Laravel Boost v2.6.0: Testing Best Practices Skill and Read-Only DB Transactions

Laravel Boost v2.6.0 Is Out

Laravel Boost v2.6.0 landed on August 26, 2026, with three headline changes: a consolidated testing-best-practices skill for AI coding agents, database-enforced read-only transactions for the DatabaseQuery MCP tool, and a round of skill management fixes.

Unified Testing Best Practices Skill

Previous versions of Boost shipped several overlapping testing skills — pest-testing, enforce-testing, and phpunit-guidelines. When AI agents had access to all three simultaneously, the results were inconsistent: duplicate mocks, conflicting conventions, and tests that poked at framework internals rather than application behaviour.

v2.6.0 replaces them with a single testing-best-practices skill. Boost composes the skill dynamically based on the testing packages present in your project, so it adapts automatically to Pest, PHPUnit, browser testing, and Test Impact Analysis.

The consolidated skill covers nine areas:

• Assertions — prefer semantic helpers like assertOk() over raw status-code checks
• Endpoint Tests — focus HTTP tests on authorization and core responses, not validation matrices
• Feature Discovery — locate existing tests before writing new ones
• Isolation — prevent shared state leaks; scope database transactions to relevant tests
• Naming — use names that describe expected behaviour
• Performance — avoid creating unnecessary database records in setup hooks
• Review — audit suites and prune duplicate coverage
• Security — test hostile inputs and unauthenticated boundaries
• Test Data — use focused model factories instead of bloated datasets

Database-Enforced Read-Only Transactions

The DatabaseQuery MCP tool previously relied on lexical keyword filtering to block write operations. Keyword checks catch obvious INSERT or UPDATE statements, but they miss more complex SQL shapes such as data-modifying common table expressions (CTEs).

v2.6.0 wraps every query in a database-enforced read-only transaction:

-- MySQL / MariaDB
SET TRANSACTION READ ONLY;
START TRANSACTION;
-- ... your query ...
ROLLBACK;

-- PostgreSQL
START TRANSACTION;
SET TRANSACTION READ ONLY;
-- ... your query ...
ROLLBACK;

For SQLite, Boost sets PRAGMA query_only = ON. Regardless of dialect, the transaction is always rolled back after the query completes, so the database engine itself rejects any modification that slips past lexical parsing.

Skill Management and Tooling Fixes

Safe Skill Installation

boost:add-skill now ignores repository-root SKILL.md files. Previously, the command could mistake a root-level file for a skill directory entry and delete the entire skills directory during installation. The command also accepts arbitrary skill path shapes.

MySQL ANSI_QUOTES Support

Schema reads now quote table types as string literals, so schema tools work correctly when MySQL runs in ANSI_QUOTES mode.

MCP Server JSON Formatting

Boost preserves trailing comments when writing MCP server configurations to JSON files, keeping hand-edited config files intact.

Agent Detection Fix

A false-positive Antigravity detection that fired when scanning the shared .agents directory has been resolved.

Key Takeaways

• The new testing-best-practices skill replaces three overlapping skills, giving AI agents a single, consistent source of testing guidance.
• DatabaseQuery now uses native read-only transactions on MySQL, MariaDB, PostgreSQL, and SQLite — not just keyword filtering.
• boost:add-skill is safer: it no longer risks deleting your skills directory when a root SKILL.md is present.
• MySQL ANSI_QUOTES mode is now supported for schema reads.

Source: Testing Best Practices Skill in Laravel Boost v2.6.0 — Laravel News