Laravel 12 stopped getting bug fixes on August 13, 2026, and gets security fixes only until February 24, 2027. Laravel 13 needs PHP 8.3 or newer. On a fresh 12.70.0 app, one Composer command moved us
Three changes behave differently in practice: a same-origin POST without a CSRF token now succeeds, objects in the session come back as arrays after you switch to JSON serialization, and cached
Upgrade within your normal release cycle. You have until February 2027, but the work is small and the bug-fix window has already closed.