Statamic 6 readiness checklist

https://segment.holdings/statamic-6-readiness-checklist

Print this checklist

1. Back up, and tag git

   • Commit the work you mean to keep, and push it. Do this before you change constraints.
   • Create a git tag at the current release, and make sure the committed composer.lock is in that tag. Keep a copy of the lockfile outside the working tree as well. Rollback is git checkout <tag> -- composer.json composer.lock and then composer install.
   • Back up content/, users/, .env, and the database if you use the Eloquent driver or database users.
   • On production, record php -v and php -m. You want the version and the extensions, not just what your laptop has.

2. Check the PHP, Laravel, and Statamic versions

   Statamic 6 needs PHP 8.3 or newer and Laravel 12 or newer. It supports PHP 8.3 through 8.5, and Laravel 12 and 13. Statamic recommends Laravel 13 and PHP 8.5. 5 to 6 upgrade guide.

   • PHP 8.2 security support ends December 31, 2026. Active support ended December 31, 2024. PHP 8.3 security support ends December 31, 2027. PHP 8.4 security support runs through December 2028, and PHP 8.5 through December 2029. PHP supported versions.
   • Laravel 10 security support ended in February 2025. Laravel 11 security support ended March 12, 2026. Laravel 12 security support ends February 24, 2027. Laravel support table.
   • Statamic 5 security fixes run through December 2026. Bug fixes ended in March 2026. The published policy says the dates can change. Statamic 7 is listed for Q1 2027 as PHP 8.4 through 8.6 and Laravel 13 through 14, which is why 8.4 or 8.5 is a better target than stopping on 8.3. Statamic release and support policy.
   • If you are already on Laravel 12 and PHP 8.3 or newer, and you have no custom code, follow the official guide and stop unless something in it applies to you. The guide says that path is often under five minutes.
   • If you are staying on this page: update to the latest Statamic 5 first, with composer update statamic/cms while you are still on ^5. Clear deprecations Statamic 5 already warns about before the major bump.
   • Move the PHP runtime to 8.4 or 8.5 locally, in CI, on staging, and on production before the Laravel hops. Statamic 5 already runs on PHP 8.4, so this step can ship on its own. Install the extensions you use. intl, gd or imagick for Glide, exif, and bcmath are the usual ones. Set config.platform.php to the production PHP version so the lockfile matches production. On PHP 8.4, implicitly nullable parameters (function foo(Bar $bar = null)) are deprecated. That is the one that shows up most often in application code and older addons. PHP 8.4 deprecations.

3. Laravel hops, one at a time

   Do not combine two Laravel majors in one composer update. Finish one hop, boot the site, then start the next.

   • From Laravel 10: go 10 to 11. Boot the site and run the test suite before you touch Laravel 12.
   • On the Laravel 11 hop, set laravel/sanctum to ^4.0. A Laravel 10 site that took this path needed that constraint on the way to Laravel 12 and Statamic 6.
   • From Laravel 11: go to 12. Laravel 12 upgrade guide. Statamic 6 is the bump after Laravel 12, not before it.
   • Laravel 13 is optional, and it comes after Statamic 6. Statamic supports Laravel 13 from v6.5.0. Statamic supports Laravel 13. Laravel 13 upgrade guide.
   • Laravel Shift will open a pull request for one Laravel version at a time, if you want that part automated. If Composer refuses an old Laravel, read statamic/cms #14793. Composer 2.10’s advisory checks block Laravel 10 and 11, which is why Statamic is dropping them from 5.x. composer why-not statamic/cms 6.0 tells you which package is in the way.

4. Check addon compatibility

   • List packages of type statamic-addon, and anything else that requires statamic/cms, from composer.lock.
   • For each one, find a release whose statamic/cms constraint allows ^6 before you bump Statamic. A major bump means you read that addon’s upgrade notes. The marketplace shows supported Statamic versions. Statamic Marketplace.
   • If an addon has no v6 release, decide replace, fork, or drop before the bump. Removing it temporarily is a fair way to get Composer to resolve, then add them back one at a time.

5. Official 5 to 6 items that bite

   The full list is the official guide. These are the ones to search for on a real site. A homepage that returns 200 does not mean they are done.

   • Timezone and dates. If config/app.php is not UTC and you have dated collections or date fields, dates can shift. Check localize_dates_in_modifiers. On a static site the dates are baked into the HTML. There is no runtime left to fix them later.
   • Globals. Statamic 6 moves the data: key in content/globals/*.yaml. If you listen for GlobalSetSaved, or you call addLocalization or removeLocalization, read that part of the guide before you commit the migrated content. Commit the code change and the content migration as two commits, so content can be reverted on its own.
   • 'searchables' => 'all' throws on search:update even while the homepage returns 200. Change it before you trust a green homepage check. Custom searchables and custom search drivers belong in the same pass.
   • Multisite. Per-site globals, localizations, and the sites config do not follow a single-site pass. Walk every site. A trap that only shows on the second site will not show on the homepage of the first.
   • Vue 2 addons. Custom Vue components, @vitejs/plugin-vue2, or Laravel Mix in an addon or in resources/js/cp.js need the Vue 2 to 3 guide. Statamic 6’s control panel is Vue 3.

6. Build the static site in CI

   Cloudflare Pages’ build image lacks PHP 8, so php please ssg:generate cannot run on Cloudflare’s builder. Cloudflare Pages build image. Build in GitHub Actions, or another CI image that has PHP, and deploy the HTML. A write-up of that pattern. This site is built that way.

   • Move statamic/ssg to ^4. The 4.0 release dropped Laravel 11 and PHP 8.2. The 4.2.x line needs statamic/cms ^6.11. SSG release notes.
   • Point the workflow at the same PHP you will run in production, 8.4 or 8.5. Generate the site, confirm the command exits 0, and compare the page count with the previous build.
   • Diff a few dated pages and a few generated URLs against the previous output. Timezone shifts show up in the HTML. urlencode changes can change generated URLs when the value contains a slash.

7. Test, then keep a rollback

   • Smoke test. Important URLs return 200. The control panel login page loads. A form submits. Search returns a term you already know. A Glide image URL returns 200. For a static site, ssg:generate exits 0.
   • Walk the control panel. Edit and save an entry. Save a global. Check a date field. The control panel date picker uses the browser’s timezone, which is not always the app timezone. Tell editors before they edit dated entries.
   • Keep the git tag and the old composer.lock until you trust the release. Database user migrations from this upgrade have down() methods. Roll those back before you revert the code. Static hosts: keep the previous deployment. Cloudflare Pages keeps each deployment, so you can roll back in the dashboard. Write down the commit SHA.

Segment Holdings is not affiliated with or endorsed by Statamic. This is a product for Statamic, not a Statamic product.