Laravel 13: Everything You Need to Know

Laravel 13 was released on March 17, 2026, and was announced by Taylor Otwell at Laracon EU 2026 in Amsterdam.

Unlike flashy rewrites of the past, this release delivers serious new capabilities without breaking your existing app.

From a first-party AI SDK to native JSON: API resources, here is a comprehensive look at every feature worth your attention.

What's New at a Glance

1. PHP 8.3 as the Minimum Requirement

Laravel 13 drops support for PHP 8.1 and 8.2.

PHP 8.1 reached end-of-life in December 2025, making this as much a security decision as a performance one.

On PHP 8.3, benchmarks show Laravel 13 handling approximately 445 requests per second for typical API endpoints.

PHP 8.5 (released November 2025) is also fully supported, bringing further JIT improvements.

Important: Upgrade PHP on your server before running composer update — Composer will fail immediately if PHP 8.3 is not available.

2. The Laravel AI SDK

The headline feature of Laravel 13 is its first-party AI SDK — a unified, provider-agnostic API for text generation, tool-calling agents, embeddings, audio synthesis, image generation, and vector store integrations.

It works with OpenAI, Anthropic, Gemini, DeepSeek, and OpenRouter — all using the same clean Laravel-style syntax.

Installation:

composer require laravel/ai
php artisan vendor:publish --provider="Laravel\Ai\AiServiceProvider"
php artisan migrate

Basic Agent:

use App\Ai\Agents\SalesCoach;

$response = SalesCoach::make()
    ->prompt('Analyze this sales transcript and suggest follow-up questions');

return (string) $response;

Image, Audio and Embeddings:

use Laravel\Ai\Image;
use Laravel\Ai\Audio;

// Generate an image from a prompt
$image = Image::of('A sunset over the Dhaka skyline')->generate();

// Synthesize natural-sounding audio
$audio = Audio::of('Welcome to Laravel 13!')->generate();
$rawContent = (string) $audio;

Note: When a provider runs out of credits or hits a quota limit, Laravel AI automatically fails over to the next configured provider — no code changes required.

3. PHP Attributes for Model Configuration

Laravel 13 introduces PHP 8 Attributes as a cleaner alternative to class properties for configuring Eloquent models, listeners, notifications, mailables, and broadcast events.

Existing property-based configuration continues to work — this is fully additive.

Before (Laravel 12):

class User extends Model
{
    protected $table      = 'users';
    protected $primaryKey = 'user_id';
    protected $keyType    = 'string';
    protected $fillable   = ['name', 'email'];
    protected $hidden     = ['password'];
}

After (Laravel 13):

#[Table('users', key: 'user_id', keyType: 'string', incrementing: false)]
#[Fillable('name', 'email')]
#[Hidden('password')]
class User extends Model
{
    // Clean. No properties needed.
}

Attributes are also available for:

• Form Requests — #[RedirectTo], #[StopOnFirstFailure]
• API Resources — #[Collects], #[PreserveKeys]
• Commands — signature and description via attributes
• Factories — #[UseModel]
• Test Seeders — #[Seed], #[Seeder]

4. Native Vector / Semantic Search

Laravel 13 adds native vector query support directly in the Eloquent query builder, backed by PostgreSQL and pgvector.

You can generate embeddings from strings via the AI SDK and run similarity searches without any third-party package.

$documents = DB::table('documents')
    ->whereVectorSimilarTo('embedding', 'Best wineries in Napa Valley')
    ->limit(10)
    ->get();

The string 'Best wineries in Napa Valley' is automatically converted to an embedding via the configured AI provider before the query executes.

This makes building AI-powered search experiences dramatically simpler.

5. JSON:API Resources

Laravel now ships first-party JSON:API resources via Illuminate\Http\Resources\JsonApi\JsonApiResource.

It handles resource object serialization, relationship inclusion, sparse fieldsets, links, and spec-compliant response headers out of the box.

use Illuminate\Http\Resources\JsonApi\JsonApiResource;

class ArticleResource extends JsonApiResource
{
    public function toAttributes($request): array
    {
        return [
            'title'   => $this->title,
            'content' => $this->content,
        ];
    }
}

6. Enhanced Security: PreventRequestForgery

The CSRF protection middleware has been refactored and formalized as PreventRequestForgery.

Beyond the rename, it now performs origin-aware request verification — validating the request's Origin header in addition to the standard CSRF token.

This dual-layer check stops cross-site request forgery attacks that pass token validation but originate from an unauthorized domain.

Heads up: If you have custom CSRF middleware that extends the old class, update it to reference PreventRequestForgery before upgrading.

7. Cache::touch() — Extend TTL Without Fetching

A small but impactful addition: Cache::touch() extends a cached item's time-to-live without fetching or re-storing the value.

In high-traffic systems where you only need to keep a cache key alive, this avoids unnecessary read-write cycles.

// Extend the cache key for another 60 minutes
Cache::touch('user:1:profile', now()->addMinutes(60));

8. Queue Routing by Class

Laravel 13 adds queue routing by class via Queue::route().

This allows you to define default queue and connection routing rules for specific job classes without modifying each job individually.

use Illuminate\Support\Facades\Queue;
use App\Jobs\SendInvoice;

Queue::route(SendInvoice::class, connection: 'redis', queue: 'billing');

9. Routing Improvements

Domain-specific routes now automatically take priority over generic wildcard routes during resolution.

For multi-tenant applications using subdomain routing alongside catch-all routes, this eliminates a category of resolution conflicts that previously required explicit ordering or custom middleware.

10. Passkeys and Starter Kit Upgrades

All official starter kits in Laravel 13 ship with passkey (WebAuthn) support, giving users a passwordless authentication experience out of the box.

The starter kits also now include the Teams feature across all flavors:

• Create and manage teams
• Switch between teams
• Invite members
• Update team details

All starter kits have been upgraded to use Laravel 13 and Inertia v3 from day one.

Laravel 12 vs Laravel 13 — Quick Comparison

How to Upgrade

1. Ensure your server runs PHP 8.3 or higher
2. Update composer.json: "laravel/framework": "^13.0"
3. Run composer update
4. Update any custom CSRF middleware to reference PreventRequestForgery
5. Audit custom cache stores and contracts — several gained new methods
6. Test on staging before pushing to production

Pro tip: Use Laravel Shift for automated upgrades — it opens a pull request with clean, atomic commits so you can review every change before merging.

Final Thoughts

Laravel 13 is the kind of release that feels generous.

The team shipped a first-party AI SDK, semantic search, JSON:API resources, passkeys, PHP Attributes, and stronger security defaults — all while keeping the upgrade path shorter than most minor version bumps.

Whether you are building an AI-powered SaaS, a multi-tenant platform, or a simple REST API, Laravel 13 gives you better tools without demanding a rewrite.

If your app already runs on PHP 8.3, there is no reason to wait.

If you are still on PHP 8.2, Laravel 12 continues receiving bug fixes until August 2026 and security fixes until February 2027 — giving you a comfortable window to plan the upgrade.

Happy coding with Laravel 13!