Laravel 13 interview-relevant changes

Status: Complete. Last reviewed 2026-08-29.

Laravel 13 adds several useful mechanisms, but an interview answer should connect them to an existing engineering boundary rather than recite release notes. Adoption still depends on the application’s supported PHP/framework matrix, operational needs, and migration evidence.

First-party AI SDK

The laravel/ai package gives agents, structured output, tools, embeddings, media, provider failover, testing fakes, files, and vector stores a Laravel-shaped boundary. “Provider agnostic” reduces application coupling; it does not erase differences in model capability, latency, billing, data retention, or tool semantics. Treat prompts and tool calls as untrusted I/O, constrain authorization in application code, and test observable contracts. This extends the AI-assisted development boundary; it does not replace it.

JSON:API resources

First-party JSON:API resources model resource objects, relationships, inclusion, sparse fieldsets, links, metadata, and response headers. Adopt them when JSON:API is the actual external contract. They are not a reason to migrate a stable bespoke API casually: compatibility, query planning for requested relationships, authorization, and error semantics remain application responsibilities. See API design and Eloquent loading.

Request-forgery protection

PreventRequestForgery formalizes the CSRF middleware with origin-aware verification while retaining token-based protection. The interview distinction is still browser authority: cookies can be attached implicitly, so state-changing cookie-authenticated requests need forgery defenses. Bearer-token APIs have a different threat boundary. Review proxy/origin configuration and excluded endpoints during an upgrade; do not infer authorization from CSRF success. See authentication and API security.

Central queue routing

Queue::route(JobClass::class, connection: ..., queue: ...) centralizes default routing by job class. It can make infrastructure policy reviewable and remove repeated $connection/$queue declarations. It does not guarantee delivery, priority fairness, worker availability, or safe retry. Confirm precedence with per-dispatch choices and ensure deployment worker topology consumes every routed queue. See queues and retries.

Expanded attributes

Laravel 13 expands attribute-first declarations across controllers, authorization, jobs, Eloquent, events, validation, testing, and resources. Examples include controller #[Middleware] and #[Authorize], and job #[Tries], #[Backoff], #[Timeout], and #[FailOnTimeout]. Attributes colocate static metadata and can improve discoverability; they can also hide policy when conventions are mixed. Choose one legible team convention, test precedence, and avoid confusing declarative configuration with the runtime guarantee itself.

Extending cache lifetime

Cache::touch($key, $ttl) extends an existing item’s TTL without fetching and writing its value through application code. It is useful for sliding-expiration policies, but repeated touch can keep stale or revoked state alive. Driver behavior, racing deletion, and the distinction between freshness and existence still matter. See cache guarantees and generic cache failure behavior.

Semantic and vector search

Laravel 13 supports vector columns and similarity-query methods, with PostgreSQL pgvector and MariaDB support described in the AI SDK documentation. A query such as whereVectorSimilarTo ranks by embedding similarity; it does not establish factual correctness or authorization. Record embedding model and dimensions, filter tenant/access scope before returning results, plan re-embedding migrations, evaluate relevance on representative queries, and understand index recall/latency trade-offs. The SDK can turn strings into embeddings and expose similarity search as an agent tool, adding provider cost and failure boundaries.

Adoption conversation

A strong upgrade answer starts with the official upgrade guide and dependency constraints, then inventories behavioral changes, runs the existing suite under production-like infrastructure, and canaries observability-sensitive paths. New syntax can wait until the version upgrade is stable. Adopt a feature when it simplifies an owned boundary and its failure modes are understood—not merely because it is new.