Upgrade Guide | Laravel 13.x - The clean stack for Artisans and agents

We attempt to document every possible breaking change. Since some of these breaking changes are in obscure parts of the framework only a portion of these changes may actually affect your application. To save time, you may use Shift. Shift is a community-maintained service that automates Laravel upgrades.
You can automate your upgrade using Laravel Boost. Boost is a first-party MCP server that provides your AI assistant with guided upgrade prompts — once installed in any Laravel 12 application, use the /upgrade-laravel-v13 slash command in Claude Code, Cursor, OpenCode, Gemini, or VS Code to begin the upgrade to Laravel 13. This command requires Laravel Boost ^2.0.
Likelihood Of Impact: High
You should update the following dependencies in your application's composer.json file:
If you are using the Laravel installer CLI tool to create new Laravel applications, you should update your installer installation for Laravel 13.x compatibility.
If you installed the Laravel installer via composer global require, you may update the installer using composer global update:
Or, if you are using Laravel Herd's bundled copy of the Laravel installer, you should update your Herd installation to the latest release.
Likelihood Of Impact: Low
Laravel's default cache and Redis key prefixes now use hyphenated suffixes.
In most applications, this change will not apply because application-level configuration files already define these values. This primarily affects applications that rely on framework-level fallback configuration when corresponding application config values are not present.
If your application relies on these generated defaults, cache keys and session cookie names may change after upgrading:
To retain previous behavior, explicitly configure CACHE_PREFIX, REDIS_PREFIX, and SESSION_COOKIE in your environment.
Likelihood Of Impact: Very Low
The cache contracts now include a touch method for extending item TTLs. If you maintain custom cache store implementations, you should add this method:
Likelihood Of Impact: Medium
The default application cache configuration now includes a serializable_classes option set to false. This hardens cache unserialization behavior to help prevent PHP deserialization gadget chain attacks if your application's APP_KEY is leaked. If your application intentionally stores PHP objects in cache, you should explicitly list the classes that may be unserialized:
If your application previously relied on unserializing arbitrary cached objects, you will need to migrate that usage to explicit class allow-lists or to non-object cache payloads (such as arrays).
Likelihood Of Impact: Low
Container::call now respects nullable class parameter defaults when no binding exists, matching constructor injection behavior introduced in Laravel 12:
If your method-call injection logic depended on the previous behavior, you may need to update it.
Likelihood Of Impact: Very Low
The Illuminate\Contracts\Bus\Dispatcher contract now includes the dispatchAfterResponse($command, $handler = null) method.
If you maintain a custom dispatcher implementation, add this method to your class.
Likelihood Of Impact: Very Low
The Illuminate\Contracts\Routing\ResponseFactory contract now includes an eventStream signature.
If you maintain a custom implementation of this contract, you should add this method.
Likelihood Of Impact: Very Low
The Illuminate\Contracts\Auth\MustVerifyEmail contract now includes markEmailAsUnverified().
If you provide a custom implementation of this contract, add this method to remain compatible.
Likelihood Of Impact: Medium
Laravel now validates that the caller provides a non-empty value for uniqueBy, and will throw an InvalidArgumentException instead of generating invalid SQL.
Although the MariaDB and MySQL database drivers ignore the uniqueBy value and always use the table's primary and unique indexes to detect existing records, the validation still applies. An InvalidArgumentException will be thrown if uniqueBy is empty.
Likelihood Of Impact: Low
Laravel now compiles full DELETE ... JOIN queries including ORDER BY and LIMIT for MySQL grammar.
In previous versions, ORDER BY / LIMIT clauses could be silently ignored on joined deletes. In Laravel 13, these clauses are included in the generated SQL. As a result, database engines that do not support this syntax (MySQL, and MariaDB before 11.8.1) may now throw a QueryException instead of executing an unbounded delete.
Likelihood Of Impact: Very Low
Creating a new model instance while that model is still booting is now disallowed and throws a LogicException.
This affects code that instantiates models from inside model boot methods or trait boot* methods:
Move this logic outside the boot cycle to avoid nested booting.
Likelihood Of Impact: Low