Laravel 13 Ships with PHP Attributes, Passkeys, and Zero Breaking Changes
Taylor Otwell unveiled Laravel 13 at Laracon EU, delivering PHP 8 Attributes as an alternative to class properties, built-in passkey authentication in starter kits, and a new Reverb database driver for horizontal WebSocket scaling. The release requires PHP 8.3+ and promises the smoothest upgrade path in Laravel history.
Taylor Otwell took the stage at Laracon EU in Amsterdam to announce Laravel 13, the latest major version of the PHP framework that powers millions of web applications. The release makes good on Otwell's long-standing promise that Laravel major versions should be upgrade-friendly: version 13 ships with zero breaking changes for applications running on Laravel 12.
PHP Attributes
The most architecturally significant addition is support for PHP 8 Attributes as an alternative to the class property conventions that Laravel has used since its inception. Instead of defining $fillable, $casts, and $hidden as array properties on Eloquent models, developers can now use #[Fillable], #[Cast], and #[Hidden] attributes on individual properties. The attribute syntax is optional — existing property-based configuration continues to work — but it provides better IDE integration and makes model configuration more explicit.
Passkeys and Authentication
Laravel 13's starter kits and Fortify authentication scaffolding now include built-in passkey support. Passkeys — the FIDO2/WebAuthn credential type that uses biometric authentication instead of passwords — are implemented as a first-class authentication method rather than a bolt-on package. The implementation handles key registration, authentication ceremony, and credential management out of the box.
Reverb Database Driver
Laravel Reverb, the WebSocket server introduced in Laravel 11, gains a database driver that enables horizontal scaling without Redis. The database driver uses MySQL or PostgreSQL as the pub/sub backbone, making it possible to run multiple Reverb server instances behind a load balancer with shared state. For teams that don't want to operate a Redis instance solely for WebSocket coordination, this removes a significant infrastructure dependency.
Cache and Developer Experience
A new Cache::touch() method allows extending a cache entry's TTL without re-fetching and re-storing its value — useful for session-like patterns where access should extend expiration. The Laravel AI SDK exits beta with first-class support for OpenAI and Anthropic APIs, including queue integration for long-running model calls.
Laravel 13 requires PHP 8.3 or later. Bug fixes will be provided through Q3 2027, with security updates continuing through Q1 2028.
Related Articles
Redis 8.4 Brings Hybrid Search, Atomic Multi-Key Operations, and Auto-Repair AOF
Redis 8.4 is now generally available, delivering hybrid search that combines full-text and vector queries using Reciprocal Rank Fusion, new atomic string commands like MSETEX and DELEX, and automatic repair for corrupted append-only files. Lookahead prefetching and JSON memory optimizations round out a performance-focused release.
Deno 2.7 Stabilizes Temporal API and Ships Native Windows ARM Builds
Deno 2.7 has stabilized the TC39 Temporal API, bringing immutable, timezone-aware date and time objects to replace the legacy JavaScript Date API. The release also delivers official Windows ARM builds for Surface and Snapdragon devices, npm overrides support, and global install compilation for standalone executables.
Go 1.26.1 Fixes Five Security Vulnerabilities Including Certificate Verification Panics
The Go team has released Go 1.26.1 and Go 1.25.8 with patches for five security vulnerabilities spanning crypto/x509, html/template, net/url, and os packages. Two critical certificate verification bugs can cause incorrect email constraint enforcement and verification panics that crash TLS-dependent services.