PHP Architect

Join Us Live Next Week

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.06.04 appeared first on PHP Architect.

PHP Tek 2026 Review

John Congdon — Mon, 01 Jun 2026 18:13:08 +0000

As we wrap up May, we want to take a momen to review our conference PHP Tek. This conference has just wrapped it’s 18th annual edition. While we, the current owners, have only just put on our 4th event, PHP Tek has been a staple in the community for many years.

The post PHP Tek 2026 Review appeared first on PHP Architect.

The PHP Podcast 2026.05.28

Eric Van Johnson — Sat, 30 May 2026 21:13:30 +0000

PHP Podcast – May 28, 2026

Hosts: Eric Van Johnson & John Congdon

Links from the show:

PHP Tek is behind us, the ballroom is cleaned up, and we’re back to talk about all of it. Here’s what we covered:

RIP Archie Bot
After a long fight to keep him alive, Eric has officially retired Archie — the Discord bot built on OpenClaw that handled team standups, monitored PHP Architect’s Twitter/X group for join requests, and did a surprising amount of background work for the consulting team. When Anthropic shut down the OpenClaw API, Eric tried every model and service he could find to bring Archie back to form, but nothing got him all the way there. After a month of “almost working,” the call was made. He’s dead. Eric hasn’t ruled out revisiting it eventually — maybe with Claude Cowork — but for now, the bot is gone and the starting-soon link in Discord is broken because of it.

Reviving a Six-Year-Old Codebase
A client PHP Architect Consulting worked with from 2018 to 2021 has come back. The project — a reimagining of their app — was killed off when COVID hit and the CEO couldn’t align with the team’s vision. The last commit was six years ago. Now the client wants to bring it back, and Eric is spending the next few days analyzing what it’ll take to get it running again. Outdated packages, an old PHP version, and the general entropy of time are all on the checklist. Eric has genuine affection for this codebase — it was one of the first projects where he felt like the team was truly operating as a team, not just as an extension of him. Now it’s time to dust it off.

Partner Spotlight: PHP Score → Our CVEs
The PHP Score sponsor read may be getting a refresh — the folks at Artisan Build, who built PHP Score, have a new product they’re excited about: ourCVEs.com. It monitors your codebase’s Composer and NPM packages — and optionally your servers via a lightweight agent — for exposure to open CVEs, and alerts you when something needs attention. Pricing is generous: free forever for open source projects, $17/month for solo devs, $83/month for teams (or $1,000/year), with server monitoring scaling at $1 per server above 50. Ed from Artisan Build was at PHP Tek and made a strong impression. Go check it out at ourcves.com.

How PHP Barely Avoided a Supply Chain Disaster
Brent Roose released a 22-minute video covering a near-miss in the PHP ecosystem involving GitHub and Composer. The short version: GitHub changed their token format and briefly released it before Composer was ready to handle it. Composer was logging the token when the format check failed — meaning GitHub tokens were ending up in CI logs. In GitHub Actions, depending on how your action is configured, that container (and its token) might stick around for a while, giving an attacker a window to act. An alert developer caught the issue, used Claude to help research it, then did responsible disclosure — contacting the Composer maintainers and reaching out to Taylor Otwell, Vincent Pontier, and others in the ecosystem to disable their actions until the fix was in place. Update your Composer. GitHub rolled back the new token format but won’t keep it rolled back forever.

Packagist MFA and Account Security
Following up on the supply chain theme: Nils and Igor (Composer/Packagist maintainers) released a blog post on what they’re doing to improve supply chain security. The immediate ask for anyone publishing packages is to enable MFA on your Packagist account — it’s not required yet, but it will be. Eric went to check his own account, found MFA was already on, but noticed his username was still “diegodev” and he was using an old email. While updating it, he noted that Packagist didn’t require him to re-authenticate or confirm the change via the old email — a gap worth flagging if you have popular packages and someone ever gets into your session.

PHP Tek 2026 Recap — The Good
PHP Tek 2026 in Chicago is done, and despite everything (see below), the team is proud of how it went. Some highlights:

Holly (CodeLorax) built a conference mobile app from scratch, released on both Google Play and the Apple App Store within 24 hours of the conference opening. The app let attendees build their own schedule, detected conflicting talk selections, sent push notifications when talks moved rooms, and even included a vendor lead-scanning feature where vendors could scan attendee QR codes to capture contacts. It was a genuine game-changer for the event. Eric and John named the conference elephant after Holly in appreciation — she also changed a trailer tire during setup, which sealed the deal.

Clayton Kendall sponsored and produced the conference shirts and bags on an extremely tight timeline — shirts two weeks out, bags just one week before the event. Both were a hit. Attendees at the conference were getting questions about the rainbow PHP Architect shirt in particular.

A job fair ran for the first time, with four companies represented. One hiring manager showed up even though they already had 1,400 applicants — because they knew that conference attendees are exactly the kind of motivated, self-improving developers they want. Attendees got to ask questions directly, including the real-world stuff like remote vs. office. Eric would love feedback on how to make it better next year.

JS Tech debuted as a fourth track alongside the three PHP tracks, bringing in fresh faces from the JavaScript community. Eric came away energized by the cross-pollination — different people, different approaches to similar problems.

Ben Ramsey and James Tickham (Rove) both wrote great blog posts about the conference. Ben’s will be featured in the magazine. Diana Pham also put together a video recap. Links in the show notes.

