Laravel 13.x Shift

[mattstauffer]

This pull request includes the changes for upgrading to Laravel 13.x. Feel free to commit any additional changes to the shift-169659 branch.

Before merging, you need to:

• Checkout the shift-169659 branch
• Review all pull request comments for additional changes
• Run composer update (if the scripts fail, try with --no-scripts)
• Clear any config, route, or view cache
• Thoroughly test your application (no tests?, no CI?)

If you get stuck, never hesitate to email support. If you need more help with your upgrade, check out the Human Shifts.

[mattstauffer]

ℹ️ Laravel 13 introduced dozens of new PHP attributes. Shift automated the adoption of these PHP attributes for Laravel class properties with simple values. However, there are additional attributes which you may adopt that contain potentially long values. For example, adopting the #[Fillable] or #[Guarded] attributes for model array properties.

 ✨ Automate more with AI...

Shift automates the changes it determines are reliable. If you want to push this automation further, you may paste the following prompt into your AI of choice:

I'm upgrading to Laravel 13. Laravel introduced new PHP attributes you may use
instead of class properties. Please adopt the `#[Fillable]` or `#[Guarded]`
attributes for any model array properties. Make sure to collapse any multiline
arrays into a single line for valid PHP attributes.

[mattstauffer]

⚠️ The default values for CACHE_PREFIX, REDIS_PREFIX, and SESSION_COOKIE changed in Laravel 13. If you are not setting these values explicitly, this change could cause cache or session invalidation after upgrading. As these defaults have changed a few times in recent Laravel versions, Shift recommends explicitly setting these ENV variables in your environment to ensure consistent behavior when upgrading.

 ✨ Automate more with AI...

Shift automates the changes it determines are reliable. If you want to push this automation further, you may paste the following prompt into your AI of choice:

I'm upgrading to Laravel 13. The default values for `CACHE_PREFIX`,
`REDIS_PREFIX`, and `SESSION_COOKIE` have changed. In Laravel 12 and earlier,
these were derived from `APP_NAME` using `Str::slug(env('APP_NAME', 'laravel'),
'_')` as a base (e.g. `myapp_cache_`, `myapp_database_`, `myapp_session`).
Please check my config files and `.env` to determine if these are explicitly set
or relying on the old defaults. If relying on defaults, suggest the explicit
values I should add to my `.env` to preserve the previous behavior.

[mattstauffer]

⚠️ The default cache configuration now includes a serializable_classes option set to false. This hardens cache unserialization behavior to help prevent PHP deserialization attacks. If your application stores PHP objects in cache, you should update this value to an array of the classes that may be unserialized.

 ✨ Automate more with AI...

Shift automates the changes it determines are reliable. If you want to push this automation further, you may paste the following prompt into your AI of choice:

I'm upgrading to Laravel 13. The default cache configuration now includes a
`serializable_classes` option set to `false` to prevent PHP deserialization
attacks. Please search my codebase for any code that stores PHP objects in the
cache (e.g. using `Cache::put()`, `cache()`, or `remember()` with object
values). If found, identify the classes being cached and suggest the explicit
list of classes I should set for the `serializable_classes` option in
`config/cache.php`.

[mattstauffer]

❌ Shift detected a PHP version constraint of ^8.2 in your composer.json file. Laravel 13 requires PHP 8.3 or higher. Shift bumped your PHP dependency to make your application compatible. However, if you encounter PHP errors, you should review the Migration Notes to ensure your PHP code is compatible.

[mattstauffer]

⚠️ Shift detected your application is using Pest. To provide you with a compatible set of dependencies, Shift bumped your version of Pest to 4.x. While your test suite may still run, you are encouraged to review their Upgrade Guide to ensure your test suite is fully upgraded.

[mattstauffer]

ℹ️ Shift updated your dependencies for Laravel 13. While many of the popular packages are reviewed, you may have to update additional packages in order for your application to be compatible with Laravel 13. Watch dealing with dependencies for tips on handling any Composer issues.

The following dependencies were updated by a major version and may have their own changes. You may check their changelog for any additional upgrade steps.

• pestphp/pest
• pestphp/pest-plugin-laravel

The following dependencies were not updated by Shift and may be incompatible. If Composer lists one of these packages as a problem, you should check for a newer version.

• tightenco/duster

[mattstauffer]

⚠️ Laravel 13 now throws a LogicException if you attempt to create new instances or register observer events while booting models. Instead, you must wrap this code within a whenBooted callback.

For example:

static::whenBooted(fn () => static::observe(new ModelObserver));

Shift found boot methods within the following files. You should review the code within these methods and update it to use the whenBooted callback if necessary.

 ✨ Automate more with AI...

Shift automates the changes it determines are reliable. If you want to push this automation further, you may paste the following prompt into your AI of choice:

I'm upgrading to Laravel 13. Calling `observe` while a model is still booting is
now disallowed and will throw a `LogicException`. Any `observe` calls within
`boot` methods must be wrapped in a `whenBooted` callback. For example:
`static::whenBooted(fn () => static::observe(new ModelObserver));`. Please
review the `boot` methods in the following files and wrap any observer
registration in `whenBooted`. Also, identify any `new Model()` instantiation
within `boot` methods and note these may also need to be moved or deferred, but
the appropriate fix will depend on their context.

- app/Models/Hit.php

• app/Models/Hit.php

[mattstauffer]

ℹ️ Laravel 13 changed the password reset mail subject from "Reset Password Notification" to "Reset your password". If your application relied on the previous subject, for example in custom translation messages, you should update them accordingly.

[mattstauffer]

🎉 Congratulations, you're now running the latest version of Laravel!

Next, you may optionally run the following Shifts to ensure your application is fully upgraded, adopts the latest Laravel conventions, and easier to maintain in the future:

• Laravel Fixer automatically updates your code to the latest Laravel conventions.
• Tests Generator intelligently generates model factories, HTTP Tests, and configuration for your application.
• CI Generator intelligently generates CI jobs to lint PHP, check code style, and run tests, including Dusk.

You may also use the Shift Workbench to automate common tasks for maintaining your Laravel application.