Upgrading an Old Laravel Application: When, Why and How to Plan It

Many business applications in India were built on Laravel five, six or seven years ago and have been running ever since. The dealer portal works. The billing module works. Nobody wants to touch it. Meanwhile, the Laravel and PHP versions underneath have quietly fallen out of support.

This is one of the most common situations we see: an application that is valuable to the business but sits on foundations that no longer receive security fixes. This guide explains why that matters, how to tell how far behind you are, and how to plan an upgrade that does not disrupt daily work.

How Laravel and PHP support works

Laravel releases a new major version roughly once a year. Under its published support policy, each major version gets bug fixes for 18 months and security fixes for two years. After that, newly discovered vulnerabilities are not patched for that version.

PHP itself has a similar cycle: each PHP version gets active support and then security-only support, after which it reaches end of life. Older Laravel versions cannot run on newer PHP versions, so an old Laravel app often forces the server to stay on an old PHP version too.

That combination - unsupported framework on unsupported PHP - is the real risk.

Why "it still works" is not enough

Security

Vulnerabilities are discovered in frameworks, PHP and third-party packages all the time. On supported versions, fixes arrive as routine updates. On unsupported versions, they never arrive, and your application stays exposed.

Hosting pressure

Hosting providers and server operating systems eventually drop old PHP versions. You may be forced into an emergency upgrade on someone else's timetable.

Integrations break

Payment gateways, SMS and WhatsApp providers, and other APIs update their SDKs and security requirements. Newer SDKs often need newer PHP and Laravel versions.

Hiring and maintenance

Developers are most productive on current versions. Very old code bases take longer to work on, and every new feature is slower to deliver.

Compliance

The Digital Personal Data Protection Act, 2023 expects reasonable security safeguards for personal data. Running software that no longer receives security patches is hard to defend as "reasonable".

Step 1: Find out where you stand

Ask your developer, or check yourself if you have access:

• Laravel version - listed in the composer.lock file, or shown by the "php artisan --version" command.
• PHP version on the server.
• Number of third-party packages and whether each is still maintained.
• Amount of custom code - modules, integrations, reports and scheduled jobs.
• Automated tests - do any exist?

| Situation | Typical approach |
|---|---|
| One version behind, still supported | Routine upgrade as part of maintenance |
| Two or three versions behind | Planned upgrade project, version by version |
| Many versions behind, unsupported PHP | Structured upgrade with audit; sometimes partial rebuild |
| Very old, heavily patched, no documentation | Compare upgrade versus phased rebuild |

Step 2: Audit the application

A proper audit looks at:

• Packages - which are abandoned, which have newer compatible versions, and which need replacing.
• Deprecated features - code using functions or patterns removed in later Laravel or PHP versions.
• Custom changes to vendor code - edits made directly to package files, which upgrades will overwrite.
• Integrations - payment, SMS, email, ERP and courier APIs that may need new SDKs.
• Server setup - PHP extensions, queue workers, cron jobs and storage configuration.

The audit produces a clear list of work and risks, which drives a written plan and quote.

Step 3: Build a safety net

Before changing anything:

1. Put the code in Git if it is not already, so every change is tracked and reversible.
2. Take full backups of the database, uploaded files and server configuration - and test a restore.
3. Create a staging environment that mirrors production.
4. Write tests for critical flows - login, order creation, invoice generation, GST calculations, report totals. Even a small set of automated tests makes each upgrade step far safer. Laravel includes testing tools out of the box.
5. Record expected outputs - sample invoices, reports and exports from the current system to compare against later.

Step 4: Upgrade step by step

The safest path is usually:

1. Upgrade one major Laravel version at a time, following the official upgrade guide for each version.
2. Update packages to versions compatible with that Laravel version, replacing abandoned ones.
3. Raise the PHP version when the target Laravel version requires it.
4. Run tests and manual checks after each step before moving on.

Tools can speed this up. Automated upgrade services and code-refactoring tools such as Rector can handle many mechanical changes, but a developer still needs to review and test the results.

Things that commonly need attention

• Authentication and authorisation changes between versions.
• Changes to how routes, middleware and configuration are organised.
• Date handling, string helpers and collection methods that changed or moved.
• Queue, mail and file storage configuration.
• Front-end build tools, for example moving from older asset tooling to Vite in newer Laravel versions.

Step 5: Test with real scenarios

On staging, with a copy of real data:

• Every user role logs in and completes its main tasks.
• Invoices, GST amounts and report totals match the recorded outputs from Step 3.
• Scheduled jobs, emails, SMS and WhatsApp notifications run correctly.
• Payment gateway flows work in test mode.
• Performance is the same or better.

Ask a few daily users to spend time on staging. They notice things developers will not.

Step 6: Plan the rollout

• Pick a quiet time - not month-end billing or a festival rush.
• Announce a short maintenance window if needed.
• Deploy, run migrations, restart queue workers and clear caches.
• Monitor error logs closely for the first days.
• Keep the previous version and backups ready for rollback.

Questions to ask before approving an upgrade plan

A clear plan answers these without hesitation:

• Which Laravel and PHP versions are we moving from and to, and in how many steps?
• Which packages will be replaced, and does any replacement change how a feature works?
• Which automated tests will be written, and will they stay in the code for future use?
• How will you prove that invoices, GST amounts, stock figures and reports still match?
• What is the rollback plan if something goes wrong on launch day?
• Does the server need changes, and who handles them?
• What maintenance routine do you recommend afterwards?

Warning signs during an upgrade

• Long silences with no staging link to review.
• "We had to change a few things" without a written list of what changed.
• Tests being skipped "to save time".
• Edits made directly on the live server instead of through Git and staging.

If you notice any of these, pause and ask for a status walkthrough before work continues.

Upgrade or rebuild?

Sometimes upgrading is not the best answer. Consider a phased rebuild if:

• The code has no structure, many direct edits to package files and no documentation.
• The business has changed so much that most modules need redesign anyway.
• Upgrading would mean replacing most packages and rewriting most code regardless.

In many cases, a hybrid works: upgrade the core to a supported version first for security, then rebuild the weakest modules over time.

Avoid falling behind again

• Include Laravel, PHP and package updates in a regular maintenance plan.
• Run dependency vulnerability checks such as composer audit routinely.
• Keep automated tests growing with every new feature.
• Review the server setup yearly with your DevOps team.

Key takeaways

• Each Laravel major version gets bug fixes for 18 months and security fixes for two years.
• "It still works" hides growing security, hosting and integration risks.
• Audit first, build a safety net, then upgrade one major version at a time.
• Test with real data and real users before rolling out.
• Regular maintenance is the easiest way to never face a big upgrade again.

Get help upgrading your Laravel application

MetaFox Technologies has 6+ years of experience with Laravel applications and a 25+ person in-house team in Jaipur. If your application is running on an old version, book a free consultation. We will review the code and server and follow up with an upgrade plan and written quote. Learn more about our Laravel development services.