PHP Tek 2026 Recap — The Incident
On Monday during final setup, a hotel employee had a medical incident while walking through the main ballroom — leaving a trail that required hazmat-suited cleanup crews and forced the team to quarantine the ballroom, the hallway leading to it, and the adjacent bathroom. The person is okay and was back at the hotel by Friday, which was a relief. But in the moment, nobody knew what was happening or how long the room would be unavailable.

The team had to rebuild the entire conference footprint overnight. The keynote moved, the JS Tech track went into the quiet room, vendors moved to the atrium, and the hotel staff — to their enormous credit — cleared their own furniture and accommodated every ask without complaint. Attendees were equally patient; once they understood the situation, there was no drama, just “tell us where to go.”

The incident also took out the streaming setup for day one, compounding an already-difficult start. The solution that eventually worked — plugging the Ethernet into a hub before the streaming equipment — wasn’t tried until day three. Eric is mad at himself for thinking of it and not doing it sooner.

PHP Tek 2027 — Save the Date (TBD)
Planning for next year is already underway. The current target is April 2027 — away from the May timing that caused Eric to miss two of his kid’s band performances this year. Nothing is locked yet, but they’re working through venue and date options and hope to have an announcement soon.

Links from the show:

Host:

Eric Van Johnson

John Congdon

Streams:

- Youtube Channel
- Twitch

Connect & Hire

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

Displace

PHPScore

Put Your Technical Debt on Autopay with PHPScore

Cut code review time & bugs in half instantly with CodeRabbit.

Music Provided by Epidemic Sound

Join Us Live Next Week

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.05.28 appeared first on PHP Architect.

Branching Workflows: Choosing the Right Git Strategy for Your Team

Scott Keck-Warren — Wed, 27 May 2026 19:55:35 +0000

Video version at: https://youtu.be/R_-NG_frTiw

Last month, two developers on a team I was working with both merged their branches to main within minutes of each other. The first merge was fine but the the second introduced a conflict in a shared service class that nobody caught until the CI pipeline deployed a broken build to production.

The team scrambled to fix it, but while they were debugging, a customer reported a billing bug in production. The hotfix for that billing bug couldn’t go out cleanly because the broken feature code was already tangled into main. What should have been a 1-minute rollback turned into a two-hour fire drill.

After a lengthy discussion, it was determined that the root cause wasn’t the conflict itself. Instead, it was agreed that the teams’ branching workflow, or lack thereof, was the culprit. Everyone was merging to main whenever they felt like it, with no structure around releases, hotfixes, or feature isolation.

In this article, we’re going to discuss different branching workflows and how your team (even if you’re a team of one with an AI assistant) can take advantage of them.

Git Flow: The Structured Approach

Git Flow is built around two long-lived branches and several short-lived supporting branches, and it works well for teams that ship versioned releases on a schedule, like a PHP library, a product with release cycles, or if you need to do a lot of manual testing before a release.

The main branch always reflects what is running in production. The develop branch is where completed features accumulate before a release. Feature branches come off develop and merge back into develop when done.

A typical feature looks like this:

# Start a new feature from develop
git checkout develop
git pull origin develop
git checkout -b feature/invoice-pdf

# Do your work, commit along the way
git add src/Invoice/PdfGenerator.php
git commit -m "Add PdfGenerator class for invoice exports"

# When the feature is complete, merge back to develop
git checkout develop
git pull origin develop
git merge feature/invoice-pdf
git push origin develop

# Clean up
git branch -d feature/invoice-pdf

When the team is ready to ship, they create a release branch from develop:

# Create a release branch
git checkout develop
git checkout -b release/1.2

# Fix any last-minute issues on the release branch
git commit -m "Bump version to 1.2.0"

# Merge into main and tag it
git checkout main
git merge release/1.2
git tag -a v1.2.0 -m "Release 1.2.0"

# Merge back into develop so it has the version bump
git checkout develop
git merge release/1.2

If a production bug needs an emergency fix, a hotfix branch comes directly off main and merges back into both main and develop, so the fix exists in both places.

Git Flow gives you a lot of control, but it comes with overhead. You’re managing multiple long-lived branches and merge paths, which means more process for your team to follow. That being said, you might need to support multiple versions of your software, and this is an excellent way to do so.

We’ll have more about branching workflows after this word from our partners.

GitHub Flow: One Branch, Keep It Simple

GitHub Flow strips branching down to the minimum in that you have one long-lived branch (main) and short-lived feature branches.

It commonly looks like the following:

Create a branch from main
Make your changes and commit
Open a pull request
Get a code review
Merge to main
Deploy

Or in command lines:

# Start a feature
git checkout main
git pull origin main
git checkout -b add-discount-codes

# Work and commit
git add src/Discount/DiscountService.php
git commit -m "Add DiscountService with percentage and fixed discounts"

# Push and open a pull request
git push -u origin add-discount-codes
# Open PR on GitHub, get review, then merge via the UI

After the merge, main is deployed, automatically if possible.

The nice thing about this is that there’s no develop branch, no release branch, no version tags unless you want them. It makes it MUCH easier to manage the state of your Git repository, but it really is best if you only have one version of your codebase deployed.

GitHub Flow works well for teams practicing CI/CD, where every merge to main goes straight to production. Many PHP teams deploying Laravel or Symfony applications use this workflow because their release cadence is “whenever a feature is ready.”

