Skip to main content

Introduction

Laravel 13 was released on March 17, 2026. As with the yearly major release cadence, Laravel 13 focuses in particular on AI-native workflows, safer defaults, and more expressive developer APIs. Breaking changes are kept to a minimum, so most applications can upgrade with only small adjustments. On the other hand, many new features—the Laravel AI SDK, semantic search, and more—have been added that can significantly change how modern applications are built.
Laravel 13 support policy: bug fixes through 2027 Q3 and security fixes through March 17, 2028.

PHP requirements update

Laravel 13 requires PHP 8.3 or later. Support for PHP 8.2 has ended.
VersionPHPRelease dateBug fix deadlineSecurity fix deadline
118.2 - 8.4March 12, 2024September 3, 2025March 12, 2026
128.2 - 8.5February 24, 2025August 13, 2026February 24, 2027
138.3 - 8.5March 17, 20262027 Q3March 17, 2028
Major PHP 8.3 benefits include typed constants, the json_validate() function, and the #[\Override] attribute.

Major new features

Laravel AI SDK

Laravel 13’s headline feature is the first-party AI SDK. It provides a unified API for text generation, tool-calling agents, embeddings, audio, image generation, and vector store integration. You can build provider-agnostic AI features while retaining the Laravel-native developer experience. Text generation (agents)
use App\Ai\Agents\SalesCoach;

$response = SalesCoach::make()->prompt('Please analyze this sales transcript...');

return (string) $response;
Image generation
use Laravel\Ai\Image;

$image = Image::of('A donut on a kitchen counter')->generate();

$rawContent = (string) $image;
Speech synthesis
use Laravel\Ai\Audio;

$audio = Audio::of('I love coding in Laravel.')->generate();

$rawContent = (string) $audio;
Embedding generation
use Illuminate\Support\Str;

$embeddings = Str::of('Napa Valley wines are the best.')->toEmbeddings();
See the Laravel AI SDK documentation for details.
Native vector query support, integrated with the AI SDK, has been added. You can run semantic search directly from the query builder using PostgreSQL + pgvector.
$documents = DB::table('documents')
    ->whereVectorSimilarTo('embedding', 'the best wineries in Napa Valley')
    ->limit(10)
    ->get();
Everything—from adding embedding columns to running queries—can be done within the Laravel ecosystem.

JSON:API resources

First-party JSON:API resource support has been added to Laravel. It’s now easy to return responses that conform to the JSON:API specification:
  • Resource object serialization
  • Relationship includes
  • Sparse fieldsets
  • Links
  • JSON:API-compliant response headers

Expanded PHP attributes

Laravel 13 extends declarative configuration via PHP attributes across the framework. Applied to controllers
<?php

namespace App\Http\Controllers;

use App\Models\Comment;
use App\Models\Post;
use Illuminate\Routing\Attributes\Controllers\Authorize;
use Illuminate\Routing\Attributes\Controllers\Middleware;

#[Middleware('auth')]
class CommentController
{
    #[Middleware('subscribed')]
    #[Authorize('create', [Comment::class, 'post'])]
    public function store(Post $post)
    {
        // ...
    }
}
Applied to queued jobs
use Illuminate\Queue\Attributes\Tries;
use Illuminate\Queue\Attributes\Backoff;
use Illuminate\Queue\Attributes\Timeout;
use Illuminate\Queue\Attributes\FailOnTimeout;

#[Tries(3)]
#[Backoff(60)]
#[Timeout(120)]
#[FailOnTimeout]
class ProcessPodcast implements ShouldQueue
{
    // ...
}
Notable new attributes:
AttributePurpose
#[Middleware]Apply middleware to a controller or method
#[Authorize]Apply policy checks on a controller
#[Tries]Maximum attempts for a queued job
#[Backoff]Backoff time for a queued job
#[Timeout]Timeout for a queued job
#[FailOnTimeout]Fail the job on timeout
Additional attributes are introduced for Eloquent, events, notifications, validation, testing, resource serialization APIs, and more.

Queue routing

Use Queue::route(...) to define default queue and connection routing rules for specific jobs in one place.
use App\Jobs\ProcessPodcast;
use Illuminate\Support\Facades\Queue;

Queue::route(ProcessPodcast::class, connection: 'redis', queue: 'podcasts');
You no longer have to hardcode queue names in job classes, decoupling infrastructure configuration from your code.

Cache TTL extension

Use Cache::touch(...) to extend the TTL of a cache item without fetching and re-storing the value.
// Extend the TTL by 3600 seconds without changing the current value
Cache::touch('expensive-computation', 3600);

Security enhancements

Strengthened CSRF protection (PreventRequestForgery)

The CSRF middleware has been renamed from VerifyCsrfToken to PreventRequestForgery, and origin validation via the Sec-Fetch-Site header has been added.
use Illuminate\Foundation\Http\Middleware\PreventRequestForgery;

// Excluding the middleware in tests
->withoutMiddleware([PreventRequestForgery::class]);
VerifyCsrfToken remains as a deprecated alias, but migrating to the new class name is recommended.

Cache deserialization restrictions

A serializable_classes option has been added to config/cache.php, and the default is false. This mitigates PHP deserialization attacks if APP_KEY is leaked.
// config/cache.php
'serializable_classes' => [
    App\Data\CachedDashboardStats::class,
    App\Support\CachedPricingSnapshot::class,
],
If you store PHP objects in the cache, you must explicitly add the classes to the allow list.

Starter kit changes

The starter kits revamped in Laravel 12 (React/Vue/Livewire-based) continue to be available in Laravel 13. Inertia v3 was also released alongside Laravel 13. Key changes include:
  • Simpler layout props
  • Vite 8 support
  • Addition of a withApp callback
  • New Blade components
If you use Inertia v3, consider upgrading it as well.

Other improvements

AI-assisted upgrade (Laravel Boost)

Laravel Boost is a first-party MCP server. It integrates with AI editors like Claude Code, Cursor, OpenCode, Gemini, and VS Code, letting you semi-automate upgrades via the /upgrade-laravel-v13 slash command.
composer require laravel/boost:^2.0 --dev

New contract methods

New methods have been added to the following contracts:
ContractAdded methods
Bus\DispatcherdispatchAfterResponse
Routing\ResponseFactoryeventStream (SSE support)
Auth\MustVerifyEmailmarkEmailAsUnverified
Queue\QueuependingSize, delayedSize, reservedSize, creationTimeOfOldestPendingJob
Cache\Store / Cache\Repositorytouch

Summary

Laravel 13 is a release characterized by “few breaking changes, many new features.” Upgrade work is minimal, while the AI SDK and semantic search in particular have the potential to change how modern applications are built. When you’re ready to upgrade an existing application from Laravel 12 to 13, see the detailed guide below.

Upgrade guide: Laravel 12 to 13

A list of breaking changes and step-by-step upgrade instructions.
Last modified on July 13, 2026