Statamic was ready for Laravel 13 before Laravel was

Two weeks early

Laravel 13 came out on March 17, but Statamic had supported it since version 6.5 on March 4. If you wanted to try the new framework on a Statamic site before its release, you could, as long as you told Composer to accept development versions with "minimum-stability": "dev" and "prefer-stable": true.

That's not a coincidence. Laravel makes its next major version available for testing well before release, and the better-maintained packages use that time. What stands out with Statamic is that the work didn't stop at the core: the first-party addons and the starter project that new sites are created from got matching updates too.

Thirteen lines and a dependency chain

The pull request that did it, Laravel 13 by Duncan McClean, adds 13 lines and removes 11, in two files. Most of them widen version constraints in composer.json, so that laravel/framework and several Symfony components accept the next major version. The test suite now runs against Laravel 12 and 13.

The real work was elsewhere. Statamic can only support a new Laravel version once every package it depends on does too, and Duncan's pull request lists five that had to move first: Inertia's Laravel adapter, Stillat's Blade parser, Spatie's Laravel Ray, the GraphQL package by rebing, and laragraph's utilities. Each of those got its own pull request in its own repository.

Statamic's first-party addons got matching pull requests, among them SEO Pro, the static site generator, the Eloquent driver, the importer, and the migrator. So did the starter project. Runway from the Statamic Rad Pack and Duncan's own addons, such as Cargo and Guest Entries, followed the same path.

That chain is the part of a framework upgrade most people never see. A CMS can only be as ready as its slowest dependency, and for Statamic, none of them held things up.

What Laravel 13 brings

The release notes put one thing first: the team focused on avoiding breaking changes and expects most applications to upgrade with minimal code changes. Laravel's general promise is that a major upgrade should take a day or less.

The headline features target developers who write their own Laravel code. The biggest is a first-party AI SDK for text, images, audio, and embeddings, which pairs with new vector search in the query builder for PostgreSQL with pgvector. The rest are smaller quality-of-life changes. PHP attributes can now replace class properties on models, jobs, commands, and controllers, while JSON:API resources, queue routing per job class, and Cache::touch() for extending a cached item's lifetime round out the list.

On a typical Statamic site, where the content lives in flat files and the logic in Antlers templates, you won't notice most of this. It matters for projects that use Statamic inside a larger Laravel application, or that bring their own models, jobs, and API endpoints. For those, Laravel 13 is where new framework features will land from now on.

One change touches every site: CSRF protection. Like any Laravel app, Statamic relies on its middleware, which Laravel 13 reworks as PreventRequestForgery. It now also checks where a request comes from, while token-based protection keeps working.

Should you upgrade now?

For Statamic 6 sites, the step is small. Statamic 6 already requires PHP 8.3, which is also Laravel 13's new minimum, so the usual obstacle of a PHP upgrade on the server doesn't apply. What's left is your own code and your addons. Every addon on a site, first-party or not, needs a release that allows Laravel 13. Run composer why-not laravel/framework 13.0 and Composer will tell you which package is holding you back.

There's no rush either. Laravel 12 gets bug fixes until August 13, 2026, and security fixes until February 24, 2027. A site that upgrades in the summer, once its addons have caught up, loses nothing.

Statamic 5 is a different story. It supports Laravel 10, 11, and 12, but not 13, so Laravel 13 is only an option after moving to Statamic 6. And for some Statamic 5 sites, the clock is already running. Laravel 11 stopped receiving security fixes on March 12, a few days before Laravel 13 came out. Statamic 5 supports Laravel 12, so a site still on Laravel 11 should upgrade to it now and plan the move to Statamic 6 from there.

Built on someone else's schedule

Every CMS built on a framework lives on that framework's calendar. Laravel ships a major version every year, and each time the question for Statamic is the same: how long until we can follow? This year the answer was negative two weeks.

Part of that is down to how the Laravel world works. Laravel 13 was available as a development version well before its release, and the packages Statamic depends on were moving at the same time, so a CMS several layers up could be ready when the framework was. For anyone choosing a platform for client work, that's worth more than any single feature in the release. A framework is only as current as the packages you can actually run on it.