Laravel 13's ten-minute upgrade hinges on what your tests still call VerifyCsrfToken

Call `withoutMiddleware([VerifyCsrfToken::class])` in a Laravel 13 test and the class you named is a deprecated alias, kept around so nothing explodes on day one ^[11]. The exclusion may not apply the way you assumed, because the alias points elsewhere, according to a dev.to walkthrough of the upgrade ^[13]. The post says test suites that call it expecting to disable the protection are where this really bites ^[13]. The middleware configuration API now exposes `preventRequestForgery(...)` ^[12]. The check before you upgrade is one command: `grep -rn "VerifyCsrfToken\|ValidateCsrfToken" app/ tests/ routes/ bootstrap/` ^[14].

The second high-impact default is in the cache configuration, which now ships `serializable_classes => false` as hardening against deserialization gadget chain attacks ^[15]. The published post breaks off partway through that section, so the remediation is missing.

Laravel's own docs put the job at ten minutes and say most applications can upgrade "without changing much application code" ^[3]. That figure describes someone else's application. It transfers if nothing in `app/`, `tests/` or `routes/` references the old CSRF class names ^[11], nothing you put in the cache is a serialized PHP object ^[15], and you are already on PHP 8.3 or newer ^[8]. Ten minutes is an estimate for the code.

The dependency work is wider than the framework constraint. The post's `composer.json` moves `laravel/tinker` to `^3.0`, PHPUnit to `^12.0`, Pest to `^4.0` for Pest users and `laravel/boost` to `^2.0` ^[16]. Tinker and the PHPUnit major are the two the author says people forget ^[17].

Support is now uniform across every major: 18 months of bug fixes, two years of security patches, and no LTS tier ^[7]. Subtract one from the other and the security-only tail on any Laravel major is six months ^[21]. For 12 that tail runs 195 days, and roughly nineteen flagged breaking changes sit on the far side of it ^[19][20].