How to keep Laravel and its dependencies patched

Your application code is only a small part of what runs in production. A typical Laravel application pulls in well over a hundred Composer packages and often hundreds more JavaScript packages, plus PHP itself, the web server and the operating system. Any of them can have a security flaw discovered tomorrow.

Patching is not exciting, but it is one of the most effective security measures there is. This is the routine we use on our security patching plans, and you can run it yourself.

Know what you depend on

Start by looking at what is installed:

composer show --direct
composer outdated --direct
npm outdated

composer show --direct lists the packages you chose. Everything else is a dependency of those. composer outdated shows what has newer versions available. Look out for packages that have been abandoned or have not been updated in years, as they will not get security fixes either.

Check for known vulnerabilities

Composer and npm can both check your installed packages against public security advisories:

composer audit
npm audit --omit=dev

Run these now, and then make them part of your CI pipeline so a pull request fails if it introduces a known vulnerability. For extra protection, the roave/security-advisories package stops Composer installing versions with known issues in the first place.

Automate the routine updates

GitHub's Dependabot, or a similar tool, can open pull requests when new versions of your dependencies are released. Configure it to group minor and patch updates together, so you get one tidy pull request a week rather than dozens.

Automated pull requests are only safe if you have tests. Each update should run through your test suite in CI before anyone merges it.

A monthly routine

Once a month:

1. Update minor and patch versions of Laravel and your packages with composer update, and the same for front-end packages.
2. Run the full test suite, static analysis and a build of your front-end assets.
3. Deploy to staging and check the critical paths: login, checkout, the main features your customers use.
4. Deploy to production at a quiet time, with a way to roll back.
5. Update the operating system and PHP minor version on your servers.
6. Write down what changed, so you can trace any issue back to a specific update.

For most well-tested applications, this takes an hour or two a month.

When an urgent advisory lands

Sometimes a critical vulnerability is announced in a package you use, and waiting for the monthly cycle is not an option. Have a faster route ready:

• Subscribe to security advisories for Laravel, PHP and your key packages, or use a monitoring service that alerts you.
• Decide in advance who can approve an emergency deploy.
• Apply the single patched package with composer update vendor/package, rather than updating everything at once.
• Test the affected area, deploy and then return to normal.

On our patching plans, critical patches are applied within one working day.

Major versions need a plan

Minor and patch updates should be routine. Major versions, of Laravel itself or of big packages, usually include breaking changes and need more care. Laravel releases a new major version every year, each with bug fixes for 18 months and security fixes for two years. Plan your upgrade well before your current version's security support ends.

Our Laravel 13 upgrade guide covers what is involved, and our Laravel upgrade planner shows each step from your current version.

Do not forget the servers

PHP versions and operating systems have their own support windows. Check your PHP version against the dates on php.net, and make sure your servers apply operating system security updates automatically or on a schedule.

If this sounds like a lot

It is less work than it looks once the routine is in place, but it does need to happen every month, without fail. If you would rather not think about it, our security patching plans start at £149 per month per application and include monthly updates, advisory monitoring, emergency patches and a short report.