Stepclimb by BufferSol upgrades your Laravel app as a pull request: one commit per change, composer install and your tests run in our own sandbox, and a repair pass driven by rules for common breakage. Your code never leaves our servers. From $9.99 per upgrade.
The free inspection reads composer.json, composer.lock and package.json only. No code is cloned.
Laravel 11 security fixes ended 12 Mar 2026. Laravel 12 security fixes end 24 Feb 2027. Dates from the Laravel release notes, checked 3 Nov 2026.
Sample, fictional repo
Work order
No. 4821
Airframe
northgate/billing-portal
Hop
11.45 → 13.x
Opened
05 Nov 2026
Upgrade to Laravel 13
9 recipes · 11 min 42 s
01Raise the PHP minimum to 8.3composer.jsonDone
02Rewrite laravel/framework constraint to ^13.0composer.json · composer.lockDone
03Three way diff against the tagged skeletonbootstrap/app.php · config/queue.phpMust fix
04Bump first party packagessanctum · tinker · pintDone
05Repair pass, rule composer.platformseparate commit, 1 of 3 loops usedReview
composer install
npm run build
214 tests passed
Return to serviceVerified · 214 tests passedRun 4821 · 05 Nov 2026
Every Laravel major ends the clock on the one before it
Laravel ships a breaking major each year, around Q1. Each gets 18 months of bug fixes and 2 years of security fixes. So an app left alone for two releases is out of support, and the longer the gap, the bigger the diff. Teams put it off until the client asks about a security questionnaire, a host drops old PHP, or composer audit finds a CVE.
Security fix end dates for Laravel 10 to 13, checked 3 Nov 2026
Release
Behind 13
Security fixes
Status
Laravel 10
04 Feb 2025
ended 1 y ago
Laravel 11
12 Mar 2026
ended 238 d ago
Laravel 12
24 Feb 2027
111 d left
Laravel 13
Current release
in support
Dates from the Laravel release notes, checked 3 Nov 2026. Day counts as of 5 Nov 2026.
What you get in every pull request
Verified, not just opened
composer install, npm run build and your tests run in a fresh sandbox before the PR opens. The result is a check on the PR: Verified, with each stage listed.
composer install
npm run build
214 tests passed
Return to serviceVerified · 214 tests passedRun 4821 · 05 Nov 2026
One change per commit
Each recipe is one atomic commit with a name and a version, so you can review, revert or cherry pick.
a41f9c2Raise PHP minimum to 8.3php-minimum@1.4.0
7be03d1Set laravel/framework to ^13.0laravel-12-to-13@2.1.0
c9d8e47Apply skeleton diff for bootstrap and configskeleton-13@2.1.0
02ab6f8Bump first party packagesfirst-party-13@1.9.2
e55d310Repair: composer.platformrepair@3.0.1
Inspect before you pay
A free report from composer.json and composer.lock: versions behind, support end date, recipes that apply, effort band S to XL.
Laravel
11.45
PHP constraint
^8.2
Stack
Livewire 3, Vite, Pest
Recipes that apply
9 of 9 for 11 to 13
Behind
2 majors
Security fixes
ended 238 d ago
Effort band
SMLXL
Your code stays on our servers
Runs happen in an isolated sandbox that is destroyed after the run. We keep no customer code. Nothing is sent to an AI service.
Sandbox
destroyed after the run
Network
registries and GitHub only
Code kept
none
AI services
none
Stay current weekly
One grouped dependency pull request a week per repo, verified, that refreshes instead of piling up.
Weekly dependencies
Verified
livewire/livewire 3.6.1 → 3.6.4
pestphp/pest 3.8.0 → 3.8.2
vite 6.2.0 → 6.2.3
Monday 06:00, repo timezone. Updated in place.
Every upgrade is a work order. Every change is a logbook entry. Nothing returns to service until it is signed off.
How it works
Step 1
Inspect
Install the GitHub App on the repos you choose. Each repo gets an inspection: Laravel version, PHP constraint, stack, what applies and what it would take.
Laravel
11.45
PHP constraint
^8.2
Stack
Livewire 3, Vite, Pest
Recipes that apply
9 of 9 for 11 to 13
Behind
2 majors
Security fixes
ended 238 d ago
Effort band
SMLXL
Step 2
Open a work order
Pick the hop, for example 11 to 13. We run the recipes in a sandbox, apply the repair rules if something breaks, and re-verify up to three times.
Clone0:21
Recipes1:08
Composer2:40
Build1:55
Tests4:02
Repair0:58
Verify0:38
Total11:42
Step 3
Return to service
You get a pull request with a work order in the body, squawks on the exact lines that need a person, and the Verified check. Merging stays with you. We never auto merge.
northgate/billing-portal · pull request
Work order No. 4821: Upgrade to Laravel 13
Stepclimb by BufferSol · Verified
214 passed
config/queue.php:38Must fix
bootstrap/app.php:14Review
composer.json:9Note
Merging stays with you. We never auto merge.
Rules, not guesses
Recipes make the known changes the same way every time
Recipes and repair rules make the known changes the same way every time. Nothing is sent to an AI service. What is left is listed for you, with a ready prompt for your own agent if you use one.
Expect a few more squawks than a human plus AI pass would leave. We list them instead of guessing.
