Modern Laravel Frontends: Livewire 4, Inertia, React, Vue, and Alpine.js

Laravel 13 is the latest stable release of the Laravel PHP framework, launched on March 17, 2026, at Laracon EU 2026 by Taylor Otwell. As of June 2026, the latest stable build is 13.14.0. Laravel 13 requires PHP 8.3, includes a stable AI SDK, supports PHP Attributes in 15+ locations, offers a native JSON:API resource class, and introduces security-hardening defaults — all with zero application-level breaking changes from Laravel 12. If your team is on Laravel 12 and PHP 8.3, this is the smoothest major-version upgrade in recent Laravel history.

This guide covers every new feature, breaking change, the step-by-step upgrade process, architecture tradeoffs, common mistakes, and security considerations — everything you need to plan and execute your upgrade with confidence. If you're evaluating whether to rebuild on Laravel or need expert help with a Laravel upgrade in Mumbai or anywhere in India, our team at Laravel development services is available to help.

What Is Laravel 13 and When Was It Released?

Laravel 13 is a major version of the Laravel PHP framework, released on March 17, 2026, by creator Taylor Otwell at Laracon EU 2026 in Amsterdam. The release follows Laravel's annual cadence — one major version per year, with long-term support via bug fix and security patch windows.

Each major version receives 18 months of bug and security fixes, followed by six months of security-only fixes, totaling a 2-year support window before end-of-life. Laravel 13's EOL date is March 17, 2028.

Laravel 13 on PHP 8.3 benchmarks at approximately 445 requests per second on typical API endpoints. Prepared statement caching is enabled by default in the query builder, improving read-heavy workloads by 15–25% with MySQL 8.x and PostgreSQL 16+.

Prerequisites and Version Requirements

Meeting the prerequisites for Laravel 13 is crucial before starting the upgrade. A failed prerequisite check will block the upgrade before any application code runs.

PHP Version Requirements

• PHP 8.3 — hard minimum. PHP 8.2 support is fully removed.
• PHP 8.4 — supported.
• PHP 8.5 — supported.
• PHP 8.2 and below — not supported. Composer will refuse to install Laravel 13 on PHP 8.2.

PHP 8.1 reached end-of-life in December 2025 and receives no security patches. PHP 8.2 support ends in December 2026. Staying on Laravel 12 with PHP 8.2 means running an end-of-life runtime by the end of 2026, making the PHP version bump in Laravel 13 a security necessity as much as a feature requirement.

Ensure your production, staging, and CI environments all support PHP 8.3 before beginning the upgrade. Many shared hosts still default to PHP 8.2 even though PHP 8.3 has been available since November 2023.

Sequential Upgrade Path

Laravel does not support version skipping. The only valid upgrade path to Laravel 13 is:

1. Laravel 10 → Laravel 11 (complete and deploy)
2. Laravel 11 → Laravel 12 (complete and deploy)
3. Laravel 12 → Laravel 13 (this guide)

If your application is on Laravel 10, you are looking at three independent upgrades before reaching Laravel 13. Each must be completed and tested in isolation. Attempting to jump directly from Laravel 10 or 11 to 13 is not supported and will introduce upgrade debt that is difficult to untangle.

Running a Laravel 10 or 11 application and need to reach Laravel 13? Our Mumbai-based team handles multi-step Laravel upgrades — from version audit through to deployment and post-upgrade testing.

Laravel 13 Key Features

Laravel 13 delivers eight significant additions across developer ergonomics, API design, caching, configuration, queues, authentication, and AI integration. None are mandatory — all existing code continues to work — but each solves a real production problem.

PHP Attributes Across 15+ Framework Locations

PHP Attributes are a native PHP 8.0+ syntax for attaching metadata to classes, methods, and properties using the #[AttributeName] notation. Laravel 13 adds first-party Attribute support across more than 15 framework locations — Models, Controllers, Jobs, Commands, Listeners, Mailables, Notifications, and more. The old property-based syntax remains fully supported; Attributes are completely optional and additive.