The tradeoff is that main must always be deployable. If someone merges broken code, it goes to production. Your CI/CD pipeline and test suite need to catch problems before the merge happens, not after.

Trunk-Based Development: Small Changes, Often

Trunk-Based Development (TBD) takes the GitHub Flow idea further. Developers make small, frequent commits to main (the “trunk”), multiple times per day. Feature branches live for hours or less if possible.

A common misconception is that TBD means “no branches ever.” Developers still create short-lived branches for pull requests. The difference is that those branches get merged within a day, not left open for a week.

Features that take longer than a day to build are handled with feature flags:


// In your controller or service
if (FeatureFlag::isEnabled("new-checkout-flow")) {
    return $this->newCheckoutProcess($cart);
}

return $this->legacyCheckoutProcess($cart);

With feature flags, you can merge incomplete features into main without exposing them to users. The code is in production, but the flag keeps it hidden until the feature is finished and tested. When you’re ready, you flip the flag, and the feature goes live without a deployment.

The git commands for TBD are almost identical to GitHub Flow:

git checkout main
git pull origin main
git checkout -b short-lived/checkout-step-one

# Small, focused change
git add src/Checkout/ShippingCalculator.php
git commit -m "Add ShippingCalculator for new checkout flow (behind flag)"
git push -u origin short-lived/checkout-step-one

# Open PR, get quick review, merge same day

TBD requires a high level of discipline and good automated testing. If your test suite takes 45 minutes to run, merging multiple times a day becomes harder. Teams using TBD typically invest heavily in fast CI pipelines and comprehensive test coverage.

Choosing the Right Workflow

Choosing the right workflow can be a real challenge; it depends on your release process, your team size, and how mature your deployment setup is.

If your project ships numbered versions or on a regular cadence, then Git Flow works. That’s teams maintaining a PHP package on Packagist, or shipping a new version every two weeks with a formal QA cycle. You need the structure to manage concurrent development and release preparation, and Git Flow gives you exactly that.

If your team deploys continuously and every merge goes to production, GitHub Flow is the better match. Most web application teams, especially those running Laravel or Symfony apps, fall here. Releases happen whenever a feature is ready, not on a calendar. For smaller teams (two to eight developers) with an automated deployment pipeline, GitHub Flow removes overhead without introducing risk.

Trunk-Based Development makes sense when your team has fast test suites, strong CI/CD practices, and a habit of making small, incremental changes. It works especially well for larger teams where long-lived branches would generate constant merge conflicts. The tradeoff: you need to invest in testing infrastructure and feature flags upfront. If your tests take 45 minutes to run, merging multiple times a day is painful before you fix that problem.

Gotchas

As with all things that involve squishy humans, there are some potential gotchas with this.

If half your team thinks you’re doing GitHub Flow and the other half are creating develop and release branches, you’ll end up with a confusing mess. Document your workflow in your project’s README or CONTRIBUTING file, or enforce it using protected branches. This sounds obvious, but it gets skipped constantly.

Long-lived feature branches cause problems in any workflow. The longer a branch lives, the more it diverges from main, and the harder the merge becomes. Rebase or merge main into your feature branch at least once a day to keep conflicts small.

Watch out for “it’s just a small change” commits bypassing the process. Small changes can still break things. A one-line typo in a change can take down the global economy as your “quick fix” causes millions of computers to reboot over and over again. Keep your review process consistent regardless of the change size.

What You Need To Know

A branching workflow is an agreed-upon set of rules for how your team creates, names, and merges branches.
Git Flow uses main, develop, feature, release, and hotfix branches. It fits teams with scheduled, versioned releases.
GitHub Flow is main plus short-lived feature branches and pull requests. Deploy on every merge.
Trunk-Based Development means very short-lived branches (merged within a day) with feature flags to hide incomplete work.
Pick the workflow that matches your release cadence and CI/CD maturity. Write it down somewhere.

The post Branching Workflows: Choosing the Right Git Strategy for Your Team appeared first on PHP Architect.

The PHP Podcast 2026.05.14

Eric Van Johnson — Fri, 15 May 2026 01:18:37 +0000

PHP Podcast – May 14, 2026

Hosts: Eric Van Johnson & John Congdon

Another fun episode of the PHP Podcast! Here’s what we covered:

PHP Tek Is Four Days Away
The countdown clock is basically ticking in real time — PHP Tek 2026 in Chicago is just four days and ten hours out as this episode begins. Eric flies Friday, John flies Saturday, and the team descends on the venue Sunday to get the trailer unloaded, the booth assembled, and everything tested before the conference kicks off. The conference magazines — ordered three weeks ago and still showing “printing” on Tuesday — pulled through at the last minute and are set to arrive at the venue tomorrow. That’s cutting it close, but it counts.

Win a Free PHP Tek Ticket — Live on Air
John put a full conference ticket up for grabs: DM him on any social platform, and he’d draw a winner on the live stream. The caveat? You had to be watching live — audio listeners are out of luck on this one. The lucky winner drawn on air was Jeffrey Davidson, who will now be at PHP Tek. Eric offered to even bring him to the team’s Saturday minor league baseball game if he flies in early enough. Jeffrey gets a hand-printed sticker name badge, but he’ll have a badge.

New PHP Architect Conference Merch
Fresh shirts are coming to the PHP Tek booth courtesy of Clayton Kendall, who is producing the apparel. The new design goes with a smaller logo placement — a more subtle, wearable-anywhere look compared to the big bold prints. If you’re headed to Chicago, swing by the PHP Architect table and see what’s there.

