Is it safe to paste my composer.json?

Yes. The manifest lists the packages your app depends on and their version constraints; it contains no credentials, no application code and no data. We never ask for repository access.

Do I need the composer.lock too?

No, but it makes the report sharper. The lock file records the exact installed versions, so we can say which packages are behind and which have been abandoned rather than estimating from constraints.

What happens after I submit?

You see the version-against-EOL summary instantly. The Packagist pass runs in the background and the full one-page report lands in your inbox within a few minutes, usually seconds.

Can my developer run this check themselves?

Yes. The same version and package checks are open source as jigomit/laravel-upgrade-audit on GitHub (github.com/jigomit/laravel-upgrade-audit), MIT licensed. It runs as an artisan command or a standalone script, and can fail a CI build when the app slips too far behind.

Free, takes two minutes

Free Laravel audit

composer.json in, one-page report out. PHP and Laravel against their end-of-life dates, abandoned packages named, and the fixed price of the upgrade.

No credentials No source code Instant summary, report by email

Run the audit

Paste the file or drop it on the box. The summary appears here; the full report goes to your inbox.

What you get

PHP and Laravel against their end-of-life dates
Which support window each is in, and the exact day it closes.
Abandoned and outdated packages, named
Every package checked against Packagist, with the suggested replacement where the maintainer left one.
How many majors stand between you and current
Laravel 13 and PHP 8.5 are current today; the distance decides the size of the job.
The fixed price for your tier
Upgrade Sprint, Full Upgrade or a care plan — one price attached, no hourly estimate.

The calendar that forces this

From laravel.com and php.net; we keep it current.

10 Aug 2027
Laravel 13 bug fixes end
Security fixes continue to 24 February 2028.
24 Feb 2027
Laravel 12 security fixes end
Bug fixes already ended on 13 August 2026.
31 Dec 2026
PHP 8.2 security support ends
Every Laravel 10 and 11 app still on PHP 8.2 loses runtime security fixes on this date.
12 Mar 2026
Laravel 11 security fixes ended
Every Laravel 11 app is now unpatched.
31 Dec 2025
PHP 8.1 security support ended
PHP 8.0 and 8.1 still run roughly a quarter of PHP 8 sites.

Then, if you want it fixed

Upgrade Sprint$2,500
Full Upgrade$4,500–$6,000
Care planfrom $500/month

Read what the upgrade covers →

Questions people ask before pasting

Is it safe to paste my composer.json?: Yes. The manifest lists the packages your app depends on and their version constraints; it contains no credentials, no application code and no data. We never ask for repository access.
Do I need the composer.lock too?: No, but it makes the report sharper. The lock file records the exact installed versions, so we can say which packages are behind and which have been abandoned rather than estimating from constraints.
What happens after I submit?: You see the version-against-EOL summary instantly. The Packagist pass runs in the background and the full one-page report lands in your inbox within a few minutes, usually seconds.
Can my developer run this check themselves?: Yes. The same version and package checks are open source as jigomit/laravel-upgrade-audit on GitHub (github.com/jigomit/laravel-upgrade-audit), MIT licensed. It runs as an artisan command or a standalone script, and can fail a CI build when the app slips too far behind.