Here is how PHP Attributes look on an Eloquent Model:

// PHP Attributes on Eloquent Models (new in Laravel 13, optional)
use Illuminate\Database\Eloquent\Attributes\Table;
use Illuminate\Database\Eloquent\Attributes\Fillable;
use Illuminate\Database\Eloquent\Attributes\Hidden;
#[Table('posts', primaryKey: 'id', incrementing: true, timestamps: true)]
#[Fillable('title', 'body', 'user_id')]
#[Hidden('deleted_at')]
class Post extends Model {}

And on a Controller with per-method middleware and policy authorisation:

// PHP Attributes on Controllers (new in Laravel 13)
use Illuminate\Routing\Attributes\Controllers\Authorize;
use Illuminate\Routing\Attributes\Controllers\Middleware;

#[Middleware('auth')]
class CommentController extends Controller
{
#[Middleware('subscribed')]
#[Authorize('create', [Comment::class, 'post'])]
public function store(Post $post) { }
}

When to use them: Attributes are most useful in new greenfield code or when onboarding developers who are familiar with modern PHP or other frameworks (Symfony, NestJS) that use declarative annotations. Do not mass-convert existing models just to use the new syntax — it increases diff noise with no runtime benefit.

Laravel AI SDK Goes Stable

The Laravel AI SDK exits beta with Laravel 13 and is now a fully stable, first-party API. It provides a unified interface for text generation, tool-calling agents, embeddings, image generation, audio synthesis and transcription, and vector-store integrations. It supports three first-party providers out of the box: OpenAI (GPT-4o, GPT-4o-mini), Anthropic Claude, and Google Gemini.

// Laravel AI SDK — basic text generation (stable in Laravel 13)
use Laravel\AI\Facades\AI;

$response = AI::text()
->using('openai', 'gpt-4o')
->prompt('Summarize this article: ' . $article)
->generate();
echo $response->text();

The SDK also handles embeddings and vector search natively, with PostgreSQL and pgvector as the primary backend:

// Laravel AI SDK — embeddings + vector search
use Laravel\AI\Facades\AI;

$embedding = AI::embeddings()
->using('openai', 'text-embedding-3-small')
->input('What is the refund policy?')
->generate();
$results = Post::query()
->nearestTo('embedding_column', $embedding->vector)
->limit(5)
->get();

Teams building AI-powered features in Mumbai and across India — whether for customer support automation, semantic search, or content generation — can now use the AI SDK without depending on community packages. Store all AI provider credentials (OpenAI, Anthropic, Gemini API keys) in .env and reference them through config/ai.php. Never commit API keys to version control.

For guidance on integrating AI into your existing Laravel application, see our Laravel performance guide which covers caching strategies that pair well with AI-augmented workflows.

Native JSON:API Resource Class

Laravel 13 ships a built-in JsonApiResource class that produces spec-compliant JSON:API responses — including the resource object structure, relationships, sparse fieldsets, and the correct application/vnd.api+json Content-Type header.

// JSON:API resource (new in Laravel 13)
use Illuminate\Http\Resources\JsonApi\JsonApiResource;

class PostResource extends JsonApiResource
{
public function toAttributes($request): array
{
return [
'title' => $this->title,
'body'  => $this->body,
];
}
}
// Response Content-Type: application/vnd.api+json

Generate a JSON:API resource with Artisan:

php artisan make:resource PostResource --json-api

For teams with complex API requirements — compound documents, advanced filtering, or pagination per the JSON:API spec — the mature third-party package cloudcreativity/laravel-json-api provides a richer feature set. The built-in class is ideal for new APIs that need spec compliance without additional dependencies.

Cache::touch() — Extend TTL Without Fetching

Cache::touch() is a new method introduced in Laravel 13 that extends a cache item's TTL without retrieving its value. On Redis, it issues a single EXPIRE command. On Memcached, it uses the native TOUCH operation. This is more efficient than the previous pattern of get-then-set when you only need to reset the expiry clock.