Holly’s Conference App Gets a Vendor Mode
The PHP Tek attendee app built by Holly (developed by CodeLorax) has been upgraded ahead of the conference. What started as a schedule browser with conflict detection and push notifications has now merged with a vendor lead scanning tool. Attendees can log in by scanning the QR code on their badge, and vendors can scan attendee badges to capture leads — all in a privacy-preserving way that doesn’t expose raw contact data. Eric’s wife Bek figured out the app entirely on her own without being told anything, which remains one of the best usability endorsements you can give.

Something Big Is Happening in the PHP Community
Eric teased something he can’t officially talk about yet — a community acquisition that’s still working through the legal and DNS transfer process. A new droplet has been created. Joe has already figured out what it is. Eric is too excited not to bring it up but too responsible to spill the details before it’s official. The plan is to announce after PHP Tek. If you want to know early, apparently getting Joe drunk at the conference is your best strategy.

Grok AI Exploited via Morse Code in Bank Transactions
A video from the Dave’s Garage YouTube channel surfaced a genuinely unsettling AI exploit: someone used a Grok-powered AI banking agent and embedded hidden instructions inside transaction memo fields — written in Morse code. The agent decoded the dots and dashes, interpreted them as instructions, and followed them, ultimately losing somewhere between $154,000 and $200,000 in crypto transfers. This is prompt injection in its most creative and alarming form yet. The attack surface for AI agents hooked into real financial systems is not theoretical — it’s happening.

TanStack Hit by NPM Supply Chain Attack
The TanStack ecosystem — the popular query, router, and table libraries — was hit by a supply chain attack via GitHub Actions cache poisoning. The attack vector was a forked pull request: a malicious fork can trigger GitHub Actions workflows and potentially inject poisoned artifacts into the build cache, which then get picked up by the legitimate package. Simon Hamp from NativePHP caught it and raised the alarm in the PHP Architect Discord. It’s a good reminder that the supply chain attack surface extends well beyond just what’s in your `composer.json` or `package.json` — your CI pipeline’s caching behavior matters too.

PHP Tek Job Fair — Wednesday Afternoon
There will be a job fair at PHP Tek this year, scheduled for Wednesday afternoon. At least one confirmed hiring manager will be there. If you’re looking for PHP work, or if you’re a company looking for PHP talent, this is worth planning around. Eric and John both see it as a natural fit for the conference — the PHP community is tight-knit enough that a job fair actually means something.

Eric’s Birthday Spa Day in Palm Springs
Eric’s wife Bek surprised him with a birthday spa day in Palm Springs. It was his first massage ever, and he paired it with a mineral soak in the natural springs. He came away thoroughly convinced — the combination of the mineral water and a proper massage left him feeling better than he expected, and he’s already thinking about going back. Beck planned the whole thing, and Eric was appropriately grateful.

John’s First Couples Massage
John has now also had his first couples massage, and it did not go quietly. He opted for deep tissue — which means the therapist was working hard — and his wife, in the room next door, was apparently convinced something was wrong based on the sounds coming through the wall. John described it as the kind of massage where you’re not entirely sure if you’re being helped or attacked, and the answer turns out to be both. He’d do it again.

PHP Architect Becomes Padres Season Ticket Holders
Eric and John are now official San Diego Padres season ticket holders — their first year in the program. As first-timers, they’re at the very bottom of the seniority ladder, which means they were among the last to pick seats. John blames Eric for not signing up years ago. There’s an upcoming Wednesday day game against the Dodgers with available tickets if anyone in San Diego wants them — reach out to John.

Links from the show:

Host:

Eric Van Johnson

John Congdon

Streams:

- Youtube Channel
- Twitch

Connect & Hire

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

Displace

PHPScore

Put Your Technical Debt on Autopay with PHPScore

Cut code review time & bugs in half instantly with CodeRabbit.

Music Provided by Epidemic Sound

Join Us Live Next Week

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.05.14 appeared first on PHP Architect.

Community Corner: Global Accessibility Awareness Day with Joe Devon

Scott Keck-Warren — Thu, 14 May 2026 06:08:09 +0000

In this episode, Scott talks Global Accessibility Awareness Day with Joe Devon the creator of the day.

Links:

Our Discord – https://discord.gg/aMTxunVx
Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt

Joe’s Links:

LinkedIn – https://www.linkedin.com/in/joedevon/
Global Accessibility Awareness Day – https://accessibility.day/
Accessibility and Gen AI Podcast – https://podcasts.apple.com/us/podcast/accessibility-and-gen-ai-podcast/id1759047581

Scott’s Links:

Website – https://scott.keck-warren.com/
Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social
LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/
Mastodon – https://phpc.social/@scottkeckwarren

PHP Architect Social Media:

X: https://x.com/phparch
Mastodon: https://phparch.social/@phparch
Bluesky: https://bsky.app/profile/phparch.com
Discord: https://discord.phparch.com

Subscribe to our magazine: https://www.phparch.com/subscribe/

Partners

This podcast is made a little better thanks to our partners.

Displace

PHPScore

Put Your Technical Debt on Autopay with PHPScore
https://phpscore.com/

CodeRabit

CodeRabbit – Cut code review time & bugs in half instantly with CodeRabbit.
https://www.coderabbit.ai/

Music Provided by Epidemic Sound https://www.epidemicsound.com/

#phpc #php #communityCornerPodcast #podcast #phptek

The post Community Corner: Global Accessibility Awareness Day with Joe Devon appeared first on PHP Architect.

