composer require <vendor>/<package>:^2.0.5. This is the first release in the 2.x line that declares Laravel 13 support, so the patch constraint matters: ^2.0 will resolve fine, but pinning ^2.0.5 guarantees you don't get an older 2.0.x build whose illuminate/* constraints reject Laravel 13 during composer update.composer.json (confirm the illuminate/support / laravel/framework range actually widened and the PHP floor matches what Laravel 13 requires), the README's upgrade/requirements table, then the registered service provider and any publishable config. Laravel 13 support landing in a patch release signals an additive compatibility change rather than a re-architecture, so the public API you already know should be intact.php artisan tinker or a single feature test. That confirms auto-discovery, config merging, and container bindings all resolve before you touch production code.config/<package>.php plus env vars. Keep app-specific overrides in the config file rather than subclassing package classes — that survives patch upgrades cleanly.^2.0.5 in composer.json and let Renovate/Dependabot open PRs for 2.0.x patches automatically; treat 2.1.0 as a manual review because feature releases are where behaviour can drift.laravel/framework:^12.0 and ^13.0) with the matching PHP versions. A two-entry matrix catches the next compatibility break before it reaches a release.setUp(). Prefer asserting on the package's observable side effects (queued jobs, HTTP calls, written records) over asserting on internals.composer why-not is your fastest diagnostic when the update won't resolve: composer why-not <vendor>/<package> 2.0.5 tells you which other dependency is still pinning an older illuminate/* range.composer update.How can I help you explore Laravel packages today?