Upgrading from Laravel 10 to 11

Upgrade steps and major changes for moving from Laravel 10 to 11.

Introduction

Laravel 11 was released in March 2024. This guide walks through upgrading from Laravel 10.x to 11.x.

Estimated time to upgrade is about 15 minutes. Actual impact from breaking changes depends on your app’s size and the features you use.

Automated upgrades with Laravel Shift

You can automate the upgrade with Laravel Shift. Shift updates dependencies and configuration files automatically.

---

Changes by impact level

Impact: high

• Dependency updates
• Application structure changes
• Floating-point type changes
• Preserving attributes when modifying columns
• SQLite minimum version
• Sanctum update

Impact: medium

• Carbon 3
• Password re-hashing
• Per-second rate limits
• Spatie Once package

Impact: low

• Doctrine DBAL removal
• The Eloquent model casts method
• Spatial type changes
• The Enumerable contract
• The UserProvider contract
• The Authenticatable contract

---

Upgrade steps

Update dependencies

Impact: high

Update the following dependencies in composer.json.

{
  "require": {
    "laravel/framework": "^11.0",
    "nunomaduro/collision": "^8.1"
  }
}

If you use these packages, update them too.

{
  "require": {
    "laravel/breeze": "^2.0",
    "laravel/cashier": "^15.0",
    "laravel/dusk": "^8.0",
    "laravel/jetstream": "^5.0",
    "laravel/octane": "^2.3",
    "laravel/passport": "^12.0",
    "laravel/sanctum": "^4.0",
    "laravel/scout": "^10.0",
    "laravel/spark-stripe": "^5.0",
    "laravel/telescope": "^5.0",
    "livewire/livewire": "^3.4",
    "inertiajs/inertia-laravel": "^1.0"
  }
}

Then install dependencies:

composer update

If you use Cashier Stripe, Passport, Sanctum, Spark Stripe, or Telescope, you must publish their migrations into your app.

php artisan vendor:publish --tag=cashier-migrations
php artisan vendor:publish --tag=passport-migrations
php artisan vendor:publish --tag=sanctum-migrations
php artisan vendor:publish --tag=spark-migrations
php artisan vendor:publish --tag=telescope-migrations

Also update the Laravel installer if you use it.

composer global require laravel/installer:^5.6

If you previously added doctrine/dbal manually, you can remove it. Laravel 11 no longer depends on this package.

---

PHP version requirement

Impact: high

Laravel 11 requires PHP 8.2.0 or later. Laravel’s HTTP client also requires curl 7.34.0 or later.

---

Application structure changes

Impact: high

Laravel 11 simplifies the default application structure. The number of service providers, middleware, and configuration files has been substantially reduced.

That said, we do not recommend attempting to migrate your Laravel 10 app to the new structure when upgrading. Laravel 11 is designed to also support the Laravel 10 application structure.

Main structural changes:

• Middleware, exception handlers, and routing are now configured directly in bootstrap/app.php
• app/Http/Kernel.php has been removed and integrated into bootstrap/app.php
• The default number of service providers has been reduced and are managed via bootstrap/providers.php
• The number of files in config/ has been reduced (you can publish them as needed via php artisan config:publish)

---

Breaking changes

Authentication

Password re-hashing

Impact: medium

Laravel 11 automatically re-hashes passwords at authentication time if the hash algorithm’s “work factor” has changed.

If your User model’s password field isn’t named password, specify it via the authPasswordName property on the model.

class User extends Authenticatable
{
    protected $authPasswordName = 'custom_password_field';
}

To disable this feature, add the following to config/hashing.php.

'rehash_on_login' => false,

The UserProvider contract

Impact: low

The Illuminate\Contracts\Auth\UserProvider contract adds a rehashPasswordIfRequired method. If you have a class implementing this interface, add the method.

public function rehashPasswordIfRequired(Authenticatable $user, array $credentials, bool $force = false);

The Authenticatable contract

Impact: low

The Illuminate\Contracts\Auth\Authenticatable contract adds a getAuthPasswordName method. If you have a class implementing this interface, add the method.

public function getAuthPasswordName()
{
    return 'password';
}

---

Database

SQLite minimum version

Impact: high

If you use SQLite, SQLite 3.26.0 or later is required.

Note that new Laravel 11 projects use SQLite as the default database driver.

Preserving attributes when modifying columns

Impact: high

When modifying a column, you must explicitly specify every modifier you want retained. Attributes you don’t specify are dropped.

// Laravel 10 preserved unsigned, default, and comment
Schema::table('users', function (Blueprint $table) {
    $table->integer('votes')->nullable()->change();
});

// In Laravel 11 you must specify every attribute explicitly
Schema::table('users', function (Blueprint $table) {
    $table->integer('votes')
        ->unsigned()
        ->default(1)
        ->comment('The vote count')
        ->nullable()
        ->change();
});

If you don’t want to update all existing migrations, squash them.

php artisan schema:dump

Floating-point type changes

Impact: high

The double and float migration column types have been unified across databases.

