Fixed price, quoted after a free assessment
Send us your composer.json and we will tell you what stands between your application and Laravel 13, what it will cost, and how we will cut over. Prices start from $799.
Laravel 13 is the current release. Laravel 10 and 11 no longer receive security fixes, so a vulnerability found in either stays unpatched in your application.
| Version | PHP | Bug fixes until | Security fixes until |
|---|---|---|---|
| Laravel 13 | 8.3–8.5 | Q3 2027 | March 17, 2028 |
| Laravel 12 | 8.2–8.5 | August 13, 2026 | February 24, 2027 |
| Laravel 11 | 8.2–8.4 | September 3, 2025 | March 12, 2026 |
| Laravel 10 | 8.1–8.3 | August 6, 2024 | February 4, 2025 |
Dates from the official Laravel release notes. Full history on our Laravel versions page.
After a free assessment; fixed price quoted after assessment. Prices in USD, invoiced in USD, GBP, EUR or INR.
from$799
Small application
from$1,200
Mid-sized application
from$2,999
Large application (thousands of files, full audit)
Each path breaks different things. These are the changes from Laravel's and PHP's own upgrade guides that we check first.
Security fixes for Laravel 10 ended on February 4, 2025. It runs on PHP 8.1–8.3; Laravel 13 needs PHP 8.3–8.5.
Three major releases, and the first is the one that needs the most care. In Laravel 11, a migration that calls change() must restate every column modifier or lose it, double and float columns are defined differently, and Sanctum, Passport, Cashier and Telescope need their migrations published into your application. Carbon 3 makes diffIn methods return floats that can be negative, which can shift date arithmetic in billing or reporting code without raising an error.
We move one major version at a time and run the tests at each step. We keep your Laravel 10 application structure, which is what Laravel's own upgrade guide recommends.
Security fixes for Laravel 11 ended on March 12, 2026. It runs on PHP 8.2–8.4, so an application on PHP 8.2 has to move to 8.3 or later as part of this work.
Two releases. Laravel 12 removes Carbon 2, makes HasUuids generate version 7 UUIDs, stops the image validation rule accepting SVGs, and moves the default local disk root to storage/app/private if you have not defined that disk yourself. Laravel 13 then adds the request-forgery and cache changes described in the next path.
Most of these are small edits. The checking is the work: file paths, upload rules and any code that assumes a UUID format.
Laravel 12 receives security fixes until February 24, 2027, and its bug fixes ended on August 13, 2026. You have time to plan this one.
Laravel's guide estimates 10 minutes for the framework step, and on a small application with good tests that is not far off. What takes longer: VerifyCsrfToken becomes PreventRequestForgery and now checks the Sec-Fetch-Site header; the cache serializable_classes option defaults to false; changing the session serialization setting to json signs every user out; default cache prefixes and session cookie names change if your configuration relies on them; and tests move to PHPUnit 12 or Pest 4.
If you are still on PHP 8.2, note that its security support ends on 31 December 2026, so the PHP move is worth doing at the same time.
PHP 7.4 reached end of life on 28 November 2022. Laravel 10, the oldest release in the table above, needs PHP 8.1, so an application on 7.4 is also on an older framework.
PHP 8 changes behaviour as well as syntax. Comparing a number with a non-numeric string now casts the number to a string, so 0 == "foo" is false where it used to be true, and nothing warns you. each() and array_key_exists() on objects are gone, non-static methods can no longer be called statically, and the @ operator no longer hides fatal errors.
We add tests around the flows that matter before changing anything, then move PHP and the framework together. We aim for PHP 8.3 at least, because Laravel 13 requires it, and PHP 8.3 has security support until 31 December 2027, 8.4 until 31 December 2028 and 8.5 until 31 December 2029.
// Laravel 12
->withoutMiddleware([VerifyCsrfToken::class]);
// Laravel 13
->withoutMiddleware([PreventRequestForgery::class]);
// config/cache.php, new in the Laravel 13 skeleton: false by default.
// An application that caches PHP objects has to name them.
'serializable_classes' => [
App\Data\CachedDashboardStats::class,
],What we look for on every upgrade. You can use this list yourself, whether or not you work with us.
The price is set before the code work starts. If the assessment finds something we did not ask about, it goes in the report, not in a later invoice.
You send composer.json, composer.lock, your PHP version, hosting details and whether you have tests. An NDA can come first if you need one.
You get a compatibility report listing each package and each breaking change that touches your code, with one fixed price and a proposed cutover.
We work on a branch, one major version at a time, with demos on a staging copy, weekly on most projects. Your team can keep shipping while we rebase.
The release goes out on a zero-downtime deployment configuration where your hosting supports it, with a rollback we have tested. You get handover documentation.
Two systems moved off PHP 5.6, the hard end of this work. On the cabinet manufacturer's system we validated data at every step of the database migration and checked each workflow against the old system running in parallel. The loyalty system was our own earlier build, rebuilt with every card, balance and rule intact. Most of our work is delivered under NDA, so many projects cannot be named.
Cabinet manufacturer's ordering, dealer-portal and inventory system moved from PHP 5.6 and MySQL 5.0 to Laravel 13 on PHP 8.5 and MySQL 8, with a new Next.js front end. Eight months, workflows preserved, now live.
Loyalty-card management system we first built on PHP 5.6, re-platformed onto Laravel with all cards, balances and rules preserved. Two months, live since mid-2026, Indian client.
What people ask before they send us a composer.json.
Small application: from $799. Mid-sized application: from $1,200. Large application (thousands of files, full audit): from $2,999. After a free assessment; fixed price quoted after assessment. Prices are in USD, invoiced in USD, GBP, EUR or INR.
We give you a timeline with the fixed price, after the assessment, because it depends on the size of the jump and your tests. For scale, our two published legacy projects took about eight months and two months. Both started from PHP 5.6, so a move between recent Laravel versions is a much smaller job.
We configure the cutover as a zero-downtime deployment where your hosting supports it, stage the release and test the rollback. We do not promise that nothing can interrupt service, and some choices, such as changing session serialization, sign users out. We tell you about those before release.
The assessment lists every package that has no release for the target version. For each one we propose a replacement, a fork or a rewrite, and the cost is in the fixed price rather than a surprise later.
Yes, it is usually required. Laravel 13 needs PHP 8.3–8.5, so anything on an older PHP version moves with the framework. We confirm your hosting can run the new version during the assessment.
Laravel 13, in almost every case. It has security fixes until March 17, 2028, against February 24, 2027 for Laravel 12. The exception is a package you cannot replace that has no Laravel 13 release yet, and the assessment will show that.
Yes. That is what our two published upgrades were: systems on PHP 5.6 re-platformed onto Laravel. These jobs are scoped individually, after the same free assessment.
Yes. Most of our work is delivered under NDA, so many projects cannot be named. Send the NDA before the code if you prefer.
Send your composer.json and your current PHP version. The assessment is free, and you get a fixed price with no obligation to go ahead.
We reply within one business day (IST).