// Cache::touch() — extend TTL without fetching the value (new in Laravel 13)
Cache::touch('session-token', now()->addHours(2));
// Redis: issues EXPIRE command only
// Memcached: uses native TOUCH operation
// Custom cache drivers: must implement touch() method

Breaking change note: If your application uses a custom cache store implementation, you must add a touch(string $key, $seconds) method before upgrading. Failure to do so will cause a fatal runtime error when any code calls Cache::touch().

Typed Configuration Retrieval

Laravel 13 adds typed helper methods on the config() helper. If a config value does not match its declared type at application boot, a ConfigTypeMismatchException is thrown immediately — rather than silently failing at runtime later in the request lifecycle.

// Typed config retrieval (new in Laravel 13)
// Throws ConfigTypeMismatchException at boot if type does not match
$debug = config()->boolean('app.debug'); // throws if not a boolean
$ttl   = config()->integer('cache.ttl'); // throws if not an integer

This is a meaningful improvement for production reliability. A misconfigured environment variable (for example, APP_DEBUG="yes" instead of APP_DEBUG=true) now causes a loud boot failure rather than a silent runtime bug in a specific code path. Teams that suppressed deprecation warnings in Laravel 12 may encounter boot failures after upgrading — these need to be fixed, not silenced.

Queue::route() and Queue Inspection Methods

Queue::route() provides a centralized way to define which queue and connection a job class uses by default, without per-class $queue and $connection property configuration:

// Queue::route() — centralized job routing (new in Laravel 13)
use Illuminate\Support\Facades\Queue;

Queue::route(ProcessPodcast::class, queue: 'podcasts', connection: 'redis');
Queue::route(SendEmailJob::class,   queue: 'emails',   connection: 'sqs');

Queue inspection methods were added in Laravel 13.8.0, allowing you to inspect jobs across all queues in a single call:

// Queue inspection (added in Laravel 13.8.0)
use Illuminate\Support\Facades\Queue;

$pending  = Queue::allPendingJobs();   // all pending jobs across every queue
$reserved = Queue::allReservedJobs();
$delayed  = Queue::allDelayedJobs();

Worker pause and resume events were also added in 13.8.0, giving monitoring tools better visibility into queue worker state.

Passkey (WebAuthn) Authentication

Passkey authentication — also known as WebAuthn — is now integrated into Laravel's official starter kits and Fortify. Users can authenticate via device biometrics (Face ID, Touch ID, Windows Hello) or hardware security keys (YubiKey). Passkeys cannot be phished, making them significantly more secure than passwords for user-facing applications.

Team-based multi-tenancy is also available in the official starter kits in Laravel 13, enabling workspaces where multiple users share access to the same organisation's data — a common requirement for B2B SaaS applications.

For a full overview of protecting your Laravel application at the infrastructure and application level, read our Laravel security guide.

PreventRequestForgery Middleware

The PreventRequestForgery middleware formalises CSRF protection with origin-aware request verification. It checks both the traditional synchroniser token and the HTTP Origin header, closing a class of vulnerabilities where crafted cross-origin requests could bypass token-only CSRF checks in certain SPA configurations.

This is largely transparent for standard Laravel applications. SPAs with non-standard CSRF configurations or cross-origin setups should audit their VerifyCsrfToken configuration before deploying the upgrade.

Breaking Changes in Laravel 13

Laravel 13 has zero application-level breaking changes from Laravel 12, but several default configuration changes are quiet enough to surface only after deployment. The table below covers every change that can affect a running application.

Laravel Shift and the Laravel Boost /upgrade-laravel-v13 MCP command automate most of the mechanical changes. However, manual review of config/cache.php, config/session.php, and CSRF configuration is still required before going live.