// double: no longer takes total-digit / decimal-place arguments
$table->double('amount');

// float: only takes optional precision
$table->float('amount', precision: 53);

The unsignedDecimal, unsignedDouble, and unsignedFloat methods have been removed. To keep the unsigned attribute, chain it.

$table->decimal('amount', total: 8, places: 2)->unsigned();
$table->double('amount')->unsigned();
$table->float('amount', precision: 53)->unsigned();

The Eloquent model casts method

Impact: low

A casts method is now defined on the base Eloquent model class. If your app defines a relation named casts, it collides with the base name and needs to be renamed.

Dedicated MariaDB driver

Impact: very low

Laravel 11 adds a dedicated database driver for MariaDB. When connecting to MariaDB, use the mariadb driver in configuration.

'driver' => 'mariadb',

Spatial type changes

Impact: low

Spatial column types have been unified across databases. Instead of methods like point, lineString, and polygon, use geometry or geography.

$table->geometry('shapes');
$table->geography('coordinates');

Pass subtype and srid to explicitly specify type and spatial reference system.

$table->geometry('dimension', subtype: 'polygon', srid: 0);
$table->geography('latitude', subtype: 'point', srid: 4326);

Doctrine DBAL removal

Impact: low

Laravel no longer depends on Doctrine DBAL. The following classes and methods have been removed.

• Schema\Builder::useNativeSchemaOperationsIfPossible()
• Connection::getDoctrineConnection()
• Connection::getDoctrineSchemaManager()
• Connection::registerDoctrineType()
• DatabaseManager::registerDoctrineType()
• The Schema\Grammars\ChangeColumn class
• The Schema\Grammars\RenameColumn class

For database introspection, use the new native methods Schema::getTables(), Schema::getColumns(), Schema::getIndexes(), and Schema::getForeignKeys().

---

Dates

Carbon 3

Impact: medium

Laravel 11 supports both Carbon 2 and Carbon 3. When upgrading to Carbon 3, note that diffIn* methods now return floating-point numbers, and negative values indicate the direction of time.

---

Rate limits

Per-second rate limits

Impact: medium

Laravel 11 supports rate limits measured in seconds rather than minutes. The GlobalLimit and Limit class constructors now take seconds.

// Before (minutes)
new GlobalLimit($attempts, 2); // 2 minutes

// After (seconds)
new GlobalLimit($attempts, 2 * 60); // 120 seconds

The Limit class’s decayMinutes property has been renamed to decaySeconds and is now in seconds.

The ThrottlesExceptions and ThrottlesExceptionsWithRedis constructors also take seconds.

new ThrottlesExceptions($attempts, 2 * 60);
new ThrottlesExceptionsWithRedis($attempts, 2 * 60);

---

Packages

Publishing service providers

Impact: very low

New Laravel 11 apps don’t have a providers array in config/app.php. If your package publishes a service provider, use ServiceProvider::addProviderToBootstrapFile.

use Illuminate\Support\ServiceProvider;

ServiceProvider::addProviderToBootstrapFile(Provider::class);

---

Sanctum

Sanctum update

Impact: high

Laravel 11 doesn’t support Sanctum 3.x. Update the Sanctum dependency to ^4.0 in your composer.json.

Sanctum 4.0 no longer loads its migrations automatically. Publish them with the following command.

php artisan vendor:publish --tag=sanctum-migrations

Also update the middleware configuration in config/sanctum.php.

'middleware' => [
    'authenticate_session' => Laravel\Sanctum\Http\Middleware\AuthenticateSession::class,
    'encrypt_cookies' => Illuminate\Cookie\Middleware\EncryptCookies::class,
    'validate_csrf_token' => Illuminate\Foundation\Http\Middleware\ValidateCsrfToken::class,
],

---

Spatie Once package

Impact: medium

Laravel 11 provides its own once function. If you use the spatie/once package, remove it from composer.json to avoid conflicts.

---

Summary

Laravel 11 involves major structural changes, but since Laravel 10’s application structure continues to work, you can migrate incrementally.

Change	Impact	Action
Update composer.json dependencies	High	Set laravel/framework ^11.0
PHP 8.2 required	High	Verify PHP version
Preserving attributes on column change	High	Review usages of change()
Float type changes	High	Review double/float column definitions
SQLite 3.26.0+ required	High	Verify SQLite version
Sanctum ^4.0	High	Publish migrations
Carbon 3	Medium	Verify diffIn* return values
Per-second rate limits	Medium	Rename decayMinutes to decaySeconds
Doctrine DBAL removed	Low	Migrate to native schema methods

---

References

• Official upgrade guide (English)
• laravel/laravel diff (10.x → 11.x)
• Laravel Shift — community service to automate upgrades
• Carbon 3 changelog