The PHP Podcast 2026.05.07

Eric Van Johnson — Fri, 08 May 2026 02:02:39 +0000

PHP Podcast – May 7, 2026

Hosts: Eric Van Johnson & John Congdon

Another fun episode of the PHP Podcast! Here’s what we covered:

PHP Tek Is 11 Days Away — And Everyone Is Stressed
The conference countdown is real: 11 days, 10 hours, and a handful of seconds on the clock. John’s travel plans hinge entirely on little league baseball — if his team wins their Tuesday playoff game, he coaches the Saturday game, then bolts for the airport. If they lose Tuesday, he’s sad but gets to Chicago earlier. Meanwhile, Eric is grinding through the PHP Tek TV redesign, trying to wire up the SessionIze API for schedule imports instead of doing it all manually from a CSV, and sending the design team a novel’s worth of badge and signage requests. Holly’s conference app now has notifications working: select a talk, and if Eric or John move it around, you’ll get pinged. Keynote and lunch notifications are also on the table for attendees who can never find the room.

Conference Stress Dreams: The Motorcycle Gunman Edition
John woke up mid-dream to his wife opening the blinds for the school run — and the dream he was pulled from was genuinely unhinged. He was in an Uber waiting for Uber Eats to arrive at an intersection when a motorcyclist pulled up behind them, got off, shot out the tire, then came to John’s door and started shooting at the lock to get in. The Uber app had briefly flashed the word “threat” on the map. John laid the seat back as far as it would go. The driver just stood there. Then the blinds opened and it was just a Thursday morning. John’s verdict: it’s conference stress. Hard to argue with that.

JS Tek — An Honest Conversation
John decided to say the quiet part out loud: JS Tek hasn’t brought in the JavaScript community the way they hoped. The PHP world is unusual in paying for speaker travel and hotel rooms; Joe in Discord confirmed this barely happens outside PHP, and somebody speaking at a Ruby/Rails conference once told Eric they not only weren’t reimbursed for travel — they had to buy their own conference ticket. Eric’s takeaway: the JS track itself is a great idea for PHP developers, but trying to recruit an entirely new community into the fold didn’t work out. Next year’s structure will probably look different.

The PHP 7-to-8 Upgrade That Failed Three Times
Eric’s consulting team has been struggling with a client upgrade from PHP 7 to 8 — unusual, because they’ve done this many times and know the pitfalls. After three failed attempts, a deep dive revealed the culprit: an abandoned Laravel Shift branch left behind by a previous developer who had started an upgrade and walked away, with missing config files baked right into the inherited codebase. The fix wasn’t just another attempt — it was getting the management team to produce a proper testing playbook, and more importantly, actually getting trained on the application. The team had been fixing bugs in code they’d never seen working correctly. Today they finally got that training session, and Eric says the excitement and “ah-ha” moments from his developers made it clear this should have happened much sooner.

The Database on the Same Server Problem
A related discovery from the same client: the database lives on the same machine as the application. Every upgrade means shutting the app down, exporting the database, migrating it somewhere else, and starting over. Eric’s head doesn’t compute why this is still the case in 2026. Even a second machine designated as a database server would be a massive improvement. In a moment of uncomfortable honesty, Eric also admitted that PHP Architect’s own conference site has the same setup — Forge makes it so easy to throw a database on the same box that you just don’t think about it, until you do.

Laravel Shift, Laravel Cloud, and the Pre-Check Tool
The conversation circled back to Laravel Shift — JMAC’s automated upgrade tool — which Eric notes has become less essential as Laravel’s upgrade paths have smoothed out considerably compared to the wild west of early Laravel development. But Shift is still out there and still useful. More interestingly, JMAC has a new free Shift specifically for Laravel Cloud readiness: run it against your app and it’ll tell you whether your application is compatible with Laravel Cloud’s serverless model, flag any system commands that won’t be available, and help you understand what services you’d need. Laravel Cloud itself is Taylor’s “don’t worry about servers” deployment platform, and if you’re not a sysops person, having a Shift that holds your hand through the setup could be the difference between trying it and not.

PHP Internals Made Readable — Externals and PHP RFC Watch
Eric plugged two tools for following what’s happening in PHP core. The first is externals.io — a much more readable front-end for the PHP internals mailing list, with search, read-tracking, and threaded discussions. The second is a newer discovery: php-rfc.watch, which focuses purely on RFCs, showing what’s active, what’s been voted on, and how the votes broke down. It’s more of a quick-glance dashboard than a full discussion forum. Eric also highlighted a specific RFC from Ben Ramsey: a proposal to update the PHP license, accompanied by a detailed blog post called “PHP License Simplified” that walks through the history and rationale. If you’ve ever been curious about why license choice matters (especially at the enterprise level where legal teams block open source based on license type), Ben’s post is worth the read.