Step-by-Step Laravel 13 Upgrade Guide

Follow these steps in order. Do not proceed to the next step until the current one is verified on a staging environment.

1. Verify PHP 8.3 on all environments.
   Run php -v on your production server, staging server, and CI runner. If any environment returns PHP 8.2 or lower, upgrade PHP first. On cPanel-hosted environments, use the PHP selector in WHM. On VPS or dedicated servers, install PHP 8.3 via your package manager (e.g., apt install php8.3) and update your web server config.
2. Update composer.json.
   Change "laravel/framework": "^12.0" to "laravel/framework": "^13.0". Also update "php": "^8.2" to "php": "^8.3". Run composer update laravel/framework --with-all-dependencies.
3. Run the upgrade via Laravel Boost (optional but recommended).
   Install Laravel Boost at version ^2.0: composer require laravel/boost:^2.0 --dev. Then, inside Claude Code, Cursor, or VS Code with the MCP server connected, run the /upgrade-laravel-v13 slash command. This automates structural changes to config files and service providers.
4. Audit config/cache.php.
   Check if your application caches PHP objects (Eloquent models, value objects, collections). If it does, add a serializable_classes array to your cache configuration listing the permitted classes. If you only cache scalar values and arrays, no change is needed.
5. Set cache and session prefixes explicitly in .env.
   Add CACHE_PREFIX, REDIS_PREFIX, and SESSION_COOKIE to your .env file with the values you want. This prevents the framework's default prefix from changing between versions and causing cache misses after deployment.
6. Update custom cache store implementations.
   If your application defines a custom cache store driver, add the touch(string $key, $seconds): bool method. Without it, any call to Cache::touch() will throw a fatal error at runtime.
7. Audit .env for config type mismatches.
   Review values in .env that map to typed config keys (booleans, integers). APP_DEBUG must be true or false — not "yes", "1", or "on". Fix any mismatches before deploying.
8. Run the test suite on PHP 8.3.
   Switch your local environment to PHP 8.3, run php artisan test, and fix any failures. Pay attention to deprecation notices — PHP 8.3 promotes some 8.x deprecations to warnings or errors.
9. Deploy to staging and smoke test.
   Deploy to staging first. Test authentication flows, queue processing, cache reads and writes, and any API endpoints that rely on JSON resources.
10. Deploy to production.
    After staging passes, deploy to production during a low-traffic window. Run php artisan optimize:clear immediately after deployment to clear cached config and routes.

Need help planning or executing a Laravel upgrade for your Mumbai or India-based business application? Our team handles the entire process — from version audit and staging migration to production deployment and post-upgrade monitoring.

Architecture Decisions and Tradeoffs

Laravel 13 introduces several features that come with genuine architectural tradeoffs. Here is an honest assessment of each.

The overarching theme of Laravel 13's architecture is explicit over implicit. Cache serialization, config types, and queue routing all move from implicit defaults to declarations the developer controls. This is the correct direction for production applications — the short-term friction of making existing implicit behavior explicit pays off in long-term reliability.

Common Mistakes When Upgrading to Laravel 13

Every Laravel major-version upgrade produces a predictable set of mistakes. Here are the most common ones teams make when moving to Laravel 13 — and how to avoid them.

