Simple Api Doc Bundle Laravel Package

Technical Evaluation

Verdict up front: this is not a Laravel package, and it is effectively abandoned. kreta/simple-api-doc-bundle is a Symfony bundle that sits on top of NelmioApiDocBundle. Its last release was 2016-02-01, it has 0 stars and 0 dependents, and it carries a Score of 0 with an opportunity score of 24.56. Any Laravel integration story is a port, not an adoption. As a TPM I would treat this as a reject for production use, with a narrow optional use as a historical reference for API-doc wiring.

Architecture fit. The package assumes Symfony's bundle/kernel model, service container tagging, and the NelmioApiDocBundle annotation-driven extraction pipeline. Laravel shares Symfony components but not the bundle runtime; there is no AppKernel, no bundle registration, no nelmio_api_doc config tree to merge. The bundle's value is thin — it is a convenience wrapper, not a documentation engine — so most of its behavior would have to be reimplemented anyway. Architecture fit with a Laravel codebase is poor to none.

Integration feasibility. Realistically, there are three paths, none cheap:

Because the package is a wrapper, the "extractable value" is small: some annotations, config conventions, and a rendering layer — all of which are reproducible in a week or less using modern tooling. The effort-to-value ratio does not justify a port.

Technical risk. High and largely unmitigable:

• Abandonment. No commits since 2016; no security response path; no maintainer to escalate to.
• Dependency stranding. It pins an era of NelmioApiDocBundle (v2.x) and Symfony 2.x/3.0, which in turn constrains PHP to roughly 5.5–7.0. Modern Nelmio (v4/v5) and OpenAPI 3 are out of reach without a rewrite of the wrapper and the upstream.
• Security surface. An unmaintained bundle pulling in unmaintained transitive Symfony components is a supply-chain and CVE exposure we would inherit.
• Documentation drift. Even if it ran, its output schema (Swagger 2.0-era) would not match current OpenAPI 3 expectations in most API gateways and client generators.
• Zero community signal. 0 dependents means no field-tested usage, no issue triage, no forks to lean on.

Key questions for the team.

1. Is the actual requirement "generate OpenAPI/Swagger docs from Laravel controllers" — if so, why is a 2016 Symfony wrapper on the shortlist at all?
2. Is there existing Kreta tooling in the codebase that this was meant to align with? If not, the "simple-api-doc" naming is the only thread connecting it to us.
3. Are we constrained to Swagger 2.0 for a downstream consumer, or can we target OpenAPI 3?
4. Who owns the doc pipeline long-term, and would they accept an unmaintained dependency in the critical path?
5. What is the cost of the alternative (e.g., Scribe or Scramble) versus the cost of a bespoke port?

Integration Approach

Stack fit. None for Laravel. A Laravel-native replacement is the only sensible route. Recommended candidates, all actively maintained and PHP 8.x-compatible:

• knuckleswtf/scribe — annotation/attribute-driven, generates docs plus Postman/OpenAPI; strongest "batteries included" fit for Laravel.
• dedoc/scramble — zero-annotation, introspects routes/controllers/form requests; lowest ramp-up.
• darkaonline/l5-swagger + zircote/swagger-php — if strict OpenAPI 3 with Swagger UI is mandatory.
• nelmio/api-doc-bundle — only relevant if the host app is Symfony, in which case the original wrapper is still the wrong choice; use Nelmio directly.

Migration path. Treat this as replacement, not migration:

1. Inventory current doc artifacts (annotations, YAML, generated JSON) and downstream consumers (client SDKs, gateway imports, contract tests).
2. Pin the target schema — OpenAPI 3.0/3.1 — and confirm consumer support.
3. Select one Laravel-native generator via a short spike (1–2 days) against two representative controllers.
4. Port annotations/attributes controller-by-controller; validate generated spec against the previous artifact with a diff.
5. Retire any Kreta/Nelmio config once parity is confirmed.

Compatibility. If, despite the above, someone insists on evaluating the bundle: verify it against a Symfony 2.8/3.0 + PHP 5.6/7.0 sandbox only. It will not install on PHP 8.x, and Composer will fail on Symfony 6/7 constraints. There is no Laravel compatibility tier to speak of.

Sequencing. The decision gate is week 0: confirm the requirement and rule the bundle out. Then spike the replacement in week 1, port in weeks 2–3, and run a spec-parity check before cutting over. Do not sequence any work behind this package — it is not on the critical path and should not become one.

Operational Impact

Maintenance. Effectively zero upstream. There is no release cadence, no issue response, and no security patch channel. If adopted, maintenance cost is 100% internal: we would own the fork, the Symfony-version pins, and every CVE in the transitive tree. That is a permanent tax for a convenience wrapper.

Support. No vendor, no community, no dependents to consult. Internal engineers unfamiliar with Symfony 2-era bundle conventions will spend disproportionate time on what is, functionally, a small feature. Onboarding cost is high relative to the feature's value.

Scaling. Documentation generation is a build/CI-time concern, not a runtime scaling concern, so throughput is not the issue — schema scaling is. As the API grows, an unmaintained Swagger 2.0 emitter becomes a bottleneck: no OpenAPI 3 features (oneOf/anyOf, nullable semantics, proper security schemes), and divergence from what modern client generators and gateways expect. We would accumulate manual patches exactly when the API surface is growing fastest.

Failure modes.

• Silent dependency break — Composer resolution fails on a PHP/Symfony upgrade, blocking CI for the whole repo.
• Stale spec drift — docs generate but no longer reflect actual behavior; consumers build against a lie. Highest-severity failure because it is silent.
• CVE inheritance — an unmaintained transitive package is flagged by SCA tooling, forcing an urgent fork or removal.
• Bus factor — the one engineer who understood the bundle leaves; nobody can safely modify the doc pipeline.
• Renderer breakage — the bundled UI layer stops working against modern browsers/asset pipelines with no upstream fix.

Ramp-up. For a Laravel team, ramp-up on this bundle is negative — engineers must first learn Symfony bundle conventions and 2016-era Nelmio annotations before producing any value, and the output is still not what we want. By contrast, a Laravel-native replacement is a 1–2 day ramp-up for a mid-level engineer, with docs and active issue trackers.

Recommendation. Do not adopt. Keep it out of the dependency graph entirely. Run a one-week spike on a maintained Laravel-native generator against the OpenAPI 3 target, and record this package as evaluated-and-rejected with the abandonment date and framework mismatch as the rationale. The only defensible use is as a reading reference for how someone once wrapped Nelmio — and even that has near-zero value given how thin the wrapper is.