Upgrading laravel/framework 10 to 11
Breakingv10.50.4 → v11.57.1Breaking15Security11Platform2Deprecated1New316Changed220Fixed367Other300
Fetching 112 releases from GitHub…111 / 112
BreakingUpgrade verdict
15 breaking changes and 2 platform requirement changes and 11 security fixes.
In plain terms
- The framework no longer automatically loads routes/console.php, because doing so broke the default console routing setup.
- Removes the undefined class PreventRequestsDuringMaintenance.
- Renames Model::$collection to $collectionClass.
- A method was renamed, so code calling the old name must be updated.
Must act Top 5 of 29 that need code or config changes
laravel/framework publishes an official migration guide for version 11. It covers more than the release notes do.
Laravel 11 upgrade guide ↗PHP requirement changed in v11.0.0: ^8.1 → ^8.2.
What you must change
Breaking15
Reverts auto-discovering routes/console.php because it breaks the default withRouting($console).
routes/console.phpwithRouting($console)Removes the undefined class PreventRequestsDuringMaintenance.
PreventRequestsDuringMaintenanceRenames Model::$collection to $collectionClass.
Model::$collectionModel::$collectionClassRenames the left
has method to contains.hascontainsRemoves the long-deprecated apc_* functions from the APC cache driver.
apc_*Removes the $except property from the ExcludesPaths trait.
ExcludesPaths$exceptReverts support for missing Postgres connection options.
Reverts support for DB aggregate by group and its new methods.
Reverts the change allowing injection using multiple interfaces with the same concrete implementation.
Reverts the non-static JsonResource wrapping change, restoring previous wrapping behaviour.
JsonResourceReverts the support for DB aggregate by group.
Reverts the addition of
dropColumnsIfExists, dropColumnIfExists and dropForeignIfExists.dropColumnsIfExistsdropColumnIfExistsdropForeignIfExistsReverts allowing non-ContextualAttribute attributes to have an after callback.
ContextualAttributeafterReverts the change to the scope for
afterCreating and afterMaking callbacks.afterCreatingafterMakingReverts support for int backed enums in implicit Enum route binding.
EnumSecurity11
Laravel has a File Validation Bypass
ModerateGracefully handles command not found exceptions to avoid credentials exposure.
Patches CVE-2025-22145 in the nesbot/carbon package.
nesbot/carbonPrevents unintended serialization and compression.
Laravel framework susceptible to reflected cross-site scripting
Moderate · CVSS 4.7Laravel framework susceptible to reflected cross-site scripting
Moderate · CVSS 4.7Marks password parameters in the Database connector with the SensitiveParameter attribute.
SensitiveParameterLaravel environment manipulation via query string
High · CVSS 0.0Marks sensitive parameters with the SensitiveParameter attribute.
SensitiveParameterValidates the MAC per key.
Checks for a password before storing the hash in the session.
Platform2
Adds support for PHP 8.4.
Adds PDO subclass support for PHP 8.4.
PDODeprecations to plan for
Deprecated1
Deprecates Factory::$modelNameResolver.
Factory::$modelNameResolver