NeoVim’s Flash Plugin — Used Wrong for Years
Eric has been using Flash.nvim, a NeoVim navigation plugin, for years. He recently discovered he had been using it completely incorrectly the entire time. He thought he understood what it did. He did not. A YouTube video explaining the plugin properly (titled something like “How to Jump Anywhere Instantly in NeoVim”) revealed that what he’d been doing was essentially pressing the wrong keybinding and stumbling through a fraction of the plugin’s actual functionality. This sent the conversation into a longer Vim origin story: Eric learned Vim because he was flying around the country installing Cyborg firewalls on remote servers and Vi was just there. John picked it up at an enterprise job and never thought about alternatives until he saw a developer using MacVim to write Rails and had his mind blown. The core message: you can use a tool for decades and still be using it wrong, and that’s okay — but watch the tutorial.

Eric Doesn’t Know How Old He Is
Eric has been confidently telling people for a full year that he’s 55. His wife Bek has known for some time that this is not correct. The moment of reckoning came when Eric asked Alexa: “If I was born in 1969, how old would I be now?” Alexa hedged on the birthday thing but confirmed the range. Bek stepped in. Alexa, a full 30-60 seconds later, stepped back in and confirmed: “Your birthday’s May 8th, you’re turning 57.” Eric is apparently going directly from 55 to 57, having skipped 56 entirely. He also noted at the Padres game with his wife that their Costco membership is older than a 13-year-old kid they saw on the Jumbotron, and that it could legally babysit him. John is turning 50 this year. Everyone is fine.

Links from the show:

Host:

Eric Van Johnson

John Congdon

Streams:

- Youtube Channel
- Twitch

Connect & Hire

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

Displace

PHPScore

Put Your Technical Debt on Autopay with PHPScore

Cut code review time & bugs in half instantly with CodeRabbit.

Music Provided by Epidemic Sound

Join Us Live Next Week

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.05.07 appeared first on PHP Architect.

Token-Oriented Object Notation (TOON) For PHP Developers

Scott Keck-Warren — Wed, 06 May 2026 15:31:28 +0000

See the video version at https://youtu.be/Nk9ayWxkJ1M

It’s an unfortunate piece of our current developer reality that a lot of our day is spent worrying about how many tokens we’re spending. Every time you send structured data to an LLM API, you’re paying for tokens. And if you’re sending arrays of similar objects as JSON, you’re paying to repeat the same field names for every single record. That’s not a bug in JSON, it’s just how the format works. But there’s a better option for this specific use case.

In this article, we’re going to look at Token-Oriented Object Notation (TOON) and how it strips that repetition out of your data.

The problem

Let’s say you’re tracking podcast episode statistics and you want to send that data to an LLM. Maybe you want it to flag underperforming episodes or summarize listening trends across your whole catalog. Here’s what a typical batch of episode records looks like in PHP:



$episodes = [
    [
        "id" => 1,
        "title" => "Getting Started with Laravel",
        "published_at" => "2026-01-15",
        "downloads" => 4821,
        "avg_listen_time" => "34:12",
        "completion_rate" => 0.71
    ],
    [
        "id" => 2,
        "title" => "PHP 8.4 New Features",
        "published_at" => "2026-02-03",
        "downloads" => 6204,
        "avg_listen_time" => "41:55",
        "completion_rate" => 0.83
    ],
    [
        "id" => 3,
        "title" => "Scaling MySQL for High Traffic",
        "published_at" => "2026-02-24",
        "downloads" => 3109,
        "avg_listen_time" => "28:40",
        "completion_rate" => 0.58
    ],
];

$jsonPayload = json_encode($episodes, JSON_PRETTY_PRINT);

That json_encode() call produces output like this:

[
    {
        "id": 1,
        "title": "Getting Started with Laravel",
        "published_at": "2026-01-15",
        "downloads": 4821,
        "avg_listen_time": "34:12",
        "completion_rate": 0.71
    },
    {
        "id": 2,
        "title": "PHP 8.4 New Features",
        "published_at": "2026-02-03",
        "downloads": 6204,
        "avg_listen_time": "41:55",
        "completion_rate": 0.83
    },
    {
        "id": 3,
        "title": "Scaling MySQL for High Traffic",
        "published_at": "2026-02-24",
        "downloads": 3109,
        "avg_listen_time": "28:40",
        "completion_rate": 0.58
    }
]

You might notice there’s a log of duplicate information in the keys ("id", "title", "published_at", "downloads", "avg_listen_time", "completion_rate"). Each one shows up three times, once per record.

You might be saying that three records is nothing but as you scale up and you send over 500 episodes, you’re repeating those six field names 500 times each. That’s 3,000 strings the LLM has to tokenize, and you’re paying for every single one.

Regardless of how cheap the tokens are individually, your total bill climbs faster than you’d think when you’re running hundreds of API calls a day.

What is TOON

TOON stands for Token-Oriented Object Notation. It solves the repetition problem from earlier by trading structure for whitespace. We won’t see things we’re accustomed to in PHP like curly braces, square brackets, or quoted key names. We’re just going to use indentation to show hierarchy, like YAML. That alone cuts a surprising number of punctuation tokens while not increasing error rates all that much.

An even bigger win is the tabular format that TOON uses. When all your records share the same fields, you write the field names once as a header row, and each record becomes a single comma-separated line. The keys go from appearing once per record to appearing once, period.

Our episode data in TOON looks like this:

episodes[3]{id, title, published_at, downloads, avg_listen_time, completion_rate}
    1, Getting Started with Laravel, 2026-01-15, 4821, 34:12, 0.71
    2, PHP 8.4 New Features, 2026-02-03, 6204, 41:55, 0.83
    3, Scaling MySQL for High Traffic, 2026-02-24, 3109, 28:40, 0.58

That’s the whole dataset. Field names once at the top, one row per record below that. On this sample data, TOON achieves a 60.42% token reduction: 379 tokens down to 150. Hard to get excited about with three rows but again at 500 episodes per batch, that’s where it becomes real money at production scale.

