Upgrading Laravel 5–9: step through each version or rebuild?

The dates are from Laravel’s 8.x and 10.x release notes. For the current versions, see Laravel versions. The destination is Laravel 13, which has security fixes until March 17, 2028.

The PHP column is the real pressure. Of the PHP versions these releases support, only 8.2 still has security support on php.net, and that ends on 31 December 2026. So you’re exposed at two levels, and your hosting provider may be the one that forces the issue.

Upgrade one major at a time, running tests and releasing at each stage. It’s the safest route if your tests are good, because every failure traces back to a single version’s changes. The cost is repetition: you update packages again and again, and you also have to find an intermediate PHP version at each step.

These are the steps with the most in them, according to Laravel’s upgrade guides:

• To 6: the str_ and array_ helpers move to the laravel/helpers package. Installing it buys you time. Laravel’s estimate for this step is an hour.
• To 7: Symfony 5 arrives, which reaches your exception handler’s method signatures.
• To 8: class-based model factories replace the old style. laravel/legacy-factories lets you defer rewriting them.
• To 9: Symfony Mailer replaces SwiftMailer, and Flysystem 3 arrives. Anything that customises mail or storage needs attention.
• 10 onwards: covered in our 10 to 11, 11 to 12 and 12 to 13 guides.

Automated tools help here. Laravel Shift charges per step, so a long chain is several purchases, though each is small next to the work it saves.

Create a new Laravel 13 application, then bring your models, controllers, views and routes across in stages, fixing each as it lands. Your database stays as it is, or changes only through small, planned migrations. You skip the in-between versions and their package churn, and you end up with a clean skeleton rather than years of leftovers.

The risk is that it’s easy to lose behaviour that lived in odd places: a middleware, a config value, a scheduled command nobody mentioned. So list what the old application does first, including routes, scheduled tasks, queues and outgoing integrations, and tick each one off as it arrives. We’d use this route for most applications on Laravel 8 or older, when tests are thin.

Rebuilding means new code and often a new data model, working from what the business needs today. It’s the most expensive route and the riskiest, because the old code holds rules that nobody remembers until they’re missing. We’d consider it only when at least one of these is true:

• The application no longer matches how the business works, so much of it would change anyway.
• The data model is the real problem, and can’t be fixed in steps.
• The front end has to be replaced regardless, and it’s tangled through the back-end code.
• The old application barely follows the framework, so there’s little to upgrade.

Packages can decide this for you. filament/filament 2 and livewire/livewire 2 both stop at Laravel 10, so an admin panel built on them is a project of its own. Check yours against the package compatibility matrix.

Neither of these started on an old Laravel version. Both started on plain PHP 5.6, so they’re a harder case than most readers of this page have. They do show how far scope moves the timescale.

We moved a loyalty-card management system we’d originally built ourselves onto Laravel in two months, keeping every card, balance and rule. We knew the code, and the job was to preserve it.

A cabinet manufacturer’s system took about eight months: ordering, dealer portal and inventory moved to Laravel 13, PHP 8.5 and MySQL 8, with a new Next.js front end. We audited the old code first, validated the database migration at each stage, and checked workflows against the old system running in parallel.

The second approach is how we’d handle anything with thin tests. If the old and new systems give the same answer on real work, you have evidence no test suite written after the fact can match.

Our upgrade service starts by reading your code, and a route comes out of that. Published prices run $799–$2,999+ in USD by application size, and older systems can go beyond the top tier. Our cost guide explains why. If you’ve inherited the application and nobody can explain it, start with our first 10 days guide.