Why it cannot wait
Every PHP version stops receiving security fixes on a published date, and hosts remove it soon after. From then on the upgrade is no longer a project you schedule, it is downtime you react to. A version past end of life is also a public list of known vulnerabilities.
How the upgrade is done
A static scan for removed functions and changed behaviour, then the application run on the new version in staging with errors logged at the strictest level. Dependencies move in the order their constraints allow, and Laravel goes one major version at a time, because skipped steps are where upgrades go wrong.
What you get back
The application on a supported version, dependencies updated, a written list of what changed and why, and the deprecation warnings cleared so the next upgrade is smaller. If a package is abandoned with no successor, you hear about it at the scan, not at the end.