × Laravel 11–13.

Removed

• Dead code: the empty notify() hook in SlowerServiceProvider and its call site.

Upgrade

No application-code, config, or migration changes are required if you already run PHP 8.3+ and Laravel 11+. Still on PHP 8.2 or Laravel 10? Stay on the ^2.x line.

Full changelog: https://github.com/halilcosdu/laravel-slower/blob/main/CHANGELOG.md

Laravel Slower v2.3.0 — Built-in Dashboard

Install the package and you now have a full slow-query dashboard at /slower — no npm, no CDN, no assets to publish.

Added

• Built-in dashboard (/slower): overview stats (total / pending / avg / max duration), searchable and filterable query list (status, connection), sortable columns, pagination, and a detail page with keyword-formatted SQL, bindings, and the AI recommendation rendered from markdown.
• Actions: Analyze with AI per query (per-record lock + rate limiter), analyze up to analyze_pending_limit pending queries at once, delete one, and clean up older than N days (0 clears all). AI actions warn about provider charges; destructive actions confirm first.
• Telescope-style authorization: the viewSlower gate defaults to the local environment only and is config:cache-safe. Define it in a service provider to open the dashboard in production.
• Dependency-free, themeable frontend: inline CSS + vanilla JS, dark/light theme (respects prefers-color-scheme, persists the choice), copy-to-clipboard, confirmations, auto-submitting filters.
• MarkdownRenderer: a tiny escape-first renderer that HTML-escapes all input before any transform, so AI recommendations render richly without becoming a stored-XSS vector.

Changed

• New additive dashboard config block (enabled, path, domain, middleware, per_page, analyze_pending_limit). Existing keys are unchanged.

Upgrade

Purely additive — no migration required, and the dashboard is disabled outside local by default. After upgrading, visit /slower locally, or define a viewSlower gate for other environments.

Security: captured SQL/bindings can contain sensitive data, and analyzing a query sends it to your AI provider as a billable call. Keep the gate tight and prune regularly with slower:clean.

Full changelog: https://github.com/halilcosdu/laravel-slower/blob/main/CHANGELOG.md

Maintenance and quality pass. No public API breaks. Reviewed jointly with Codex/GPT-5.5.

Fixed

• Safe EXPLAIN — RecommendationService now resolves the captured query's own connection and runs a non-executing EXPLAIN (never EXPLAIN ANALYZE), with a per-driver statement form (pgsql/mysql → EXPLAIN, sqlite → EXPLAIN QUERY PLAN, others skipped). Multi-statement input is rejected and EXPLAIN failures are reported without breaking analysis. The previous explain analyse was Postgres-only and could actually execute captured production SQL (e.g. UPDATE/DELETE).
• Retryable recommendations — a record is only marked is_analyzed when the AI returns a non-empty recommendation. Empty results stay is_analyzed=false and are retried on the next scheduled slower:analyze. The command now prints an Analyzed | Skipped summary.
• No more swallowed errors — createRecord reports failures via report() (without the raw SQL) and catches Throwable, so logging slow queries can never break the request.
• Correct iteration — slower:clean and slower:analyze switched to chunkById.

Changed

• Default recommendation_model: deprecated gpt-4 (shut down 2026-10-23) → gpt-5.4-mini. Pin SLOWER_AI_RECOMMENDATION_MODEL=gpt-4 to keep old behaviour.
• CI now tests PHP 8.4 (matrix: 8.2/8.3/8.4 × L10–13).
• openai-php/laravel → ^0.18.0, dependabot/fetch-metadata → 2.5.0.

Documentation / internals

• README config example synced with slower.php, ai_service driver switch documented, broken third-party screenshot removed, upgrade note added.
• OpenAiDriver now type-hints OpenAI\Contracts\ClientContract (substitutable/fakeable).
• +13 behavior tests (RecommendationServiceTest, extended CommandsTest, SlowLogFactory). Suite: 39 passed. PHPStan level 5: clean. Pint: clean.

