This application runs on Laravel 9.52 and PHP 8.0, which no longer receive security patches. The oldest component has been unsupported for approximately 2.7 years. Vulnerabilities disclosed since then remain unpatched, and will stay unpatched.
Support timeline
Bug fixesSecurity onlyUnsupported
Current state
Laravel
9.52
END OF LIFE unsupported since 6 Feb 2024 (2 years 5 months ago)
PHP
8.0
END OF LIFE unsupported since 26 Nov 2023 (2 years 7 months ago)
Dependencies
8 direct
9 including transitive
Required work
Abandoned — action required 1
barryvdh/laravel-cors
remove — CORS is in the framework since Laravel 9.2Delete the package, then use Illuminate\Http\Middleware\HandleCors. config/cors.php stays as is.
Version bump available 4
laravel/sanctum
bump to v4.3.3
laravel/tinker
bump to v3.0.2
yajra/laravel-oci8
bump to v13.10.1
spatie/laravel-ignitiondev
bump to 2.12.0
Effort
Framework majors
5.5 days
PHP runtime upgrade
3 days
Dependency work
0.66 days
Testing & deployment
3.21 days
Total
12.4 days
Developer-days for one engineer familiar with the stack. Testing and deployment are included at 35% of the preceding work. Any runtime upgrade requires server access and should be scheduled separately.
Recommended sequence
Confirm the hosting environment can run PHP 8.3. On managed or shared hosting this is decided by the provider, not by the codebase, and it gates everything else.
Decide what happens to the packages with no compatible release. Each needs a replacement, a fork, or a decision to drop the feature.
Apply the version bumps as one batch against a full test run, rather than package by package.
Move one major version at a time, with the test suite green before each step. Skipping intermediate versions makes failures much harder to attribute.