Laravel 13 Is Here: What You Need to Know

Taylor Otwell took the stage at Laracon EU 2026 and announced Laravel 13, which officially shipped on March 17, 2026. The headline features this cycle are substantial: a first-party AI SDK, native passkey support, JSON:API resources, PHP attribute syntax expansion, and enhanced security through improved CSRF protection.

The good news for those dreading upgrade season: Laravel 13 has no breaking changes from Laravel 12. The upgrade should be smooth.

Here's what's actually in the box.

The Laravel AI SDK

This is the feature everyone's been talking about, and for good reason. Laravel 13 ships with a first-party AI SDK that provides a unified API for working with large language models. It supports text generation, tool-calling agents, embeddings, audio generation, image generation, and vector store integrations.

The design goal is provider-agnosticism. It works with OpenAI and Anthropic out of the box, and switching between providers is a single configuration value change, not a codebase rewrite.

use Laravel\Ai\Facades\Ai;

$response = Ai::text('Summarize this article in three bullet points: ' . $article->content);

echo $response->text();

For tool-calling agents, you can define tools as invokable classes and wire them up directly:

$response = Ai::agent()
    ->withTool(new SearchProductsTool())
    ->withTool(new GetOrderStatusTool())
    ->run('What is the status of order #12345?');

This is the kind of first-class AI integration Laravel developers have been waiting for. No more cobbling together third-party packages with incompatible interfaces.

Passkey Support

Passkeys have been a long-requested security feature. Laravel 13 integrates passkey support into the starter kits and the underlying Fortify authentication system. Users can now authenticate via biometrics or hardware security keys, with no passwords involved.

This brings Laravel in line with modern authentication standards and makes it straightforward to offer passwordless login flows without reaching for a third-party service.

JSON:API Resources

Laravel now ships with first-party JSON:API resources, making it easy to return responses that comply with the JSON:API specification. JSON:API resources handle:

Resource object serialization
Relationship inclusion
Sparse fieldsets
Links
JSON:API-compliant response headers

use Laravel\JsonApi\Resources\JsonApiResource;

class PostResource extends JsonApiResource
{
    public function toAttributes($request): array
    {
        return [
            'title' => $this->title,
            'content' => $this->content,
            'published_at' => $this->published_at,
        ];
    }

    public function toRelationships($request): array
    {
        return [
            'author' => UserResource::make($this->author),
        ];
    }
}

For teams building APIs that need to conform to the JSON:API spec, this removes a significant amount of boilerplate that previously required external packages.

PHP Attribute Syntax Expansion

Laravel 13 introduces around 15 new areas where you can use PHP attributes as an alternative to the older method-based syntax. This includes route definitions, middleware, validation rules, and more.

// Before
class UserController extends Controller
{
    public function __construct()
    {
        $this->middleware('auth');
    }
}

// After (with PHP attributes)
#[Middleware('auth')]
class UserController extends Controller
{
    // ...
}

This is opt-in, not a replacement -- existing syntax continues to work. But for codebases that prefer the declarative style, it's a welcome addition.

Enhanced CSRF Protection

Laravel 13 formalizes and enhances the request forgery protection middleware as PreventRequestForgery, adding origin-aware request verification. This means CSRF protection now also checks the Origin and Referer headers for requests that include them, providing an additional layer of defense against cross-site request forgery attacks.

Existing token-based CSRF protection is preserved. This is additive, not a replacement.

Recent Point Releases

Laravel v13.8.0 added methods for inspecting jobs across all queues in a single call, new worker pause/resume events, assertSessionMissingInput() for testing, and SortDirection enum support in the query builder. The framework continues its fast release cadence even after the major version drop.

Upgrade Path

Since there are no breaking changes in Laravel 13, upgrading from Laravel 12 is as simple as bumping the version constraint in your composer.json:

"laravel/framework": "^13.0"

Then run composer update and check the upgrade guide for any application-level changes you should be aware of.

Laravel 13 is a confident, focused release that bets big on AI, modern authentication, and API standards while keeping the upgrade burden as low as possible. If you're running Laravel 12, there's no reason to wait.

Sources: