Laravel in late 2026: version 13, Laracon news, and what's next

Laravel 13 is the current major version. It came out on 17 March 2026, needs PHP 8.3 or newer, and gets security fixes until 17 March 2028, according to the official release notes.¹1 Laravel, Release Notes, Laravel 13.x. Since then the framework has shipped a minor release almost every week. The latest, 13.39.0, landed on 27 October, per the laravel/framework releases page.²2 GitHub, laravel/framework releases.

Many PHP shops work on both Laravel and Moodle. This post covers what changed, what it means, and what a Moodle codebase can and can’t borrow from it.

How Laravel got here

Laravel’s first beta came out on 9 June 2011. Taylor Otwell built it as “a more advanced alternative to the CodeIgniter framework”, as Wikipedia’s history puts it.³3 Wikipedia, Laravel.

For years it shipped a new major version every six months. In January 2021 that changed. Laravel moved to one major release a year, because users felt that “Laravel versions were being released more frequently” than they could keep up with.⁴4 Laravel News, Laravel is moving to a yearly major release cycle. Laravel 9 was the first yearly release.

The other change is money. In September 2024 Laravel took a $57 million Series A from Accel, 13 years after the first beta.⁵5 Laravel, Accel invests $57M into Laravel. That money explains most of the company news since. Laravel Cloud, a hosting platform, launched in February 2025,⁶6 Laravel, Everything we announced at Laracon US 2026. and Nightwatch monitoring shipped in June 2025.⁷7 Laravel, Announcing Laravel Nightwatch.

The support table

Each major release gets 18 months of bug fixes and two years of security fixes. Here is the official table:¹

Read that table as of today. Laravel 11 is dead. Laravel 12 stopped getting bug fixes in August and only gets security patches until February. Laravel 13 is the only version still getting ordinary bug fixes.

Every release gets the same window. There is no LTS line in that table. If you run Laravel in production, you are on a yearly upgrade treadmill. The trade is that Laravel says it strives to make each major upgrade take “one day or less”, and the last two majors were deliberately small.

What Laravel 13 actually changed

The release notes call Laravel 13 “a relatively minor upgrade in terms of effort”. Laravel 12 was the same: a dependency bump plus new starter kits for React, Svelte, Vue and Livewire, which replaced Breeze and Jetstream.⁸8 Laravel, Release Notes, Laravel 12.x. The real work now ships in weekly minor releases, and the major version mostly raises the PHP floor.

Four changes in 13 are worth your time.

Attributes instead of properties. Laravel 13 lets you declare middleware, authorization, job retries and timeouts as PHP attributes on the class or method itself. The release notes list #[Middleware], #[Authorize], #[Tries], #[Backoff], #[Timeout] and #[FailOnTimeout], among others:

#[Middleware('auth')]
class CommentController
{
    #[Middleware('subscribed')]
    #[Authorize('create', [Comment::class, 'post'])]
    public function store(Post $post)
    {
        // ...
    }
}

The point is locality. You read the method and see who can call it. No hunting through a routes file or a service provider.

A first-party AI SDK. The Laravel AI SDK gives one API for text generation, tool-calling agents, embeddings, images and audio across providers. Whatever you think of AI features, a framework-maintained wrapper beats every team writing its own HTTP client for each vendor.

Vector search in the query builder. With PostgreSQL and pgvector, whereVectorSimilarTo() runs a semantic search straight from the query builder. This is the boring, useful half of the AI story: search that understands meaning, using the database you already run.

Queue routing and request forgery protection. Queue::route() sets which connection and queue a job class uses, in one central place. The CSRF middleware became PreventRequestForgery, which adds origin-aware checks on top of tokens.

The point releases since March

The weekly releases carry more than the major did. A few from the last month, all from GitHub:²

• 13.34 (29 Sep): jobs can be told when a timeout is about to hit.
• 13.35 (6 Oct): support for the HTTP QUERY route method.
• 13.38 (20 Oct): a PreventStaleDatabaseReads middleware, and a memory fix for lazy() and lazyById().
• 13.39 (27 Oct): config, route and event cache files are now written atomically.

None of these are headline features. All of them are the kind of fix you only get from a team that runs the framework at scale every day.

Laracon US 2026: mostly tooling

Laracon US ran on 28 and 29 July in Boston, according to php[architect]‘s wrap-up.⁹9 php[architect], Laracon US 2026: A Complete Wrap Up. Laravel’s own recap lists what shipped.⁶ Most of it is developer tooling:

• Laravel LSP: the autocomplete for routes, views and config that VS Code users had, now as a language server for Neovim, Zed and Sublime Text.
• CPX: an npx for Composer. cpx laravel/pint runs Pint without adding it to composer.json.
• artisan doctor: health checks for things like a missing APP_KEY or missing PHP extensions. It fixes what it can.
• artisan dev: dev processes registered in PHP instead of a composer.json script.
• Pint for Blade: the code formatter now formats templates too.
• Debounced jobs and refreshable locks: five quick dispatches of the same job collapse into one run, and a long job can extend its lock with $lock->refresh().

