Slim Validation Laravel Package

Product Decisions This Supports

• Build vs. buy for the validation layer. The package owns the full validation surface — rule definitions, an asserter contract, typed validated values, and failure collections. Adopting it means we don't hand-roll validated-value objects or error aggregation, and we inherit a contract that third parties can extend. This release reinforces that the abstraction is maintained, not frozen.
• Platform/compatibility roadmap. Symfony 8 support in v5.1.0 moves the dependency floor forward. If our Symfony upgrade is on the roadmap, this package is no longer the blocker to schedule around — it can be upgraded independently of our own work.
• Framework reach beyond Laravel. The fix for route arguments never being read from PSR-7 requests is the load-bearing one here. It means the same validation layer can serve Laravel HTTP handlers, raw PSR-7 middleware, queued jobs, and console entry points without a parallel implementation. That directly supports any decision to reuse validators outside the framework's request lifecycle instead of re-implementing rules per entry point.
• Error-response stability for public APIs. $collection[] = $value now appends instead of throwing on ValidationFailureCollection and ValidatedValueCollection. If we build custom error aggregators or merge failures across nested validations, this removes a silent implementation constraint. Relevant to any decision to expose a documented error envelope to API consumers.
• Static analysis investment. Added array shapes and value types in the interface PHPDoc is a dependency-quality signal. It supports a decision to raise PHPStan/Psalm strictness on our integration code, since the package's interfaces now carry machine-readable shapes rather than bare array.
• Dependency-policy tuning. Two changes in a minor release are behaviorally breaking (see below). This is evidence for tightening our policy on minor-version pinning and changelog review for packages in the request path.

When to Consider This Package

Adopt when:

• We want declarative rules plus typed validated values and a structured failure collection, rather than raw arrays returned from Validator::validate().
• We need validators that accept input from more than one source — Laravel requests and PSR-7 requests — without duplicating rule sets.
• We want an AsserterInterface extension point, so domain-specific assertions live behind a stable contract instead of ad-hoc helper functions.
• We're on a PHP/Symfony combination that includes Symfony 8, or we plan to be.

Caveats to plan for on upgrade to v5.1.0:

• Exception type change. An invalid rules option now throws the package's own InvalidPropertyOptionsException rather than Symfony's InvalidOptionsException. Any catch block, error handler, or test asserting on the old type needs updating. This is the highest-risk item in the release for us.
• AsserterInterface::assert() signature. The discarded third argument is no longer passed. Custom asserter implementations that declared that parameter as required will need a signature change. First-party usage is unaffected.
• A minor version carried breaking behavior. Treat 5.1.0 as needing a deliberate upgrade, not an unattended patch bump.

Look elsewhere when:

• All validation happens inside Laravel FormRequest/Validator and nothing needs validated-value objects or cross-entry-point reuse — the framework already covers this at zero dependency cost.
• We need heavy localization/i18n of validation messaging as a first-class feature.
• Adding a transitive dependency on Symfony components is itself a problem (e.g. a minimal-service deployment constraint).
• We require strict SemVer guarantees from the dependency tree in the request path.

How to Pitch It (Stakeholders)

For executives: This is a maintenance release for a mature library, not a capability launch. It widens platform support — we can now move to Symfony 8 without waiting on this dependency — and fixes two genuine bugs, one of which was silently preventing validators from reading route arguments from PSR-7 requests. That bug fix is the one with commercial relevance: it lets us reuse a single validation layer across our HTTP surfaces instead of maintaining parallel rule sets. Scope is roughly one upgrade ticket plus test review. No migration project, no new infrastructure, no vendor conversation.

For engineering: Low-drama upgrade with two things to grep for. First, swap any catches of Symfony's InvalidOptionsException to the new InvalidPropertyOptionsException. Second, audit custom AsserterInterface implementations — assert() no longer receives the third argument, so required third parameters must be dropped. Everything else is additive: Symfony 8 constraint, collection append semantics fixed, PHPDoc array shapes added, and a corrected call signature in Validator. Recommend running the full suite plus a static-analysis pass, since the new PHPDoc types may surface pre-existing shape mismatches in our integration code — that's a benefit, but it will show up as new CI noise if we don't anticipate it.

Standing recommendation: note in the dependency register that 5.1.0 contains behaviorally breaking changes despite being a minor bump. We should be reviewing changelogs for this package rather than relying on version numbers.