Laminas Serializer Laravel Package

Product Decisions This Supports

• Data Interoperability: Standardizes serialization/deserialization of PHP objects to/from JSON, XML, YAML, or PHP's native serialize() — relevant for APIs, caching, and storage layers.
• API/Backend Modernization: Supports build vs. buy decisions by replacing hand-rolled serialization with a maintained, adapter-based solution (e.g., migrating legacy serialize() payloads to structured JSON).
• Dependency Footprint Reduction (new in 4.0): v4 drops the laminas-json dependency in favor of PHP's native JSON functions — fewer transitive dependencies to audit, patch, and license-review. A small but real win for supply-chain/security reviews.
• Microservices & Event-Driven Architectures: Standardizes payload serialization across services (e.g., domain objects → JSON for Kafka/RabbitMQ).
• Legacy System Integration: Bridges older PHP systems (var_export(), unserialize()) with modern formats for gradual modernization.
• Upgrade Planning (4.0.0 is a major, backwards-incompatible release): This is a decision point, not a drop-in patch. It resolved 6 PRs across 5 contributors and ships a dedicated migration guide. Treat it as a planned work item with a scoped regression pass, not a routine composer update.
• Roadmap Priorities:
  • Phase 0 (new): Assess v4 upgrade impact — confirm whether we use the removed PhpSerialize deprecated option, whether we rely on the removed Module class for Laminas MVC wiring, and whether any code type-checks against changed serializer signatures.
  • Phase 1: Replace ad-hoc serialization in APIs (e.g., REST controllers).
  • Phase 2: Standardize internal data contracts (DTOs → JSON for caching).
  • Phase 3: Extend to event sourcing or CQRS pipelines.

When to Consider This Package

Adopt When:

• Your team uses Laminas (or Laravel with manual wiring) and needs consistent, adapter-driven serialization (JSON/XML/YAML/PHP serialize).
• You're migrating from serialize() to safer, structured formats (avoids object-injection risks).
• You want a small dependency tree — v4 removes laminas-json entirely in favor of native JSON functions.
• You need typed, PHP 8.4+-friendly serializer internals (v4 tightened type safety across serializers, catching misuse earlier).
• You're building modular systems where serialization should be decoupled behind an adapter interface.
• You are starting fresh or already on 4.x — adopting v4 now avoids a future migration.

Look Elsewhere If:

• Need binary formats (Protocol Buffers, MessagePack) → jms/serializer or msgpack/msgpack.
• Not using Laminas/Laravel → symfony/serializer or spatie/array-to-object for simpler cases.
• Require high-performance serialization → igbinary or custom C extensions.
• Your stack is non-PHP → use language-native tooling.
• You depend on the Laminas MVC Module class or the deprecated PhpSerialize option and cannot absorb a BC break this quarter — stay on 3.3.x until the migration is scheduled. v4 removes the unused Module class, so any reliance on module-level autoloading/config must be replaced with explicit configuration or container wiring.

Upgrade cautions for 4.0.0 (BC breaks to check before adopting):

• PhpSerialize deprecated option removed — audit for its use; behavior changes for anyone still passing it.
• Module class removed — affects Laminas MVC users who relied on implicit module registration; DI wiring now must be explicit (Laravel container bindings unaffected in principle, but verify).
• Signature/type-safety changes — run static analysis and the test suite; subclassed adapters or custom serializers are the likely breakage points.
• Migration guide is provided (PR #101) — use it as the checklist; it also documents updated options and usage, so re-read the docs rather than assuming 3.x semantics.

How to Pitch It (Stakeholders)

For Executives:

"This package standardizes how data moves across our PHP systems — APIs, caches, internal services. Instead of scattered json_encode() calls or risky serialize() usage, we get a maintained, adapter-based tool that reduces tech debt, supports PHP 8.4+, and lets us swap formats without rewriting call sites.

Version 4.0 has just shipped as a major release, which means two things: (1) it's a maintenance win — it drops the laminas-json dependency and uses PHP's native JSON, shrinking our dependency surface; and (2) it's a planned upgrade, not a routine patch — there are documented breaking changes (a removed deprecated option, a removed module class, stricter typing) plus an official migration guide.

Ask: a scoped engineering slot to run the migration guide and regression suite. Cost: low (open source, BSD-3, no license spend). Risk: low-to-moderate — the breaks are documented and bounded, and we can stay on 3.3.x if the slot slips. ROI: fewer dependencies to audit, fewer serialization bugs, and a supported upgrade path instead of drifting onto an unmaintained version."

For Engineers:

"laminas-serializer 4.0.0 gives us:

1. Adapters for JSON, XML, YAML, and PHP serialize() behind a consistent interface.
2. Tighter type safety across serializers (v4, PR #88) — catches errors earlier.
3. Fewer dependencies: laminas-json removed, native JSON functions used instead (PR #80).
4. A real migration guide (PR #101) plus refreshed docs for v4 (PR #95).

BC breaks to handle before upgrading:

• Deprecated PhpSerialize option removed (PR #94) — grep for it.
• Unused Module class removed (PR #88) — if you relied on Laminas MVC module wiring, configure services explicitly now.
• Serializer signature/type changes — run static analysis and the full suite; custom adapter subclasses are the most likely casualties.

Migration path:

• Read the v4 migration guide first; don't infer 3.x behavior.
• Audit for the removed option and Module usage.
• Pin to 3.3.x on a branch, upgrade, diff serialized output for representative payloads.
• Start on JSON/XML adapters, drop serialize() where possible, and configure defaults via the factory.

Trade-offs:

• No binary formats (MessagePack/Protobuf) → use jms/serializer if needed.
• Adapter configuration still has a learning curve.
• Being on a new major means fewer production references than 3.x — acceptable, but worth noting in the risk register.

Example:

// Before: scattered logic
$json = json_encode($user);

// After: centralized, testable, swappable
$serializer = new \Laminas\Serializer\Adapter\JsonAdapter();
$json = $serializer->serialize($user);
```*