Laravel 11 is now outside its official security-fix window. Here is what legacy projects need to know about support, risk and upgrade planning.

Laravel 11 was released on 12 March 2024 and introduced useful changes for application structure, developer experience, security and real-time features. It is no longer the latest upgrade target, but it still matters for businesses running legacy Laravel applications.

As of 18 June 2026, Laravel 11 is outside its official security-fix window. That does not mean every Laravel 11 application is broken overnight, but it does mean the version should be treated as legacy and reviewed carefully.

If your application still runs on Laravel 11, the question is not whether the release was useful. The question is how long it should remain in production, what risks need managing and how the next upgrade should be planned.

Why Laravel 11 still matters

Laravel 11 was an important release because it simplified parts of the framework and made new applications feel leaner. It also introduced features that helped developers build, monitor and maintain applications more efficiently.

For existing projects, Laravel 11 can still be a useful reference point. Many applications were upgraded to it, built on it or planned around its support window. Understanding what changed helps teams make better decisions about maintenance and future upgrades.

What changed in Laravel 11

• Streamlined application structure
  Laravel 11 reduced some of the default structure in new applications, making projects feel leaner while keeping familiar framework concepts.
• Code-first application configuration
  The bootstrap/app.php file became a more central place for configuring routing, middleware, exception handling and other application behaviour.
• Health routing
  New applications could define a simple health-check endpoint, useful for monitoring and infrastructure checks.
• Per-second rate limiting
  Laravel 11 added more granular rate limiting, helping applications control traffic and queue behaviour more precisely.
• Graceful encryption key rotation
  Applications gained a safer way to rotate encryption keys without immediately breaking access to data encrypted with previous keys.
• Laravel Reverb
  Laravel introduced a first-party WebSocket server for real-time application features.

What the support window means now

Laravel's support policy provides bug fixes for 18 months and security fixes for 2 years. For Laravel 11, bug fixes ended on 3 September 2025 and security fixes ended on 12 March 2026.

• Laravel 11 was released on 12 March 2024.
• Laravel 11 requires PHP 8.2 to 8.4.
• Bug fixes ended on 3 September 2025.
• Security fixes ended on 12 March 2026.

That support status should shape your planning. A Laravel 11 application may continue to run, but new work should be assessed against current framework support, PHP compatibility, package compatibility and security expectations.

How to review a Laravel 11 application

If your business relies on a Laravel 11 application, start with a clear technical review before changing anything. The goal is to understand risk, effort and priority rather than jumping straight into an upgrade.

• Check the current PHP version
  Confirm the server is running a compatible and supported PHP version for the current application and the planned upgrade path.
• Audit third-party packages
  Review Composer dependencies, abandoned packages and anything that may block a framework upgrade.
• Review custom application code
  Look for framework-specific changes around routing, middleware, configuration, queues, authentication and tests.
• Assess security exposure
  Prioritise public-facing areas, authentication, payment flows, admin tools and sensitive data handling.
• Plan the upgrade properly
  Map the route from Laravel 11 to a currently supported Laravel version, then decide whether the work should be done in one step or staged carefully.

When to get help

Framework upgrades are not only about installing a newer version. They can affect hosting, package support, deployment workflows, testing, background jobs, integrations and the way the application is maintained.

If your application supports important business processes, a planned upgrade is usually safer than waiting until a compatibility issue or security requirement forces the work at short notice.

Our Laravel development work helps teams assess existing applications, plan upgrades and maintain bespoke web applications with a clearer view of risk and long-term support.