Your PHP app already runs Mercure? Your AI agent can now stream through it. 📡

Neuron splits what's too big, paces what's too fast, and the browser rebuilds it all in order. Already on FrankenPHP? Mercure ships with it.

Mercure is built by @coopTilleuls

#PHP #Mercure

What if we connect a cluster of @MercureRealTime to a @MongoDB. Thanks to the MongoDB event stream, events are broadcasted to every instances and the subscribers (clients) are notified in real time.

𝐍𝐞𝐰 𝐛𝐥𝐨𝐠 𝐩𝐨𝐬𝐭

Following the release of Mercure 1.0, a complete security audit conducted by our team at Tilia uncovered 10 security vulnerabilities (4 of which were rated high severity). Read @dunglas' full audit breakdown on our blog: tilia.coop/mercure-1-0-2-…

🐘 FrankenPHP 1.13 is out, and it's a big one.

@caddyserver 2.11.7 inside:
- Slowloris protection with idle read/write timeouts
- url_pattern matcher, using the URLPattern web standard
- Incremental header (RFC 10036) for streaming responses
- SSE behind encode now streams immediately

@MercureRealTime 1.0, the stable real-time protocol, built in. Also, mercure_publish() now validates updates and throws on bad input.

Config reloads are now validated before replacing the running one: no more 500s after a broken reload.

5 security vulnerabilities fixed, 2 rated high. Upgrade now, and read the upgrade notes first.

github.com/php/frankenphp…

🥳 @laravel 13 will have native support for @MercureRealTime!! 🪽🤝

github.com/laravel/framew…

@DelaneyGillilan just read it, and it's interesting. i stopped recommending websocket a few years. Besides that HTML, i think SSE or even @MercureRealTime could be used effectively

🚀 Mercure 1.0 alpha is here!

The biggest release in the project’s history brings:

🎯 New matcher system built on top of the WHATWG URL Pattern
⚙️ Revamped authorization mechanism using OAuth 2.0 Rich Authorization Requests
🛠️ Brand-new UI debugger and dev playground 🔒 Security hardening
🔄 0.x compatibility mode for easy migration
📖 Read the announcement and try the updated demo: dunglas.dev/2026/08/mercur…

Isolate deprecated code in dedicated files behind dedicated build tags. Years later you delete ~1,700 lines in one PR, zero issues. Thanks, past-me.

github.com/dunglas/mercur…

🐘 FrankenPHP 1.12.4 is out: a security hardening release.

Highlights:

- Underscore header spoofing blocked at the server layer. The bundled @caddyserver 2.11.4 now ignores header names containing underscores, closing a class of $_SERVER spoofing.
- Bundled @MercureRealTime 0.24.2 security fixes: SSE field injection (CWE-93), reserved-topic forgery, Last-Event-ID disclosure, DoS amplification caps.
- Worker-mode crash and data-race fixes: ext-parallel, metrics, save/close handler.

Every user should upgrade.

github.com/php/frankenphp…

🔒 @MercureRealTime 0.24.2 is out, a security hardening release for the real-time hub.

It rejects SSE field injection (CWE-93) via the id and type fields, blocks forgery of the reserved /.well-known/mercure namespace, fixes a Last-Event-ID metadata leak, and caps element counts to defang DoS amplification.

Every hub operator should upgrade.

github.com/dunglas/mercur…

🛰 @MercureRealTime 0.24.1 is out, riding on @caddyserver 2.11.3.

We just contributed native OTLP metrics push to Caddy upstream. Mercure hubs can now ship metrics straight to your OpenTelemetry collector. No Prometheus scrape job needed.

Drop

metrics {
otlp
}

into your Caddyfile and the standard OTEL_* env vars do the rest. Endpoint, protocol, headers, interval, all of it.

Pairs nicely with the OTel tracing that landed in 0.24, so traces + metrics work end-to-end against any OTLP backend (Grafana Alloy, OTel Collector, Tempo/Mimir, Honeycomb, Datadog, …).

Release notes: github.com/dunglas/mercur…
Upstream Caddy PR: github.com/caddyserver/ca…

🚀 Mercure 0.24 is out!

@MercureRealtime gains native OpenTelemetry tracing for the Hub: dedicated spans nest under @caddyserver's tracing directive, with zero allocations when disabled.

