Laravel 13 requires PHP 8.3 or higher and, according to creator Taylor Otwell, needs no changes to existing business logic, with most projects able to upgrade by editing composer.json in about ten minutes.

use Illuminate\Queue\Attributes\WithQueue;

#[WithQueue(connection: 'redis', queue: 'payments', tries: 3, timeout: 60)]
class ProcessPayment implements ShouldQueue
{
}

The release adds native PHP #[Attribute] syntax across more than 15 places in the framework. Queued jobs can now declare their connection, queue name, retry count and timeout with a single #[WithQueue] attribute instead of a block of public properties, and Eloquent models can set table names, fillable and hidden fields the same way using #[Table], #[Fillable] and #[Hidden]. The old property-based syntax still works, so the change is fully optional.

A new Cache::touch() method lets developers extend a cache entry's expiration without reading and rewriting its value. Redis handles it with a single EXPIRE command, Memcached with a native TOUCH, and database-backed caches with a plain UPDATE, avoiding the extra round trip and serialization overhead of the old read-then-store approach.

Laravel 13 arrives alongside a stable release of the official Laravel AI SDK, which brings vector and semantic search into the core framework. Applications using PostgreSQL with the pgvector extension can call a new whereVectorSimilarTo() method directly on the query builder, and the SDK also handles generating embeddings and connecting to models from OpenAI, Anthropic and Ollama.

Official starter kits and the Fortify authentication package now include native Passkey support based on WebAuthn, letting new applications offer biometric logins such as Touch ID, Face ID and Windows Hello, plus physical security keys, without extra setup. Because private keys stay on the user's device, this approach removes phishing and credential-stuffing as attack vectors against login endpoints.

Queue routing can now be centralized inside a service provider using Queue::route(), letting developers assign connections and queue names to job classes like ProcessPodcast or GeneratePdfReport in one place instead of repeating configuration at every dispatch call.

Smaller additions include a MySQL/PostgreSQL driver for Laravel Reverb so it can scale horizontally without a dedicated Redis instance, a default concurrency of 2 for Http::pool() instead of serial execution, and the return of team-based multi-tenancy to starter kits with tab-isolated URL routing so users can switch teams in separate browser tabs without breaking session state.