jdeniau/api-platform-filter-validator
Adds Symfony Validator constraint support to API Platform filters, so query parameters can be validated before they reach your data layer and invalid filter values return clean errors instead of failing deep in queries.
Architecture fit. The framing of this evaluation as a "Laravel/PHP package" is itself the first finding: this is not a Laravel package. jdeniau/api-platform-filter-validator targets API Platform, which is a Symfony-first framework for building hypermedia/Hydra APIs. It hooks into API Platform's filter pipeline (FilterInterface / query parameter resolution) to assert that incoming filter values are valid before they reach the data provider. On a standard Laravel stack there is no filter pipeline to hook into, so the integration surface is effectively zero. Even on API Platform's experimental Laravel bridge, the extension points and versioning assumptions differ enough that adoption would be exploratory engineering, not a Composer install. Decision implication: confirm the actual target stack before spending any further evaluation effort. If the team is on Symfony + API Platform, continue. If on Laravel, this package is out of scope and the underlying problem (validating query-string filter input) should be solved with a Laravel-native FormRequest or query-parameter validator instead.
Integration feasibility. Low. Zero stars, zero dependents, single maintainer, MIT, and an explicit self-description that it is a holding pattern awaiting api-platform/core PR #1723. That is a candid and useful disclosure, but it defines the package's lifecycle as "temporary shim," not "dependency." Any adoption plan must include a removal plan on day one. The integration itself is likely small — registering the validator against the filter collection — but small surface area does not mean low risk when the extension is reaching into framework internals that are not covered by a stability contract.
Technical risk. Three risks dominate, in order:
Key questions. (1) Is the target stack Laravel or Symfony/API Platform — and if Laravel, why is this package in scope at all? (2) What is the current status of PR #1723, and does the targeted API Platform version already cover this? (3) What exact failure are we preventing — unhandled 500s on malformed filter input, or semantic validation of values? (4) Which API Platform version will we pin, and does the package's constraint allow it? (5) Build-vs-fork-vs-adopt: is a ~100-line custom QueryParameterValidator cheaper to own than a zero-star shim we must later excise?
Stack fit. Gate everything on the stack question. Symfony + API Platform at a version the package supports: proceed to a time-boxed spike. Laravel: stop, and re-scope to a native request-validation approach. API Platform's Laravel bridge is not a supported target for this package.
Migration path. Treat this as a vendor-and-pin exercise, not a dependency. Require the package via a pinned commit hash rather than a range, and wrap all usage behind a single project-owned adapter (one service or one config block) so that removal or replacement is a localized change. Do not let filter-validation logic leak into controllers, providers, or tests outside that adapter.
Compatibility. Verify against a concrete version triple: PHP, api-platform/core, and Symfony. Run the package's own tests if any exist, then run the target application's API test suite with the package enabled to detect filter-resolution regressions. Check composer why-not for conflicts before committing.
Sequencing. (1) Confirm PR #1723 status and whether current upstream already solves the problem — this is a 30-minute check that can cancel the project. (2) One-day spike: apply the package to a representative resource with several filters, exercise valid, invalid, and edge-case inputs, and record the actual response codes. (3) Compare against a hand-rolled validator built on Symfony's Validator applied to the filter DTO. (4) Decide. (5) If adopted, ship with the removal ticket already filed against the upstream-fix milestone. (6) Establish an integration test that encodes the validation contract independently of the package, so removal is verified, not hoped for.
Maintenance. You own it, in practice. No security advisories will be issued, no CVE response, no compatibility patches. Budget it as internal code with a public origin, and assign an explicit owner. The real maintenance cost is not patch cadence — it is the removal work deferred to a future quarter, which tends to land during an unrelated upgrade crunch.
Support. None available. No maintainer SLA, no issue backlog to mine for known failure modes, no community forum. Every incident is a first-principles debugging exercise against framework internals.
Scaling. Negligible runtime cost — validation is O(1) per request against a small set of filter parameters. Scaling is not the concern; correctness under upstream version drift is.
Failure modes. Three to watch: (a) silent bypass — an upstream change causes the validator to stop being invoked, and invalid input flows through unchecked while tests still pass; (b) hard failure — an upstream change alters filter value shape and the validator throws on every request, producing a 100% error rate on filtered endpoints; (c) conflicting validation — the package's rules disagree with the schema-level constraints, returning 400s for values the rest of the system accepts.
Ramp-up. Low technical ramp-up (small, readable codebase), high organizational ramp-up: someone must own the upstream-watch, the removal ticket, and the contract test. The most likely operational outcome is that the package quietly rots after adoption because nobody is assigned the "when upstream fixes this, delete it" task — which is precisely the task the package's own description implies.
How can I help you explore Laravel packages today?