• Not verifying PHP 8.3 on the actual production host before starting. Many teams confirm PHP 8.3 locally and on CI, then discover their shared hosting provider still defaults to PHP 8.2. Confirm the runtime version on the production server before touching composer.json.
• Treating "zero breaking changes" as "zero work." The cache prefix change, the serializable_classes default, and the CSRF middleware change are quiet defaults that only surface after deployment. They do not appear during composer update. Audit the three config files regardless.
• Not adding touch() to custom cache store implementations before upgrading. This is the most dangerous omission — it causes a fatal runtime error when any code path calls Cache::touch(), which may not happen during development but will happen under production traffic patterns.
• Mass-converting existing models to PHP Attribute syntax without business justification. PHP Attributes in Laravel 13 are additive — they do not replace properties. Converting 50 models in a single PR just to use the new syntax increases diff noise, creates merge conflicts, and delivers no runtime benefit.
• Jumping from Laravel 10 directly to 13. The framework does not support version skipping. This is not a warning — Composer will refuse to install dependencies correctly if intermediate versions are skipped. Each step must be completed and tested.
• Not listing permitted classes in config/cache.php after upgrade when caching Eloquent models. Applications that cache model instances, value objects, or collections will receive either silent cache misses or deserialization errors after the serializable_classes default changes to false. List the classes explicitly or move to caching serialised arrays instead.
• Carrying over incorrect assumptions about the Laravel AI SDK from its beta phase. The SDK changed significantly between its Laravel 12 beta and the Laravel 13 stable release. Review the official docs at laravel.com/docs/13.x/ai-sdk before building any AI features.
• Not pinning Laravel Boost to ^2.0 when using the /upgrade-laravel-v13 command. Older Boost versions do not include the Laravel 13 upgrade prompts. The command will either fail or produce incorrect upgrade steps if run with an older Boost version.

Security Considerations in Laravel 13

Laravel 13 is the strongest security release in the framework's recent history. Every major security change is described below.

PHP 8.3 minimum as a security forcing function. PHP 8.1 reached end-of-life in December 2025 and receives no security patches. PHP 8.2 support ends in December 2026. Laravel 13's PHP 8.3 minimum forces teams onto a supported runtime with active security maintenance — a decision that benefits every application running on the framework.

Cache deserialization hardening. The serializable_classes default changing to false prevents PHP object deserialization gadget chain attacks. These attacks are possible when an attacker can inject serialized PHP objects into a cache store and control the deserialization process — a known attack vector if an application's APP_KEY is ever leaked. The new default ensures deserialization of PHP objects from cache requires an explicit developer decision.

PreventRequestForgery middleware. Origin-based CSRF verification runs in addition to the token check. This closes a class of cross-origin CSRF vulnerabilities that could bypass token-only verification in certain single-page application configurations with misconfigured CORS or session settings.

Passkey (WebAuthn) authentication. Passkeys are phishing-resistant by design. A passkey is a cryptographic key pair bound to the authenticating device — it cannot be stolen via a fake login page, replayed from another device, or leaked in a database breach (since only the public key is stored server-side). Applications that enable passkey authentication for users gain meaningful protection against credential stuffing and phishing attacks.

Typed configuration at boot. ConfigTypeMismatchException surfaces misconfigured environment variables at application boot — before any request is served. This reduces the window during which a misconfiguration can cause silent security-relevant behavior. A common example is APP_DEBUG=true accidentally enabled in production due to an env type mismatch; typed config catches this at boot rather than letting it run silently.

AI provider credentials. The Laravel AI SDK reads provider credentials (OpenAI, Anthropic, Gemini API keys) from config/ai.php, which references environment variables. Never hardcode API keys or commit them to version control. Rotate keys immediately if a repository containing credentials is ever made public — AI API keys can generate significant costs within minutes if abused.

The security fix support window for Laravel 13 runs until March 17, 2028. Plan your upgrade to Laravel 14 before that date to maintain continuous security patch coverage. If your team needs help with ongoing Laravel integrations and automation or security hardening, our team works with applications of all sizes across Mumbai and India.

Testing and Verification After Upgrade

Testing after a Laravel upgrade is not optional. Follow this verification checklist after completing the upgrade on staging before promoting to production.

