Laravel Version Upgrades (8/9/10/11/12 to 13)

If your application is running Laravel 8, 9, 10, or 11, it is running without security fixes. Laravel 8 stopped receiving them in January 2023, Laravel 10 in February 2025, and Laravel 11 in March 2026. Laravel 12 is in its final support window. Laravel 13, released March 17, 2026, receives security fixes until March 2028 and requires PHP 8.3 or newer.

Polish & Pixel upgrades Laravel applications for a living. We do it as a sequence of small, verified steps rather than a big-bang rewrite, and we leave you with a test suite and a deployment pipeline that make the next upgrade routine.

Why upgrade now

• Security. Every supported Laravel version receives security fixes for two years from release. An unsupported version receives none, and the PHP version underneath it is usually unsupported too.
• Dependencies. The longer you wait, the more of your Composer dependencies go abandoned (Laravel Collective's packages are the classic example) and the harder each hop becomes.
• Hiring and velocity. Developers want to work on current Laravel. Modern tooling (Vite, Pest, Livewire, Filament, Octane, the AI SDK) targets current releases only.
• Cost. Laravel 12 to 13 is designed as a minimal-breaking-change release with an estimated upgrade time of about ten minutes for many applications. The expensive part is the accumulated gap below it, and that gap only grows.

Our upgrade process

1. Audit. We read the codebase, run the test suite (or note its absence), and inventory PHP version, Laravel version, and every Composer and npm dependency. You get a written report with the risks ranked.

2. Dependency graph. For each package we determine whether it supports the target Laravel version, needs a version bump, has a maintained replacement, or has to be replaced with in-house code. Abandoned packages are the most common source of upgrade surprises, so this happens before any framework code changes.

3. Regression safety net. Before we change anything, we make sure there is enough test coverage to catch regressions: HTTP tests for the main user journeys, database tests for critical models, and Pest browser tests for the flows that matter commercially. Where a suite does not exist we write the minimum that lets us upgrade with confidence.

4. Stepwise version hops. We move one major version at a time (8 to 9 to 10 to 11 to 12 to 13), following the official upgrade guide for each hop and using Laravel Shift where it saves time. Each hop lands as its own pull request with a green test run, so the work is reviewable and can ship incrementally.

5. PHP platform upgrade. Laravel 13 requires PHP 8.3+. We upgrade the runtime, fix deprecations (dynamic properties, nullable parameter declarations, string-function behaviour changes), and update the CI and server images to match.

6. Mix to Vite. Applications that started on Laravel 8 or earlier usually still build assets with Laravel Mix. We migrate the frontend build to Vite, Laravel's first-party bundler since Laravel 9, including the @vite Blade directive and the MIX_ to VITE_ environment-variable change.

7. Test hardening. Suites are moved to Pest 4 where the team wants it, and flaky or slow tests are fixed so CI stays trustworthy after we leave.

8. Zero-downtime deploy. We ship the upgrade through your existing pipeline, or build one on Laravel Forge or Laravel Cloud, with a rollback plan and monitoring on the first production hours.

Typical effort bands

Every codebase is different, so we scope after the audit, but these bands hold for most applications we see:

• Small (under 20k lines, good tests, few custom packages): one to two weeks for 8 to 13 including Vite and PHP 8.3.
• Medium (20k–100k lines, partial tests, several abandoned dependencies): three to six weeks, with the test safety net taking a meaningful share.
• Large or heavily customised (100k+ lines, forked packages, no tests): scoped in phases; we typically deliver the safety net and the first two hops as phase one.
• 12 to 13 only: often a day or less, most of it verification.

What you get after the upgrade

A supported framework on supported PHP, a dependency list with no abandoned packages, a test suite that runs in CI, a Vite build, and access to the features the old version could not use: native PHP attributes across controllers, jobs, and models, Fortify passkey authentication, JSON:API resources, vector search, the Laravel AI SDK, and the performance work that has gone into the framework over the past four major releases.

Stuck on an old Laravel release? Contact us for an upgrade audit. If you would rather read first, start with our field guide to upgrading a Laravel 8 app to Laravel 13.

Back to services