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v2.1.0...v2.2.0

What's Changed

• Added Laravel 13 support to composer.json dependencies
• Updated GitHub Actions CI workflow to test against Laravel 13.x with Orchestra Testbench 11.x
• Updated Pest and plugin version constraints for PHPUnit 11+ compatibility
• Package now supports Laravel 10.x, 11.x, 12.x, and 13.x

What's Changed

• Bump actions/checkout from 5 to 6 by @dependabot[bot] in https://github.com/halilcosdu/laravel-slower/pull/48

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v2.0.4...v2.0.5

What's Changed

• Update openai-php/laravel requirement from ^0.10.1 to ^0.11.0 by @dependabot[bot] in https://github.com/halilcosdu/laravel-slower/pull/33
• Bump dependabot/fetch-metadata from 2.3.0 to 2.4.0 by @dependabot[bot] in https://github.com/halilcosdu/laravel-slower/pull/34
• Update openai-php/laravel requirement from ^0.11.0 to ^0.13.0 by @dependabot[bot] in https://github.com/halilcosdu/laravel-slower/pull/35
• Update openai-php/laravel requirement from ^0.13.0 to ^0.14.0 by @dependabot[bot] in https://github.com/halilcosdu/laravel-slower/pull/37
• Bump aglipanci/laravel-pint-action from 2.5 to 2.6 by @dependabot[bot] in https://github.com/halilcosdu/laravel-slower/pull/38
• Update openai-php/laravel requirement from ^0.14.0 to ^0.15.0 by @dependabot[bot] in https://github.com/halilcosdu/laravel-slower/pull/39
• docs(models): improve SlowLog model docblock for type accuracy and completeness by @tusharnain in https://github.com/halilcosdu/laravel-slower/pull/43
• Add Laravel 12 support by @halilcosdu in https://github.com/halilcosdu/laravel-slower/pull/46
• Update openai-php/laravel requirement from ^0.15.0 to ^0.18.0 by @dependabot[bot] in https://github.com/halilcosdu/laravel-slower/pull/45
• Bump stefanzweifel/git-auto-commit-action from 5 to 7 by @dependabot[bot] in https://github.com/halilcosdu/laravel-slower/pull/44
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in https://github.com/halilcosdu/laravel-slower/pull/40
• Fix Laravel 12 compatibility issues by @halilcosdu in https://github.com/halilcosdu/laravel-slower/pull/47

New Contributors

• @tusharnain made their first contribution in https://github.com/halilcosdu/laravel-slower/pull/43
• @halilcosdu made their first contribution in https://github.com/halilcosdu/laravel-slower/pull/46

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v2.0.3...v2.0.4

What's Changed

• Laravel 12 Support added.
• Bump dependabot/fetch-metadata from 2.2.0 to 2.3.0 by @dependabot in https://github.com/halilcosdu/laravel-slower/pull/29
• Bump aglipanci/laravel-pint-action from 2.4 to 2.5 by @dependabot in https://github.com/halilcosdu/laravel-slower/pull/30

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v2.0.2...v2.0.3

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v2.0.0...v2.0.2

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v2.0.0...v2.0.1

What's Changed

• Update openai-php/laravel requirement from ^0.8.1 to ^0.9.1 by @dependabot in https://github.com/halilcosdu/laravel-slower/pull/18
• Update openai-php/laravel requirement from ^0.9.1 to ^0.10.1 by @dependabot in https://github.com/halilcosdu/laravel-slower/pull/19
• Bump dependabot/fetch-metadata from 2.1.0 to 2.2.0 by @dependabot in https://github.com/halilcosdu/laravel-slower/pull/21
• Added explain analyze query plan to recommendation prompt by @dimafe6 in https://github.com/halilcosdu/laravel-slower/pull/17

New Contributors

• @dimafe6 made their first contribution in https://github.com/halilcosdu/laravel-slower/pull/17

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.1.1...v2.0.0

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.1.0...v1.1.1

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.0.9...v1.1.0

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.0.8...v1.0.9

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.0.7...v1.0.8

• Schema and current indexes added.

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.0.6...v1.0.7

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.0.5...v1.0.6

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.0.4...v1.0.5

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.0.3...v1.0.4

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.0.2...v1.0.3

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.0.1...v1.0.2

Full Changelog: https://github.com/halilcosdu/laravel-slower/compare/v1.0.0...v1.0.1

What's Changed

• Bump dependabot/fetch-metadata from 1.6.0 to 2.1.0 by @dependabot in https://github.com/halilcosdu/laravel-slower/pull/1

New Contributors

• @dependabot made their first contribution in https://github.com/halilcosdu/laravel-slower/pull/1

Full Changelog: https://github.com/halilcosdu/laravel-slower/commits/v1.0.0