App Setup & Structure

app holds your classes, bootstrap boots the framework and keeps its caches, config holds settings arrays, database holds migrations, factories and seeders, public is the web root, resources holds views and raw assets, routes the route files, storage runtime files and logs.

composer run dev calls php artisan dev, which by default runs the PHP development server, a queue listener, Pail log tailing and the Vite dev server together. artisan serve alone only answers HTTP, so queued jobs and Vite assets are left without a process.

composer create-project laravel/laravel copies the bare skeleton and runs its Composer scripts (.env, app key, SQLite file, migrations). laravel new wraps that step and adds prompts, an optional starter kit, Pest by default, a front-end build and Boost.

public/index.php is the entry point: it checks for maintenance mode, loads Composer's autoloader, requires bootstrap/app.php to get the application, and calls handleRequest(Request::capture()). bootstrap/app.php builds and returns that application with Application::configure()->...->create().

vendor:publish copies files that service providers registered with publishes() into the app. --tag picks a named group of files, --provider picks one provider's files, and existing files are skipped unless --force is given.

Laravel releases one major version a year, around the first quarter. Each major gets bug fixes for 18 months and security fixes for 2 years; Laravel 13 (March 2026) is covered for security until March 17th, 2028.

Production runs with cached configuration, and once config is cached Laravel skips loading .env, so env() sees only real server environment variables. Map the key in a config file and read it with config() instead.

Since Laravel 11 the skeleton has no kernel or handler classes. Middleware and exception handling are configured in bootstrap/app.php, schedules and closure commands go in routes/console.php, command classes in app/Console/Commands, and providers in bootstrap/providers.php.

handleRequest() passes the request to the HTTP kernel, which bootstraps the app and runs global middleware into the router. The router runs route middleware and the controller, converts its return value into a response, and handleRequest() sends it, then terminates.

A package lists its providers and facade aliases under extra.laravel in its composer.json. package:discover reads every installed package's entry into bootstrap/cache/packages.php, and Laravel registers those providers at boot.

Move PHP to 8.3 first, since Laravel 10 through 13 all support it, then upgrade 10 to 11, 11 to 12 and 12 to 13, following each upgrade guide and getting tests green after every hop.

public/ holds only the front controller index.php and assets, so every request goes through Laravel. Serving the project root lets browsers request files like .env with credentials and APP_KEY, storage/logs/laravel.log, composer.json and vendor code directly.

app()->environment() returns the app.env config value, which config/app.php takes from APP_ENV (default 'production'). An APP_ENV set outside the file makes Laravel load .env.{APP_ENV} instead of .env when that file exists.

Laravel 13 loads the framework's own config files as a base and merges the app's files over them, so view settings exist without a local file. Run php artisan config:publish view to copy it into config/ for editing.

Turn it into a class under app/, for example app/Support/TimetableFormatter.php in the App\Support namespace; PSR-4 autoloading of App\ finds it with no registration. Global functions need Composer files autoloading, and config/, routes/, bootstrap/ and public/ are the wrong places.

Herd and Valet keep Nginx running in the background and resolve *.test names, so every app inside a parked directory is served at foldername.test with no command. php artisan serve starts PHP's single-process built-in server on 127.0.0.1:8000 only while it runs.

The Laravel 13 installer defaults to Pest, SQLite, Laravel Boost and npm. Override them with --phpunit, --database=mysql (or mariadb, pgsql, sqlsrv), --no-boost, and --pnpm, --bun, --yarn or --no-node.

LoadEnvironmentVariables, LoadConfiguration, HandleExceptions, RegisterFacades, RegisterProviders, BootProviders. So .env is read before config files, errors are handled before providers run, and every eager provider is registered before any provider boots.

List the package's Composer name under extra.laravel.dont-discover in the app's composer.json (or * to disable discovery entirely), rebuild the manifest with package:discover, and register the provider yourself where and when you want it.

loadRoutesFrom() requires the package's route file unless routes are cached; loadViewsFrom() registers a view namespace such as audit-trail::. Laravel checks resources/views/vendor/audit-trail first, so a file placed there overrides the package's view.

Laravel 11 gave new apps a much smaller skeleton: no app-level kernel classes, middleware and exceptions configured in bootstrap/app.php, one service provider, and opt-in config, API and broadcasting files. Upgraded apps may keep their Laravel 10 structure.

A minor release like 13.34 may add features and fix bugs but should never contain breaking changes; those wait for the next major. Named arguments are excluded from that promise, because Laravel may rename method parameters in any release.

env:encrypt writes an encrypted copy such as .env.production.encrypted that can be committed; env:decrypt recreates the plain file during deployment. The key must stay outside the repository, typically in LARAVEL_ENV_ENCRYPTION_KEY on the deploy host.

storage/framework/views is missing. The view config sets the compiled path to realpath(storage_path('framework/views')), which is false for a missing folder, so the Blade compiler throws. Recreate the storage and bootstrap/cache tree, writable by PHP.

Laravel 13 requires PHP 8.3, so composer install on the cloned app fails its platform check, and a fresh laravel new or create-project quietly resolves Laravel 12 instead. Install PHP 8.3+ with the required extensions, including pdo_sqlite, then rerun setup.

Only the returned object becomes the response, and outbound middleware or exception rendering can replace it. It can change until send(), with a RequestHandled listener as the last hook; terminable middleware and terminating() callbacks run after send(), too late.

After send(), the kernel's terminate() dispatches the Terminating event, calls terminate() on terminable middleware, runs app()->terminating() callbacks (including afterResponse jobs), then runs slow-request handlers. The work cannot change the response and still holds the worker process.

loadMigrationsFrom() runs the package's migrations straight from vendor/, so all three apps get new schema changes with each package update; publishing copies them into each app, which can then edit them but must re-publish to get later ones.

mergeConfigFrom() loads a package's default config under a key and lets the app's published copy override it. It merges only the first level, so a nested array in the app's copy replaces the package's whole.