Neo4J Ogm Bundle Laravel Package

Technical Evaluation

Architecture fit

• Wrong ecosystem for the stated target. Despite being listed as a Laravel/PHP package, kwattro/neo4j-ogm-bundle is a Symfony bundle (Bundle suffix, AppKernel registration, DI Extension class, services.xml). It has no ServiceProvider, no config/*.php publishable config, and no Laravel facade. Nothing in it is designed to be booted by Laravel's container.
• The bundle is a thin wrapper: its real value is the underlying OGM library, which provides annotation-driven entity mapping, a persistence manager/unit-of-work, identity map, and proxy generation over Neo4j's HTTP Cypher endpoint. That programming model is closer to Doctrine than to Eloquent — adoptable as a bolt-on persistence layer, but it will not interoperate with Eloquent relations, Model events, or Laravel's query builder.
• Graph access is over the legacy HTTP REST API, not Bolt. That is architecturally dated and constrains both driver behaviour and Neo4j server version.

Integration feasibility — low

• Composer resolution is the first blocker: a Symfony 2-era bundle will pin symfony/symfony or symfony/dependency-injection at ~2.x, which conflicts directly with Laravel 9/10/11 (Symfony 6/7 components). Expect composer require to fail outright, or to force a dependency downgrade that breaks the framework.
• PHP version support is pre-PHP 8. Even if the code installs, unmodified code paths (dynamic properties, each(), non-nullable signatures) are likely to emit deprecations or fatal at runtime on 8.1+.
• A workable path exists only if you ignore the bundle and consume the OGM library directly, manually constructing the EntityManager in a Laravel service provider or a small adapter class.

Technical risk — high

• Abandonment. 19 stars, 0 dependents, score 0.345. No dependent packages means no downstream consumers bug-reporting, no ecosystem pressure to patch, and effectively no maintainer signal. This is a "you fork it, you own it" acquisition.
• Protocol/version drift. The OGM targets Neo4j 2.x/3.x-era REST semantics. Neo4j 4.x and 5.x moved to Bolt-first and removed or changed several legacy HTTP endpoints and transaction handling. Validation against a current Neo4j is mandatory before any design commitment.
• Security exposure. Unmaintained vendor code on the network path to the database, with no CVE triage and no patch stream. This is a compliance finding in most regulated environments.
• Hidden cost. The genuinely useful artefact (the OGM abstraction) is exactly the part with no support, and it is also the part that would need PHP 8 and Bolt work.

Key questions

1. Is the driver requirement actually graph traversal, or would a recursive CTE / closure table in MySQL/Postgres satisfy the queries? Most "we need Neo4j" asks collapse under this question and it removes the entire risk surface.
2. Which Neo4j server version is on the roadmap, and has anyone executed a single Cypher statement from this library against that version?
3. Has the underlying OGM been evaluated against maintained successors (e.g. graphaware/neo4j-php-ogm, or laudis/neo4j-php-client with hand-written mapping)?
4. Who owns a fork? Without a named engineer and a budget line for upstream-less maintenance, this is a latent outage.
5. What is the licensing of the bundle and the OGM (MIT vs. GPL-family)? Unmaintained repos often carry ambiguous licence files.

Verdict: Do not adopt as a Laravel dependency. Score 0.345 is consistent with the evidence: an ecosystem-mismatched, abandoned, pre-PHP-8 wrapper. Treat it as a reference implementation for OGM design ideas only.

Integration Approach

Stack fit

• Current stack (Laravel on PHP 8.x, Symfony 6/7 transitive components) is incompatible with the bundle's dependency graph. There is no supported install path.
• If graph persistence is confirmed as a requirement, the fit-correct choice is laudis/neo4j-php-client (Bolt, PHP 8, actively maintained) wrapped in a small internal repository/mapper layer. That preserves the OGM ergonomics (entities in, entities out, unit-of-work at the edges) without inheriting the Symfony coupling or the REST-era protocol.
• If OGM semantics (annotation mapping, identity map, cascade) are specifically required, graphaware/neo4j-php-ogm is the lineage-successor of this bundle's underlying library and is the only defensible starting point — still subject to its own PHP 8 and Neo4j 5 vetting.

