indragunawan/api-rate-limit-bundle
A PHP package for adding configurable rate limiting to APIs. Define request limits, track usage per endpoint, and protect your application from abuse with simple throttling and clear rate-limit responses. Suitable for REST APIs that need lightweight, customizable request control.
Architecture fit. Unchanged and still the headline issue: this is a Symfony bundle for API Platform resources, not a Laravel package. No ServiceProvider, no auto-discovery, no config publishing, no Laravel HTTP kernel hooks. Its rate-limit metadata lives in API Platform resource definitions and Symfony DI/compiler passes, none of which execute in a Laravel app. Fit for Laravel remains effectively zero; fit is confined to Symfony + API Platform.
What v0.5.0 changes. The only new datapoint is that the package is not abandoned: a 0.5.0 minor release exists, superseding v0.4.1. The release artifact supplied is a changelog link with no body, so the substantive content is unverified. This matters because a pre-1.0 minor bump (0.4.1 → 0.5.0) is permitted to carry breaking changes under semver, and after a multi-year dormancy the most probable contents are a compatibility refresh (Symfony 6/7, PHP 8.2/8.3, API Platform 3) or a maintenance/CI bump — but that is an inference, not a finding.
Claims in the prior assessment now requiring correction. "Last release 2021-04-27," "no release in 4+ years," and "no upstream" are no longer accurate as stated. The dormancy risk is reduced from defunct to low-cadence/sporadic. Everything else — single maintainer, zero dependents, MIT/forkable, security-relevant code path — is unchanged and not contradicted by a version bump.
Integration feasibility. Still not "install and configure" on Laravel; adopting the behavior means re-implementing it as middleware over Illuminate\Cache\RateLimiter, at which point the package is an algorithm reference, not a dependency. On Symfony, the blocking question is now narrower and answerable: does v0.5.0 resolve against API Platform 3.x metadata/attributes? Before the release that was near-certainly no; now it is genuinely unknown and cheap to test.
Technical risk. Remains High, but the risk character has shifted from "decaying, unpatchable" to "unverified, sporadically maintained." A single release from a single maintainer does not establish a maintenance cadence, and a 0.x bump with no published changelog body is itself a governance signal — you cannot assess upgrade impact from the artifact provided. Rate limiting sits in the abuse-protection path, so an untriageable diff there is still a security-posture decision.
Key questions.
v0.4.1...v0.5.0 compare diff — dependency constraints, API Platform 3 attributes, Symfony 6/7 support, or CI/lint only?Stack fit. On Laravel, still do not integrate. Use the native limiter: RateLimiter::for('api', fn (Request $r) => Limit::perMinute(60)->by($r->user()?->id ?: $r->ip())) in AppServiceProvider, applied via throttle:api. Per-resource semantics map to route middleware groups, not framework-level resource metadata. On Symfony, the first-party symfony/rate-limiter with a kernel.request listener remains the preferred default; v0.5.0 makes this bundle a candidate rather than a non-starter, but only if the diff shows AP 3 support.
Migration path. Unchanged in shape: bundle → first-party Symfony RateLimiter with a custom limiter per API Platform operation; to Laravel → native RateLimiter plus a small middleware for X-RateLimit-* / Retry-After headers, which neither option provides out of the box. If the goal is purely volumetric abuse protection, edge termination still removes the application-layer dependency entirely.
Compatibility. Downgrade from "treat as incompatible" to "unverified — timebox a spike." Read the compare diff first (30 minutes), then attempt a resolve against PHP 8.2/8.3, Symfony 6/7, and API Platform 3 in a 1–2 day spike. Success criterion: the metadata extension points register and a per-resource limit is enforced under AP 3. Abandon on fork requirement.
Sequencing.
v0.4.1...v0.5.0 diff and the composer.json constraints. This is now the gating step and it is cheap — do it before any other decision.Maintenance. Moved from "no upstream, must fork" to "sporadic upstream — pin and hedge." A v0.5.0 release does not constitute a support commitment: pin the tag, add your own CI, and retain the ability to fork (MIT makes that cheap). The decision is no longer binary between adopt-and-own versus avoid; it is "you are still the de facto maintainer of your pin, but you now have a moving target to rebase against."
Support. Unchanged: community-only, concentrated in one author, zero dependents — no downstream consumers exercising upgrades, no internal precedent to learn from, no commercial backstop. The release slightly improves the odds of an issue being seen; it does not create an SLA.
Scaling. Unchanged and independent of this release: limiter state must live in a shared store (Redis). In-memory or file cache silently breaks correctness across pods. Budget the per-request cache round-trip and watch hot keys — sliding-window logic is roughly O(1) but not free at high RPS.
Failure modes. Unchanged: Redis outage forces a documented fail-open (abuse exposure) vs. fail-closed (outage amplification) decision; client IP resolution behind proxies and X-Forwarded-For spoofing; clock skew across nodes with fixed windows; thundering herd at window boundaries; unbounded key cardinality causing memory pressure. Add one new failure mode from this release: unassessable upgrade risk — a 0.x minor bump with no published changelog body means an upgrade cannot be scoped without reading the diff, so treat any future bump as potentially breaking until proven otherwise.
Ramp-up. Unchanged: low for the Laravel-native path (throttle middleware is well understood); moderate for the Symfony bundle if the team is not already on API Platform; high if forking, since a new owner inherits unfamiliar internals in a security-relevant path. The v0.5.0 diff review is itself the cheapest possible ramp-up activity and should be assigned to whoever would own the pin.
Assessment. v0.5.0 is a positive signal, not a re-evaluation trigger — insufficient to move the recommendation on its own. The prior 2.16 score and zero dependents still describe the ground truth, and the release artifact supplied is a changelog pointer with no content, which prevents any meaningful capability or breaking-change analysis. Hold the current stance pending the compare diff. Update the factual record now (the package is not dormant; the "no upstream" framing is retired) and re-open the assessment only if the diff shows Symfony 6/7 + API Platform 3 support — that, and only that, would justify a genuine re-score. Absent it, continue using this repository as a reference implementation for per-resource limiting semantics, not as a dependency.
How can I help you explore Laravel packages today?