Upgrading Statamic 5 on Laravel 10 or 11 to Statamic 6

Statamic 6 requires Laravel 12 or newer and PHP 8.3 or newer, so it will not install on Laravel 10 or 11. Laravel also will not skip a major. On a Statamic 5 site that is still on Laravel 10 or 11, the sequence is the job.

We ran that sequence on two throwaway Statamic 5 test sites. This is the order that got through, and the spots where a homepage returning 200 was the wrong signal.

Laravel 10’s security support ended February 4, 2025, and Laravel 11’s ended March 12, 2026. Laravel 12’s security support runs to February 24, 2027. The Statamic 5 and PHP 8.2 dates are in Statamic 5 end of life and PHP 8.2 end of life.

The order

Do one hop, boot the site, run the tests you have, and only then start the next hop. Do not combine two Laravel majors in a single composer update.

1. Snapshot first. Tag git, and keep composer.lock in that tag. Back up content/, users/, .env, and the database if you use one. Record php -v on production. Code rollback is git checkout <tag> -- composer.json composer.lock and then composer install.

2. Stay on the Statamic 5 you already have while Laravel moves. The published support table still lists Statamic 5 as Laravel 10 through 12. A merged 5.x change, statamic/cms #14793, drops Laravel 10 and 11 from new 5.x releases, because Composer 2.10’s advisory checks refuse those trees. The December security commitment described there is for Statamic itself.

So composer update statamic/cms to the newest 5.x can fail on Laravel 10 or 11. Read the laravel/framework constraint on that 5.x release. If it no longer allows your Laravel major, leave Statamic pinned and hop Laravel first. Move to the latest Statamic 5 only once that release still accepts the Laravel version you are on. After Laravel 12, doing it before Statamic 6 lets you clear deprecations Statamic 5 already warns about.

3. Laravel 10 to Laravel 11, still on Statamic 5. Laravel 11 requires PHP 8.2 or newer and supports PHP 8.2 through 8.4. A site already on PHP 8.2 can make this hop without a new runtime. Laravel 10 only supports PHP 8.1 through 8.3, so do not put PHP 8.4 on the server before this hop. Boot the site and run the test suite before you touch Laravel 12.

This is the hop where laravel/sanctum at ^3.3 blocks the install. Laravel 11 does not support Sanctum 3. Set laravel/sanctum to ^4.0 or Composer cannot resolve laravel/framework at ^11.0. On the throwaway Laravel 10 site, that constraint stopped the install until it was bumped. Then run php artisan vendor:publish --tag=sanctum-migrations (Sanctum 4 no longer ships its migrations automatically) and update the authenticate_session, encrypt_cookies, and validate_csrf_token entries in config/sanctum.php to the class names in that guide.

Leave app/Http/Kernel.php in place. The Laravel 11 upgrade guide says not to migrate a Laravel 10 app onto the newer, smaller application structure as part of the version bump, because Laravel 11 still runs the Laravel 10 structure. On the throwaway test upgrades, the existing HTTP kernel kept working through the later hops.

4. Laravel 11 to Laravel 12, still on Statamic 5. Follow the Laravel 12 upgrade guide for the dependency bumps (laravel/framework to ^12.0, and PHPUnit or Pest if you use them). Laravel 12 supports PHP 8.2 through 8.5. PHP 8.4 is a supported runtime once Laravel 11 is in, so this is a sound time to move local, CI, staging, and production to 8.4. Keep a Statamic 5 site off PHP 8.5. Statamic 5’s table tops out at 8.4.

Laravel Shift is a fine way to open these pull requests. Statamic’s 5 to 6 guide recommends it for the Laravel part. Shift does one major per run, so use it for 10 to 11 and again for 11 to 12. It does not upgrade Statamic, and it will not notice a Statamic 5 release that has already dropped your Laravel version.

5. Then Statamic 6. Set statamic/cms to ^6.0 and run composer update statamic/cms --with-dependencies. If the site is now on Laravel 12 with no custom code, this is the part the official guide calls less than five minutes for most such sites. The items below still will not show up as a failed homepage.

6. Laravel 13 is optional, and it comes after Statamic 6. Statamic supports Laravel 13 from v6.5.0. The 5 to 6 guide recommends going through to Laravel 13 and PHP 8.5. Laravel 13 requires PHP 8.3 or newer. Do it as its own hop, after Statamic 6 is booting, using the Laravel 13 upgrade guide.

What a 200 homepage does not prove

Search. Statamic 6 removes 'searchables' => 'all' and does not rewrite the config, so you choose whether users are in the index. Use 'searchables' => 'content' (entries, terms, and assets, not users) or an explicit list such as collection:blog, taxonomy:categories, and assets:*. On a throwaway test upgrade, php please search:update threw while the value was still 'all'. The homepage still returned 200.

Multisite. The first homepage will not show these. The sites array on a global set now decides which sites that set is localized into, including origins, and Statamic may rewrite it during the upgrade. The guide says that change does not affect single-site installs. Moving variables out of a data: key is the single-site case. Multisite variables were already stored per site. addLocalization() and removeLocalization() on GlobalSet are removed. Save or delete that site’s variables instead ($globalSet->in('en')->save() and ->delete()). Site::setConfig() is removed. Call Site::setSites().

If config/app.php is not UTC and you have dated entries or date fields, Statamic 6 converts those values to UTC at runtime. The guide’s example is 10pm in New York becoming 3am UTC the next day. Confirm localize_dates_in_modifiers in config/statamic/system.php. On a static site the dates are already in the HTML. Walk every site.

Cloudflare Pages, if the site is static. The build-image docs mention PHP in the introduction. The version tables do not list PHP 8. v3, the current image, does not list PHP at all. v1, the only table that does, lists 5.6, 7.2, and 7.4, and v1 projects were moved to v3 on September 15, 2026. Statamic 6 needs PHP 8.3 or newer, so run php please ssg:generate in CI and deploy the HTML.

statamic/ssg 4.0 dropped Laravel 11 and PHP 8.2. Move that package when you move Statamic, not before.

Sources

What to do next

Start with the free Statamic 6 readiness checklist. It is the order of operations, with nothing to download and no email gate.

The Upgrade Kit for Statamic 6 is the paid runbook and scripts for the same path, including the Laravel hops, PHP, addons, and a static build.

If you want the work done for you, start with a Rescue Audit.

Segment Holdings is not affiliated with or endorsed by Statamic. This is a product for Statamic, not a Statamic product.