Laravel 13: what's new and how to upgrade without surprises

Laravel 13 was released on March 17, 2026. It requires PHP 8.3 or newer and supports PHP 8.3–8.5. Bug fixes continue until Q3 2027 and security fixes until March 17, 2028.

If you run Laravel 12, another date matters more: on August 13, 2026 the 12.x branch stopped receiving bug fixes. Security patches continue until February 24, 2027, so it's time to plan the upgrade rather than leave it to the last minute.

What's new in Laravel 13

• Laravel AI SDK (laravel/ai) — an official package for working with language models: text generation, tool-calling agents, embeddings, audio, images and vector stores. Version 1.0 shipped in September 2026.
• Vector search in the query builder: whereVectorSimilarTo() for PostgreSQL with pgvector. Semantic search over products or documents no longer needs a separate database.
• JSON:API resources out of the box — less hand-written code for APIs that must follow the spec.
• PreventRequestForgery — CSRF protection that also checks the request's origin via the Sec-Fetch-Site header.
• Queue routing by job class: Queue::route(...) defines in one place which job goes to which queue.
• New PHP attributes: #[Middleware], #[Authorize], #[Tries], #[Backoff], #[Timeout] — configuration next to the code instead of in separate arrays.
• Cache::touch() — extends a cache entry's lifetime without storing it again.

The ecosystem: Filament 5, Livewire 4 and MCP

• Livewire 4 shipped on January 14, 2026 and Filament 5 on January 16. The only fundamental difference between Filament 4 and 5 is Livewire 4 support, so new projects should start on version 5.
• Laravel Boost is the official MCP server and rule set for AI coding assistants. The assistant sees your project structure and the docs for your exact versions, and can help with upgrades — there is a dedicated /upgrade-laravel-v13 command.
• laravel/mcp (1.0 in September 2026) lets you build an MCP server inside your own application, giving AI agents controlled access to your system's data and actions.

What to check when upgrading

The official guide estimates the upgrade at about 10 minutes, but in real projects check a few things:

1. Dependencies. laravel/framework ^13, PHPUnit ^12 or Pest ^4, Tinker ^3, Boost ^2 — plus compatibility of third-party packages.
2. CSRF. The VerifyCsrfToken middleware is renamed to PreventRequestForgery. The old name still works but is deprecated.
3. Objects in the cache. The cache config gains serializable_classes => false: if you cache objects, their classes must be explicitly allowed.
4. Cache, Redis and session cookie prefixes now use hyphens. After deployment the cache is effectively cleared and sessions may be reset, so schedule the upgrade for a quiet time.
5. upsert() now requires a non-empty uniqueBy.
6. Tests. A full test run and a queue check on staging before production are a must.

Our experience

We built our CRM platform with chatbots on Laravel 13, Filament 5 and Livewire 4 from day one. Storeforma, our e-commerce platform, also runs on Laravel 13. Instead of porting an old codebase, we started from a fresh install and kept only proven solutions from the previous project. For large systems this is often cheaper than clearing years of technical debt.

If your project runs on Laravel 10–12 and you're not sure what an upgrade will cost, start with a short technical audit: dependencies, tests, custom packages, infrastructure. Afterwards it's clear whether it's a day of work or a dedicated sprint.