On the AI side, the SDK gained human approval for agent tool calls: an agent can pause and wait for a person to approve, deny or edit what it is about to do. Laravel Boost, the MCP server that went into public beta in August 2025 with 15+ tools for coding agents,¹⁰10 Laravel, Announcing Laravel Boost. now infers a project’s own conventions.

Laravel Cloud got the rest of the stage time: managed queue workers that wake in under a second instead of about 30, scale-to-zero for the whole stack in under 500 milliseconds, MySQL included, and Next.js and Nuxt deployments next to a Laravel backend.

Pest 5 was also announced there. Its Tia engine reruns only the tests a change affects. php[architect] reports Laravel Cloud’s suite of 19,000+ tests dropping from three minutes to five seconds.⁹

What’s next

Laravel 14 has no announced date. Laravel News expects it in Q1 2027, with PHP 8.4 as the minimum because Symfony 8 requires it.¹¹11 Laravel News, What We Know About Laravel 14. The features on the master branch so far are small, and any of them can change before release.

Laracon EU already happened, on 2 and 3 March 2026 in Amsterdam, two weeks before Laravel 13 shipped.¹²12 Laravel News, Laracon EU 2026. Laracon AU runs 4 to 6 November 2026 in Brisbane.¹³13 Laracon AU, Tickets.

One more October item matters to anyone on PHP. After the 21 October PHP security releases, Laravel patched every app on Laravel Cloud in place and told Vapor users that “If you’re running PHP 8.0, or 8.1 no patch is available.”¹⁴14 Laravel, PHP critical vulnerability response updates. That is the same lesson we wrote about for Moodle on outdated PHP.

What Moodle developers can take from Laravel

Moodle is not as far behind as its reputation says. Some of the gap has closed in recent releases:

• Attributes for routes. Since Moodle 4.5, the routing subsystem uses Slim and FastRoute, and you define a route with a PHP attribute like #[\core\router\route(path: '/example')].¹⁵15 Moodle HQ, Routing.
• Dependency injection. Since Moodle 4.4, \core\di offers PSR-11 dependency injection built on PHP-DI.¹⁶16 Moodle HQ, Dependency Injection.
• Hooks. Since Moodle 4.3, the Hooks API replaces some of the old lib.php callbacks with a PSR-14 approach.¹⁷17 Moodle HQ, Hooks.
• Background work. Moodle’s ad-hoc tasks are its queue. They retry failed tasks up to 12 times by default.¹⁸18 Moodle HQ, Ad-hoc tasks.

What Moodle plugin code can still borrow:

1. Typed config. Laravel’s Config::integer() and friends throw an exception when a value has the wrong type.¹⁹19 Laravel, Configuration, Laravel 13.x. A plugin can wrap its own settings in small typed getters and get the same safety.
2. Tests as the default. Moodle supports PHPUnit and Behat,²⁰20 Moodle HQ, PHPUnit and Behat. but nothing forces a plugin to use them. A plugin with no tests installs just the same. Treat tests as part of the plugin, not an extra.
3. Health checks. artisan doctor is a good model for a plugin’s own admin check page: test the settings, the external API keys and the PHP extensions, and say what is wrong in plain words.
4. Tooling in CI. Laravel ships its own formatter, Pint, and Pest 5 added first-party PHPStan support.⁹ On the Moodle side, the GitHub Actions page on moodledev.io points plugin authors to Moodle Plugin CI.²¹21 Moodle HQ, GitHub Actions integration. Run it on every commit.

Why Moodle can’t just be Laravel

Moodle is a product that other people extend. Laravel is a framework you build your own product on. That one difference drives the rest.

Plugins are the architecture. Moodle lists about 56 plugin types, from activity modules to enrolment methods.²²22 Moodle HQ, Plugin types. Each has fixed file names and callbacks that core looks for. A Laravel app has one owner who can restructure anything.

Its own database layer. Plugins must use the $DB Data Manipulation API to “guarantee that your database manipulation will work against different RDBMSes”.²³23 Moodle HQ, Data manipulation API. Eloquent can’t replace it without breaking thousands of plugins.

Backward compatibility is a promise. Moodle’s deprecation policy ties removals to LTS releases. Something deprecated in 4.5 may only be removed in 7.0, and deprecated parameters “MUST be retained, and MUST NOT be renamed”.²⁴24 Moodle HQ, Deprecation policy. Laravel can break things every year because one team upgrades one app. Moodle can’t, because a university upgrades core while running plugins from many different vendors.

How we apply this

We build Moodle plugins the way a modern PHP team builds anything: typed code, PHPUnit and Behat tests, and moodle-plugin-ci on every commit, inside Moodle’s own APIs.