Understanding Release Process

Laravel follows a predictable release cadence. Understanding it helps a team plan upgrades instead of reacting to deprecations during a busy quarter. The exact schedule is published by the maintainers; check the official documentation before planning a migration.

Version numbering

Laravel uses semantic-style major versions: 10, 11, 12, and so on. A major release may contain breaking changes. Minor releases add features without breaking existing code. Patch releases contain fixes.

A typical cycle

1. Major releases arrive on an annual rhythm.
2. Each major version receives bug fixes for a defined period.
3. Security fixes continue for a longer window.
4. Minor releases appear during the supported life of a major version.
5. Deprecations are announced before removal, usually one major version ahead.

Because support windows overlap, a team can wait for the first patch releases of a new major version before upgrading, while still remaining on a supported version.

Planning an upgrade

• Read the upgrade guide for every major version between your current and target versions.
• Update dependencies first; many breaking changes come from third-party packages.
• Run the test suite before changing application code.
• Upgrade in a branch and deploy to staging before production.
• Review deprecated helpers, facades, and configuration keys.

composer outdated
composer update --with-all-dependencies
php artisan test

Laravel Shift and automated help

Automated upgrade services can handle routine changes, but they do not replace a review. Treat generated diffs as a starting point and run the full suite plus a manual smoke test of critical flows.

Release artifacts

Composer locks exact dependency versions in composer.lock. Commit that file for applications, and deploy with composer install rather than composer update. For libraries, the lock file is not shipped.

Staying informed

Follow the official release notes, the framework repository, and security advisories. Subscribe to a dependency vulnerability feed so a compromised package is noticed before an attacker uses it.