Engineering / ENG-1200
Upgrade identity-service from Laravel 12 to 13
Description
Laravel 13 comes out in March. Laravel 12 gets bug fixes until August and security fixes until February 2027, so nothing is on fire, but the next security questionnaire will ask, and the SAML library's next release needs 13. Move in April, with PHP 8.4 (see ENG-1314).
Scope
composer.json: laravel/framework ^13, and the packages that pin 12 (the SAML library, the queue monitor).- Re-publish config files and diff them by hand against ours. Don't take new defaults blindly.
- Queue payloads: jobs serialised by 12 must still run after the deploy (drain the queue first if not).
- Full suite, plus the SAML tests against the local test IdP in
tools/.
Acceptance criteria
- identity-service runs on Laravel 13 in all three regions.
- Password and SAML sign-in work for a depot at each kind of client (Entra ID, password only).
- No job fails in the 24 h after the deploy.
Linked issues
- relates to ENG-1314 PHP 8.2 → 8.4 on identity-service hosts and CI Done
- relates to ENG-1323 After Laravel 13: SAML sign-ins refused with 'Destination mismatch' Done
- causes ENG-1323 After Laravel 13: SAML sign-ins refused with 'Destination mismatch' Done
Comments (5)
Marek Nowak · 7 Apr 2026, 12:32 UTC
Branch is green. Two real changes: the SAML library needed its next 4.x release, and our RequestExpired listener used a removed contract. Config diff written up in the merge request.
Lukas Brandt · 7 Apr 2026, 13:10 UTC
Deploy before Vossberg's Okta work starts? Don't want both at once.
Marek Nowak · 8 Apr 2026, 07:12 UTC
Yes: next Tuesday, me on call.
Marek Nowak · 14 Apr 2026, 14:20 UTC
Merged at 11:00; deployed US 13:00, UK 14:00, EU 15:00. Queue drained first. Nothing failed overnight on staging. One trap found after: ENG-1323.
Taking it. Once 13 is out and the SAML library has a release for it, so April.