Laravel9 min read

What's new in Laravel 13

Laravel 13 shipped on March 17, 2026. Few breaking changes, lots of comfort: PHP attributes, an official AI SDK, JSON:API resources. Here's what changes the way you write code.

Which version, and until when

One major version per year. Each gets 18 months of bug fixes and 2 years of security fixes. Laravel 13 needs PHP 8.3 at minimum (we target 8.4).

20242025202620272028

Laravel 11

Laravel 12

Laravel 13

Bug fixesSecurity only

Laravel 11 is no longer maintained, Laravel 12 only gets security fixes. Every new project starts on Laravel 13.

PHP attributes everywhere

More than fifteen places in the framework now accept PHP attributes instead of class properties. It's optional and non-breaking: configuration reads at the top of the class. Toggle to compare.

Eloquent models

app/Models/Invoice.php

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;

class Invoice extends Model
{
    protected $table = 'billing_invoices';

    protected $fillable = ['customer_id', 'status', 'total'];

    protected $hidden = ['internal_notes'];
}

app/Models/Invoice.php

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Attributes\Fillable;
use Illuminate\Database\Eloquent\Attributes\Hidden;
use Illuminate\Database\Eloquent\Attributes\Table;
use Illuminate\Database\Eloquent\Model;

#[Table('billing_invoices')]
#[Fillable(['customer_id', 'status', 'total'])]
#[Hidden(['internal_notes'])]
class Invoice extends Model
{
}

Queued jobs

app/Jobs/SendInvoiceReminder.php

<?php

class SendInvoiceReminder implements ShouldQueue
{
    use Queueable;

    public $tries = 3;

    public $backoff = [60, 300];

    public $timeout = 120;

    public $failOnTimeout = true;
}

app/Jobs/SendInvoiceReminder.php

<?php

use Illuminate\Queue\Attributes\Backoff;
use Illuminate\Queue\Attributes\FailOnTimeout;
use Illuminate\Queue\Attributes\Timeout;
use Illuminate\Queue\Attributes\Tries;

#[Tries(3)]
#[Backoff([60, 300])]
#[Timeout(120)]
#[FailOnTimeout]
class SendInvoiceReminder implements ShouldQueue
{
    use Queueable;
}

Middleware and authorization in controllers

app/Http/Controllers/CommentController.php

<?php

namespace App\Http\Controllers;

use App\Models\Comment;
use App\Models\Post;
use Illuminate\Routing\Attributes\Controllers\Authorize;
use Illuminate\Routing\Attributes\Controllers\Middleware;

#[Middleware('auth')]
class CommentController
{
    #[Middleware('subscribed')]
    #[Authorize('create', [Comment::class, 'post'])]
    public function store(Post $post)
    {
        // ...
    }
}

Laravel AI SDK

The official AI SDK is stable: one API for text, tool-calling agents, images, audio and embeddings. Switching providers (OpenAI, Anthropic, Gemini) is a matter of configuration, not a rewrite.

app/Services/SalesInsights.php

<?php

use App\Ai\Agents\SalesCoach;
use Illuminate\Support\Str;
use Laravel\Ai\Image;

// Agent: provider (OpenAI, Anthropic, Gemini...) is configuration, not code
$response = SalesCoach::make()->prompt('Analyze this sales transcript...');

// Images and embeddings with the same fluent API
$image = Image::of('A donut sitting on the kitchen counter')->generate();
$embeddings = Str::of('Napa Valley has great wine.')->toEmbeddings();

Semantic search lands in the query builder with whereVectorSimilarTo(), on PostgreSQL with the pgvector extension.

app/Actions/Search/SearchDocuments.php

<?php

// PostgreSQL + pgvector: search by meaning, not by keyword
$documents = DB::table('documents')
    ->whereVectorSimilarTo('embedding', 'Best wineries in Napa Valley')
    ->limit(10)
    ->get();

Laravel now generates responses that follow the JSON:API spec: included relationships, sparse fieldsets, links and headers. Useful when an external client requires that format; for our Next.js front ends, classic JsonResource remains the norm.

terminal

php artisan make:resource InvoiceResource --json-api

app/Http/Resources/InvoiceResource.php

<?php

namespace App\Http\Resources;

use Illuminate\Http\Resources\JsonApi\JsonApiResource;

class InvoiceResource extends JsonApiResource
{
    public $attributes = ['status', 'total', 'due_at'];

    public $relationships = ['customer', 'lines'];
}

Small but useful

Queue::route() centralizes which queue and connection each job uses.
Cache::touch() extends a key's lifetime without reading or rewriting its value.
The PreventRequestForgery middleware checks the request origin (Sec-Fetch-Site header) on top of the CSRF token.
Passkeys are built into Fortify and the starter kits: passwordless sign-in out of the box.

app/Providers/AppServiceProvider.php

<?php

// AppServiceProvider::boot(): one place to route jobs to queues
Queue::route(ProcessPodcast::class, connection: 'redis', queue: 'podcasts');

// Extend a cache TTL without reading and rewriting the value
Cache::touch('dashboard:stats');

Ecosystem to know

Tool	Why
Pest 4	Browser tests with Playwright, visual regression, suite sharding in CI.
Laravel Boost	MCP server and guidelines that give AI assistants your app's exact context (versions, schema, routes).
Starter kits	React, Vue or Livewire base with authentication, passkeys and Pest already set up.
Nightwatch	Official monitoring: slow queries, exceptions, failed jobs in production.
Laravel Cloud	Hosting managed by the Laravel team, deploy on every push.

Upgrading from Laravel 12

Most applications upgrade in under an hour. We always do it on a dedicated branch, chore/upgrade-laravel-13.

terminal

composer require laravel/framework:^13.0 laravel/tinker:^3.0 --with-all-dependencies
composer require pestphp/pest:^4.0 phpunit/phpunit:^12.0 --dev --with-all-dependencies

php artisan test --parallel   # then read the upgrade guide line by line

Source: official Laravel 13 release notes, checked in September 2026.