Support dates
| Release | Security fixes end |
|---|---|
| Laravel 12 | 24 Feb 2027111 days left |
| Laravel 13 | Date not in our calendar yet. See laravel.com |
Laravel 13 requires PHP 8.3 or newer, so an app on PHP 8.2 must raise its PHP version before or with this upgrade. Laravel 12 supports PHP 8.2 to 8.5.
Update composer.json
The official upgrade guide lists these constraints. Change them, then run composer update and read the output for conflicts with your other packages.
| Package | Constraint | Section |
|---|---|---|
| laravel/framework | ^13.0 | require |
| laravel/boost | ^2.0 | Where already listed |
| laravel/tinker | ^3.0 | Where already listed |
| phpunit/phpunit | ^12.0 | require-dev |
| pestphp/pest | ^4.0 | require-dev |
Raise the PHP minimum
Set the php constraint in composer.json to ^8.3 or higher, and make sure your host, your CI image and your local machines run PHP 8.3 or newer before you run composer update.
Rename the CSRF middleware references
The 13.x guide renames the CSRF middleware to PreventRequestForgery. The old names stay as deprecated aliases, so nothing breaks at once, but search your code and bootstrap/app.php for VerifyCsrfToken and plan the rename. The guide also adds a preventRequestForgery(...) middleware API.
Review the skeleton and config changes
The guide says skeleton changes are optional. You can compare your app with the new skeleton on GitHub. Two config changes matter because they change behavior:
config/session.php: the 13.x skeleton sets the sessionserializationoption tojson. Changing it fromphpinvalidates every active session, so users sign in again. Keepphpif you need sessions to survive the deploy.config/cache.php: the skeleton addsserializable_classesset tofalse. If your app stores PHP objects in the cache on purpose, list the allowed classes or move to array payloads.
Run the install, the build and the tests
After composer update, run composer install from a clean checkout, build your assets and run the whole test suite. A pull request that skips these steps can fail in CI for reasons you could have seen earlier. Packages not listed in the guide, such as Sail, Pint, Sanctum and Collision, may need a bump too. Check each one against its own release notes.
What Stepclimb does for this hop
Each of these is one named recipe and one commit in the pull request. The pull request also carries a work order and the Verified check, which means composer install, your asset build and your tests ran in our sandbox first.
- Update composer.json for Laravel 13: PHP 8.3 minimum, framework, Boost, Tinker, PHPUnit and Pest constraints as in the table above.
- Sync skeleton and config files with Laravel 13, as a three way merge. Conflicts keep your version and become squawks, including the session and cache notes above.
- Report the VerifyCsrfToken rename as a squawk. The guide does not show the exact replacement for every bootstrap/app.php setup, so we list it and change nothing automatically.
Sources and method
Constraints and changes on this page come from the official Laravel documentation and were read on 5 Nov 2026. Support dates come from the Laravel release notes. If the official guide changes after that date, trust the official guide.