Laravel 13: What Actually Breaks When You Upgrade (and What Doesn't)
Laravel 12 stopped receiving bug fixes on August 13, 2026. Since then only security patches remain, and those run out on February 24, 2027. If you have a production app on 12, you are already in the last window. The good news is that Laravel 13 really is a small upgrade. The official docs estimate 10 minutes and say most applications can upgrade "without changing much application code." That is…
The article covers the changes that occur when upgrading to Laravel 13. There are a few key points to note:
1. Laravel 12 stopped receiving bug fixes on August 13, 2026. Security patches are only available until February 24, 2027. Upgrading to Laravel 13 is recommended for production applications on 12. The upgrade process is estimated to take only 10 minutes, but there are some breaking changes to be aware of.
2. The two high-impact changes are:
a. Dependencies in composer.json - Ensure the correct versions of Laravel, Tinker, PHPUnit, and Pest are specified. Update the global Laravel installer and Herd if needed.
b. CSRF middleware changes - The VerifyCsrfToken middleware has been renamed to PreventRequestForgery. It now also performs origin verification using the Sec-Fetch-Site header.
3. Medium impact change:
3.1. The default config/cache.php now includes serializable_classes = false for security reasons. If your application caches arbitrary objects, you need to explicitly declare which classes can be unserialized to avoid deserialization gadget chain attacks.
4. Low-impact changes:
4.1. Laravel 13 requires PHP 8.3 minimum, supporting versions up to 8.5. If you're coming from PHP 8.2, you need to update your PHP version before upgrading.
4.2. Update any references to VerifyCsrfToken and ValidateCsrfToken to PreventRequestForgery in your codebase, especially in tests and route definitions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