Also in this release:
• file:// URLs for publisher_jwks_url and subscriber_jwks_url, so you can mount a JWK Set as a Kubernetes Secret instead of running a sidecar.
• A @HelmPack chart that satisfies the restricted Pod Security Standard out of the box: rootless UID 1000, drop ALL caps, read-only rootfs.

On the Enterprise side, all four production transports (Redis, PostgreSQL, Kafka, Pulsar) now emit OpenTelemetry spans too, with attributes and error recording matching the upstream pattern.

github.com/dunglas/mercur…

🚀 @MercureRealTime v0.23.5 is out! This release focuses heavily on Helm chart hardening. After a recent cluster audit, we've shipped the necessary constraints directly into the OSS chart.

Key highlights:
🔒 Opt-in NetworkPolicy & CiliumNetworkPolic
📁 readOnlyRootFilesystem works out of the box
🛡️ Restricted PodSecurity defaults

I wrote a blog post breaking down the full story, the new security features, and how to configure them.

Read it here: dunglas.dev/2026/05/mercur…

#Kubernetes #Helm #DevOps #MercureRocks

Learn how we cut our cloud costs by nearly 50% while improving the resilience and performance of the managed version of @MercureRealTime through infrastructure and code optimization: les-tilleuls.coop/en/blog/scalin…

🚨 @MercureRealTime 0.23 is officially out! 🚨

This release brings a massive operational improvement for modern infrastructures, along with new Helm chart features. If you are running Mercure at scale, you'll want this update! 🚀

Here is what's new in v0.23.0:

🩺 Transport-aware Health Checks: Kubernetes (and other orchestrators) can now detect when a hub's transport connection is actually broken, rather than just checking if the Caddy process is alive.

I’ve introduced new /mercure/health/{ready,live} endpoints. The old /healthz HTTP port endpoint is now deprecated.

🛥️ Helm Chart Upgrades: Added support for HTTProute as an alternative to Ingress for Gateway API-based clusters. In addition, you can now configure annotations directly on the Deployment resource.

🏢 Enterprise Goodies: All Enterprise transports (Redis, Postgres, Kafka, and Pulsar) fully implement the new health checks. Production clusters using managed brokers now get 100% accurate readiness/liveness signals out of the box.

🙏 Huge thanks to our new contributor vmignot for adding the deployment annotations feature!

Read the full changelog and download the release: 🔗 github.com/dunglas/mercur…

#Mercure #GoLang #Kubernetes #ServerSentEvents #OpenSource

We've just finalized our next-gen AI-powered security audit tool at @coopTilleuls!

We used it to discover and patch a critical vulnerability in @MercureRealTime as well as in several of our clients' projects.

The Mercure fix also made topic matching 38% faster! ⚡️

1. Update Mercure and FrankenPHP immediately. (Using Mercure.rocks Cloud? You're already updated and protected! ☁️✅)

2. Want us to secure your stack? Contact us for a full security audit! ✉️ contact@les-tilleuls.coop

#CyberSecurity #AI #Mercure #FrankenPHP #OpenSource

🔥 @MercureRealTime v0.21.10 is here!

🚀 Built with @golang 1.26 (10–40% reduction in GC overhead)
🛠 Includes @caddyserver 2.11

Faster, leaner, and ready for production. Upgrade now! 🥳

github.com/dunglas/mercur…

🎄 Merry Christmas #PHP developers! 🎁

FrankenPHP 1.11 is out now!

🔥 Native Hot Reload (HMR)
🪵 Structured Logging
🚀 Improved Performance

🧸 PLUS: "Le Monstre" plushies are available for @ApiPlatform Con attendees! (Everyone else: Early 2026!)

Unwrap it here (blog post, th WordPress video): dunglas.dev/2025/12/merry-…

🧟‍♀️ After days and nights of toil: FrankenPHP 1.10 is alive! 🧟‍♂️

The creature is awake and brings unprecedented power to your #PHP applications:

🐘 PHP 8.5 support
🪽 New mercure_publish() function for easy real-time broadcasting with @MercureRealTime
⚙️ Enhanced extensions & custom workers (hello high-performance gRPC and WebSockets servers!)

Downloads and changelog, right from our laboratory: github.com/php/frankenphp…

Au #ForumPHP 2025, notre coopérateur Albin a tenté de transformer 300 téléphones en pixels pour dessiner le logo #PHP dans la salle. Une expérience participative et interactive à base de PHP, Mercure, #FrankenPHP et @clever_cloud que l'on vous invite à découvrir sous ce post ⬇️