We’ll have more after this word from our partners.

Working with TOON in your prompts

As always, with supporting file formats in our code, we have two options. We can build our own code, do it quickly and dirty, or we can find a library on Packagist that does the work for us. Thankfully, someone already has, and it supports more options than just our basic array of object examples above. It’s toon-php and it allows us to simply call “Toon::encode()”

echo Toon::encode([
    'users' => [
        ['id' => 1, 'name' => 'Alice', 'role' => 'admin'],
        ['id' => 2, 'name' => 'Bob', 'role' => 'user'],
    ]
]);

To get our data in TOON format.

users[2]{id,name,role}:
  1,Alice,admin
  2,Bob,user

It can also reverse TOON back into a PHP array:

// Decode objects (returned as associative arrays)
$toon = <<;

$result = Toon::decode($toon);
// ['id' => 123, 'name' => 'Ada', 'active' => true]

It’s fairly slick.

Sending Toon to the LLM

Now that we have our data in TOON format, you also need to tell the model how to read this format.

This can be done by adding it to your system prompt:



$systemPrompt = "You will receive data in TOON (Token-Oriented Object Notation) tabular format. "
    . "The first indented line contains comma-separated field names. "
    . "Each subsequent indented line contains comma-separated values in the same field order. "
    . "Parse each line as a record using the header fields as keys.";

$userPrompt = "Analyze the following podcast episode statistics and identify which episodes have low completion rates:\n\n"
    . convertToToon($episodes, "episodes");

Leave that out, and the model treats your data as unstructured text. It’ll miss the structure entirely and give you garbage back.

It’s still wild that this works as well as it does.

Gotchas

Now there are some gotchas you have to keep in mind.

The first is that with everything with LLMs, we have to include that everything is brand new in this field, so this is most likely going to be out of date before we hit the publish button. It’s still beneficial just to understand the concept because there are so many places where we messy humans need structure that LLMs don’t.

Because LLMs are non-deterministic, your mileage is going to vary, but in benchmarks, TOON is just as accurate as JSON for returned results, so make sure you’re always looking for bad data coming back from the LLM and including a “this data is generated using AI” warning on the output.

The most annoying gotcha is that you have to explain the format every time. JSON is something every LLM has been trained on because it exists in all of the LLMs’ training data, but TOON isn’t (yet). If you don’t include those parsing instructions in the system prompt, the model will read your rows as plain text, and the response will be wackadoo.

TOON also falls apart with messy data. It works best with flat, consistent records where every item has the same fields. Nested objects, optional fields that vary between records, arrays inside arrays, all of that breaks the tabular structure. If you’re sending that data, stick with JSON. You might also can also do a hybrid where TOON handles the flat parts, and JSON handles anything irregular.

Finally, the math only works at scale. If you’re just sending two or three records, then the token overhead of explaining the format in the system prompt costs more than you save. Hundreds or thousands of records is where TOON earns its keep.

What You Need To Know

TOON writes field names once as a header row, then one comma-separated line per record after that.
Benchmarks on uniform data like episode stats show roughly a 60% token reduction.
You MUST include format instructions in your system prompt. LLMs aren’t trained on TOON and won’t figure it out on their own.
Flat, consistent data is where TOON shines. Nested or irregular structures are still better handled by JSON.

The post Token-Oriented Object Notation (TOON) For PHP Developers appeared first on PHP Architect.

The PHP Podcast 2026.04.30

Eric Van Johnson — Fri, 01 May 2026 01:54:46 +0000

PHP Podcast – April 30, 2026

Hosts: Eric Van Johnson & John Congdon

Another fun episode of the PHP Podcast! Here’s what we covered:

The Drone Slayer Strikes
Eric and John wrapped up a Padres game at beautiful Petco Park in downtown San Diego — and things got weird on the way out. A rogue drone started buzzing around a busy intersection, lingering on a guy on a scooter, before making a fateful attempt to fly in front of Eric’s car. It did not make it. The controller came running out, Eric kept driving, and John has already dubbed him “the drone slayer.” Eric still hasn’t looked at whether his wife’s car got scratched, which feels like the bravest choice of all.

Baseball Week Never Ends
The reason today’s episode started an hour early? Baseball. John’s week was wall-to-wall: a Tuesday night little league game, the Padres game with Eric on Wednesday, practice Thursday night, the playoff draft reveal Friday, a little league game Saturday, and another Padres game Sunday. Eric pointed out John was wearing his own last name on a jersey to a Padres game, which opened up a whole sidebar on why anyone buys a $200 jersey with a player’s name on it when players change teams every two years anyway.

Walking Pneumonia and the Power of the Right Antibiotic
John’s week was also scrambled because his son had been diagnosed with regular pneumonia — but after not getting better, a second doctor visit revealed it was actually atypical (walking) pneumonia, which requires a completely different antibiotic. Once on the correct medication, his son bounced back almost immediately. The kid had been pushing himself trying to feel well enough for sixth grade camp, but there’s really no faking it with the wrong treatment.