Migration path (if pursued at all)

1. Timeboxed spike (1–2 days, isolated). New throwaway Laravel app or bare PHP script in a container. Install the OGM library (not the bundle) directly, stand up Neo4j in Docker at the target version, map one entity, run create/read/update/delete.
2. Record the failure points. Composer conflicts, PHP 8 fatals, endpoint 404s, transaction semantics. This artefact is the go/no-go document.
3. Decide fork vs. replace. If the library works but the bundle does not, write a Neo4jServiceProvider that bootstraps the OGM EntityManager and binds it as a singleton — roughly 50–100 lines. That is the only part of the bundle you actually need.
4. Isolate behind an interface. Define an internal GraphRepository contract in the domain layer; the OGM implementation is one adapter. This makes a later swap to laudis/neo4j-php-client a contained change rather than a rewrite.
5. Do not let OGM entities leak into the domain. Map to/from your existing Laravel models or DTOs explicitly; do not attempt to make one class both an Eloquent model and an OGM entity.

Compatibility

• Verify PHP constraint, PSR-0 vs. PSR-4 autoloading (Symfony 2-era bundles were often PSR-0), and whether the code relies on symfony/property-access / doctrine/annotations at versions Laravel already pins.
• Confirm Neo4j server compatibility explicitly — HTTP endpoint availability by version, auth scheme, and whether multi-database (USE/database-scoped sessions) is required. This library predates multi-database and will not express it.

Sequencing Spike → go/no-go → interface design → adapter implementation → feature work. Never sequence this as "install the bundle, then discover". The composer install is the cheapest possible test and it should happen on day one, before any estimation.

Operational Impact

Maintenance

• Zero upstream. Every defect, dependency bump, PHP upgrade, and Neo4j upgrade is yours. Budget realistically: an unmaintained persistence library on a core data path is a standing 5–15% of one engineer's capacity, plus an unplanned spike at each PHP and Neo4j major.
• Forking is the likely end state (vendor the code, strip the Symfony glue, publish internally). Once forked, you have inherited a codebase that your team did not design and whose test suite is unknown — establish coverage before trusting it.

Support

• No community, no issue triage, no security advisories, no StackOverflow corpus. 19 stars and 0 dependents means you are the only consumer; the bus factor for your own fork is your team's headcount.
• Vendor-risk review will typically flag this as an unsupported component in a tier-1 dependency; expect it to need a documented, time-bound exception.

Scaling

• HTTP-per-query with no Bolt connection pooling imposes a much lower throughput ceiling than a native driver. Expect per-query latency dominated by connection setup under concurrency.
• The OGM's identity map and proxy objects grow within a persistent process. Under Octane or long-lived queue workers this is a memory leak by design — the EntityManager must be reset (or the worker killed) per job or per request. Plan for a clear() in a terminating callback, and load-test to confirm.
• No built-in retry, backoff, or circuit breaking toward Neo4j. A Neo4j blip propagates as raw exceptions into user-facing requests unless you wrap the adapter.

Failure modes

• Partial writes: legacy HTTP transaction semantics may not give you atomicity you assume, particularly across multiple flush() calls. Any multi-step write needs explicit verification.
• Silent mapping failure: annotation/proxy misconfiguration tends to surface as empty results or null fields rather than errors — the worst class of failure to debug in production.
• Version drift: a Neo4j upgrade can break the library with no upstream patch available, and you will discover it in staging or, worse, in production.
• Missing Symfony warmup: the bundle normally compiles metadata at container build. In Laravel there is no equivalent, so proxy/metadata generation happens at runtime — first-request latency spikes and cold-start failures after deploy.
• Composer lock churn: an unmaintained transitive tree becomes the reason you cannot take a security patch elsewhere.

Ramp-up

• The OGM model (unit-of-work, identity map, proxies, annotations) is a genuine conceptual jump for a team fluent in Eloquent's Active Record. Expect 1–2 weeks before a mid-level engineer is productive and safe, and that learning is largely non-transferable.
• Documentation is thin and reflects Symfony 2 conventions; internal documentation will be written from scratch.
• Onboarding cost is concentrated and recurring: every new hire hits the same wall, because there is no public material to point at.

Bottom line for the roadmap: the expected value of this package is negative unless a graph store is a hard, validated requirement. Spend the spike on confirming the requirement first; if graph is required, adopt a maintained Bolt client behind an internal interface and treat this bundle as design reference only.