1. Run the full test suite: php artisan test — all tests must pass on PHP 8.3 before continuing.
2. Verify authentication flows: Test login, logout, password reset, and (if enabled) passkey registration and authentication.
3. Verify queue processing: Dispatch test jobs and confirm they are picked up and processed by workers on the correct queues and connections. If using Queue::route(), verify routing rules work as expected.
4. Verify cache operations: Confirm cache reads and writes work. If your app uses Cache::touch(), test it explicitly. If your app cached PHP objects, verify that deserialization works after adding classes to serializable_classes.
5. Verify JSON API responses: If using the new JsonApiResource, check that the response Content-Type is application/vnd.api+json and the response structure matches the JSON:API specification.
6. Verify config type validation: Run php artisan config:clear && php artisan config:cache and watch for ConfigTypeMismatchException. Fix any env value mismatches before deploying.
7. Verify API endpoints: Run integration tests or Postman collections against staging for all critical API routes — authentication, data CRUD, file uploads, and webhook receivers.
8. Smoke test production after deployment: After deploying to production, run php artisan optimize:clear, then manually verify login, a key user workflow, and the queue dashboard. Monitor application logs for the first 30 minutes.

Laravel 13 Support Lifecycle

Laravel 13's support lifecycle follows the framework's standard two-year policy:

• Bug fixes and security fixes: Until approximately September 2027 (18 months from release)
• Security fixes only: September 2027 to March 17, 2028
• End of life (EOL): March 17, 2028

Laravel 14 is expected to be released in early 2027, following the same annual cadence. Teams should plan an upgrade to Laravel 14 well before March 2028 to maintain continuous security patch coverage. Running an EOL framework version means your application will receive no security patches for any vulnerabilities discovered in the framework after that date.

For teams evaluating whether to build on Laravel for a new project, or whether to migrate an existing PHP application to Laravel, our Laravel development services page covers our approach to long-term application maintenance alongside new builds.

Frequently Asked Questions

What are the minimum PHP requirements for Laravel 13?

Laravel 13 requires PHP 8.3 as the hard minimum — PHP 8.2 support is fully dropped. PHP 8.4 and PHP 8.5 are also supported. The PHP version bump is partly a security decision: PHP 8.1 reached end-of-life in December 2025 and receives no security patches, while PHP 8.2 support ends December 2026. Teams on shared hosting should confirm their host supports PHP 8.3 in a staging environment before attempting the upgrade.

Does Laravel 13 have breaking changes that will break my application?

Laravel 13 has zero application-level breaking changes from Laravel 12 — it is the smoothest upgrade in recent Laravel history. The only change that will block an upgrade cold is the PHP 8.3 minimum requirement. There are also a handful of quiet default changes in the cache and CSRF configuration that only surface after deployment, not during composer update. Audit config/cache.php, config/session.php, and your CSRF configuration before going live.

Can I upgrade directly from Laravel 10 or 11 to Laravel 13?

No — Laravel does not support version skipping. The only supported upgrade path is sequential: Laravel 10 to 11, then 11 to 12, then 12 to 13. Each intermediate upgrade must be completed, tested, and deployed independently before the next step. Teams on Laravel 10 are looking at three separate upgrades before reaching Laravel 13.

What is the Laravel AI SDK that shipped stable in Laravel 13?

The Laravel AI SDK is a first-party package that provides a unified PHP API for text generation, tool-calling agents, embeddings, image generation, audio synthesis and transcription, and vector-store integrations. It was in beta during the Laravel 12 era and became fully stable with Laravel 13. It supports OpenAI (GPT-4o and others), Anthropic Claude, and Google Gemini as first-party providers. Teams that evaluated it during the beta phase may carry outdated assumptions about its stability and API surface.

How do I use the Laravel Boost MCP server to upgrade to Laravel 13?

Laravel Boost (laravel/boost on GitHub) is a first-party MCP server with 15+ AI-assisted development tools. Install it at version ^2.0 — older versions do not include the Laravel 13 upgrade prompts. Once installed and connected to your editor (Claude Code, Cursor, OpenCode, Gemini CLI, or VS Code), run the /upgrade-laravel-v13 slash command. The command automates most mechanical upgrade tasks, but you must still manually review config/cache.php, config/session.php, and your CSRF configuration before deploying.