The Archie Situation — AI Standups Gone Sideways
Eric has had a rough stretch after Anthropic shut down OpenClaw, the platform that powered their internal Discord bot Archie (a.k.a. Alfred). Archie had been running daily team standups, generating weekly summaries, letting team members tag it with updates throughout the day, and even setting reminders. Everyone got spoiled by it. Since then, attempts to migrate to Ollama — both locally and through the web service — have been plagued by slow response times and dropped messages. Eric is close to pulling the plug and going back to the old manual method, and he’s not happy about it.

Claude SSH’d Into Eric’s Server and Fixed Everything
For weeks, Eric had been fighting a broken Postiz Docker container — a self-hosted social media scheduling tool he uses to post across platforms. After updates broke it and multiple attempts at a fresh install still left it broken, he dropped the problem in Claude’s lap and explained the whole situation. Claude asked for permission to SSH into the remote server on Eric’s Tailscale network, and Eric said sure. Thirty minutes later, Claude had identified the culprit — a Temporal workflow engine losing its configuration on restart — wrote a fix script, configured the service to reconfigure properly on boot, and even set up a cron job to restart the container on reboot. Eric’s still trying to find that chat to review exactly what it did, but the service is running.

GitHub is Getting Hammered by AI Agents
GitHub has had a rough patch of outages, and the numbers tell the story: 20 million new repos per month, 1.4 billion commits, 90 million pull requests — with a dramatic spike right at the start of 2026. Part of the culprit? AI agents being unleashed on codebases to automatically open pull requests from backlog tickets. Eric has a client doing exactly this, and while it sounds impressive from the owner’s perspective (“look at all this work getting done!”), the developers on the ground report that a high percentage of those AI-generated PRs require significant human correction before they’re anywhere close to mergeable. The comparison to Reddit’s early explosion — and the one engineer who basically didn’t sleep for two years — felt pretty apt.

The GitHub Security Vulnerability Nobody Talked About
As if the outages weren’t enough, GitHub quietly disclosed a serious security vulnerability: a specially crafted git push — using malformed options in the push metadata — could allow arbitrary code execution on GitHub’s own servers. Eric had to dig to find the blog post because GitHub was not exactly shouting about it. To their credit, they state that their investigation found no evidence the vulnerability was ever exploited in the wild. But knowing that a specific sequence of bytes in a git push could have handed someone the keys to GitHub’s servers is genuinely unsettling.

The Creator of Ghosty Is Leaving GitHub
Mitchell Hashimoto — creator of the Ghostty terminal and formerly of HashiCorp — announced he’s leaving GitHub, where he’s been a user since 2008 (user #1299). This comes shortly after the Zig programming language made the same move, also citing reliability concerns. Eric was mildly skeptical of the “announcing I’m leaving” genre of posts, pointing out that GitHub doesn’t especially need your permission to stop using it. Notably, Hashimoto’s post doesn’t say what he plans to use instead. John joined GitHub in 2009, which led to a fun live expedition through his commit history — turns out he got serious about coding right around July 2013, roughly when DiegoDev landed its first client.

Update Composer. Like, Right Now.
PHP developers tend to set Composer up and forget about it — but there’s been a serious security vulnerability patched in a recent release that you absolutely want. The fix is simple: just run composer self-update. It updates in place and keeps a rollback copy in case anything breaks. While you’re at it, if you have global Composer packages installed, run composer global update to catch those too. Eric noted that Composer should really warn you when you’re significantly behind versions, the way Claude Code does. Until it does, just make a habit of it.

Linux Kernel Exploit — Patch Your Servers
A CVE was shared in the phparch Discord that affects Ubuntu, Amazon Linux, and Red Hat: a Linux kernel exploit that lets an attacker gain root access with a remarkably small payload — around 732 bytes targeting setuid. It’s a good reminder that the old sysadmin badge of honor (“my server has 5-year uptime, never rebooted”) is the wrong mentality now. With tools like Terraform and infrastructure-as-code, spinning up a freshly patched machine is the move. Keep your operating systems current, especially Linux servers running in production.

Holly Built a PHP Tek App — And It’s Already Good
Community member Holly built a native attendee app for PHP Tek, available now in beta on iOS (via TestFlight) and Android. You can browse the schedule, select the talks you want to attend, and it’ll warn you if two of your picks are in conflict — a “merge conflict,” as Eric put it. Best of all, it sends push notifications when sessions you’ve favorited get moved or rescheduled, which happens constantly at tech conferences. Eric’s wife installed it without being told anything about it and figured it out on her own — about as good a usability test as you can get. The app is built natively in Swift and Kotlin. Be kind to Holly — this is a gift to the community.

PHP Tek in 19 Days + New PHP Architect Merch
PHP Tek is nearly here — 19 days out in Chicago. A brand new PHP Architect elephant is coming (tentatively named Holly, after a live-stream vote). Eric also walked through new merch at store.phparch.com: a v-neck version of the classic rainbow PHP Architect shirt, and his personal labor of love — the “I have standards, specifically PSR 0, 1” tee — which he admits has sold exactly zero copies. If the hotel room block is sold out by the time you read this, reach out to the team directly and they’ll see what they can do.

Links from the show:

Host:

Eric Van Johnson

John Congdon

Streams:

- Youtube Channel
- Twitch

Connect & Hire

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

Displace

PHPScore

Put Your Technical Debt on Autopay with PHPScore

Cut code review time & bugs in half instantly with CodeRabbit.

Music Provided by Epidemic Sound

Join Us Live Next Week