Critical PHP2Shell: two unauthenticated RCE flaws in PHP itself. Fixes shipped on 21 Oct 2026. Check if you are affected →
← All news

Laravel 13 Released: AI SDK, JSON:API Resources and a PHP 8.3 Minimum

Laravel 13 shipped on 17 March 2026 with a first-party AI SDK, JSON:API resources and vector search, and it now requires PHP 8.3 or newer. Laravel 12 stopped receiving bug fixes on 13 August 2026.

Laravel 13 was released on 17 March 2026, continuing the framework's annual release cadence. According to the official release notes, the focus this cycle was on keeping breaking changes to a minimum, so most applications can upgrade without changing much code. The bigger hurdle for older projects is the runtime: Laravel 13 requires PHP 8.3 or newer and supports PHP 8.3 to 8.5.

What's new

  • Laravel AI SDK. A first-party, provider-agnostic API for text generation, tool-calling agents, embeddings, audio, images and vector-store integrations.
  • JSON:API resources. Built-in resources that handle resource objects, relationship inclusion, sparse fieldsets, links and JSON:API-compliant headers.
  • Semantic and vector search. Native vector queries (for example whereVectorSimilarTo()) for PostgreSQL with pgvector.
  • Request forgery protection. The CSRF middleware is formalised as PreventRequestForgery, adding origin-aware request verification while keeping token-based CSRF working.
  • Queue routing. Queue::route() lets you set the default connection and queue for a job class in one place.
  • More PHP attributes. Examples include #[Middleware] and #[Authorize] on controllers, plus #[Tries], #[Backoff], #[Timeout] and #[FailOnTimeout] on jobs.
  • Cache::touch(). Extends an existing cache item's TTL without reading and re-storing its value.

Support timeline

Laravel provides 18 months of bug fixes and two years of security fixes for each major version. The official support table currently reads:

Version PHP Bug fixes until Security fixes until
11 8.2 to 8.4 3 Sep 2025 12 Mar 2026
12 8.2 to 8.5 13 Aug 2026 24 Feb 2027
13 8.3 to 8.5 Q3 2027 17 Mar 2028

That means Laravel 11 and older no longer receive security fixes, and Laravel 12 is now in security-fixes-only mode until February 2027.

What to do

If you are on Laravel 12 with PHP 8.3 or later, the jump to 13 should be small. Applications still on Laravel 11 or earlier, or on PHP 8.2 and below, have a two-step job: upgrade PHP first, then move through the framework versions.

If your Laravel app is stuck on an unsupported version or an old PHP runtime, RescuePHP can help plan the upgrade path or keep it patched in the meantime.

Source: Laravel 13 release notes.