Squawks 3 open
Sample, fictional repo
Skeleton diff conflict on after_commitMust fixconfig/queue.php:38
Middleware alias moved to the new builderReviewbootstrap/app.php:14
PHP constraint raised from 8.2 to 8.3Notecomposer.json:9
Prompt for your own agent
Fix config/queue.php for Laravel 13.
File: config/queue.php, line 38
Failing output: Undefined array key "after_commit"
Guide: https://laravel.com/docs/13.x/upgrade
Change only this file, then run: composer install && php artisan test
Fifty client apps, one board
The hangar board shows every repo, how far behind it is, when support ends and the last work order. Studio and Agency plans add seats and white label client reports.
Board shown with sample data.
Sample, fictional agency
Kestrel Digital · Agency plan
New work order
Service bulletin. Laravel 12 security support ends 24 Feb 2027, in 111 days. 2 airframes in this hangar are affected.
Airframes
6
Past support
3on 10.x or 11.x
Verified this month
3of 5 runs
Open squawks
72 must fix
Airframe
Laravel
Behind
Support
Tests
Last work order
Action
northgate/billing-portalLivewire · Pest
11.45
ended 238 d ago
214
Verified#4821
Open PR · $9.99
harborline/dispatch-apiAPI only · PHPUnit
10.48
ended 1 y ago
388
No run
Plan 3 hop chain
pinecrest/clinic-bookingInertia React · Pest
12.8
111 d left
127
Verified#4807
Open PR · $9.99
lumen-works/storefrontBlade · no tests
11.31
ended 238 d ago
0
Unverified#4793
Re run
quarry-co/crmInertia Vue · Pest
13.2
in support
291
Verified#4776
Weekly deps on
tidewater/field-opsLivewire · PHPUnit
12.15
111 d left
76
Failed#4812
View 2 squawks
northgate/billing-portalVerifiedLaravel 11.45 · 2 majors behind · ended 238 d ago
harborline/dispatch-apiNo runLaravel 10.48 · 3 majors behind · ended 1 y ago
pinecrest/clinic-bookingVerifiedLaravel 12.8 · 1 major behind · 111 d left
lumen-works/storefrontUnverifiedLaravel 11.31 · 2 majors behind · ended 238 d ago
Against laravelshift.com and doing it with an AI agent
Prices and features compared on 3 Nov 2026. Sources are listed on the full comparison.
Stepclimb compared with laravelshift.com and an AI agent
Compared on
Stepclimb
laravelshift.com
AI agent
Price per upgrade to the latest release
$9.99
$19
Your own agent usage
Verification before you see the PR
composer install, build and tests run in our sandbox
PR not verified, no composer update or tests
Not deterministic, you check each repo
Free inspection
Yes
No
No
Where code is processed
Isolated sandbox, destroyed after the run, nothing sent to an AI service
AI add on uses an external model
Your machine or your agent provider
Agency fleet view
Yes
No
No
Legacy coverage
10 to 13 at launch, 8 and 9 in v1, older in v2
Back to Laravel 4.2
Varies by run
Upgrading from Laravel 7 or older? Today laravelshift.com covers more legacy versions; our 8.x and 9.x paths ship in v1 and older ones in v2.
Pricing
Same core jobs, about half the price of laravelshift.com on every comparable plan, with verification included and no third party AI touching your code. Prices compared on 3 Nov 2026; sources linked.
Agency annual: $999 instead of $1,188. You save $189 a year.
PlanPrice in USDIncludes
Free inspection
See how far behind each repo is
$0always
Unlimited inspection reports
1 upgrade PR a month on public open source repos
Reads composer.json, composer.lock and package.json only
We never auto merge. Every pull request carries a Verified check, or an amber Unverified stamp when your repo has no tests, and you decide what merges. Recipes are tested against fixture apps before they ship.
What does Verified actually mean?
composer install, your asset build and your test suite ran in our sandbox and passed. The check lists each stage (composer, build, tests) and whether it passed.
What if my repo has no tests?
We still open the pull request, and it carries an amber Unverified stamp. Composer install and your build still run, and the stamp says plainly that no tests were available.
Do you clone my private code?
Yes, into an ephemeral sandbox that is destroyed when the run ends. We do not retain customer code. The sandbox can reach package registries and GitHub, nothing else, and blocked hosts are logged.
Does any AI touch my code?
No. Recipes and repair rules make the changes, and nothing is sent to an AI service. The prompts we attach to squawks are templates for your own agent, if you use one.
I do not have org admin on GitHub. What now?
Installing the GitHub App on an organisation needs an owner to approve it. We give you a request approval email you can send them, scoped to the repos you choose.
laravelshift.com already works for us.
It may well. The differences are verification before you see the pull request, a free inspection, no external AI model, a fleet view for agencies and about half the price on comparable plans, compared on 3 Nov 2026. Upgrading from Laravel 7 or older? Today laravelshift.com covers more legacy versions; our 8.x and 9.x paths ship in v1 and older ones in v2.
Our AI agent can do this.
It can try. Recipes give the same result every time, use no tokens, run on a schedule and show every repo on one board. Your agent can also read our prompts, so the two work together.
Which Laravel versions are covered?
10 to 11, 11 to 12 and 12 to 13 at launch. Laravel 8 and 9 paths ship in v1, and older versions in v2.
How does billing and cancelling work?
Payments run through Stripe, and invoices carry your VAT or GST ID. You can cancel at period end or pause for up to 3 months.