Phpstan Symfony Laravel Package

Technical Evaluation

Architecture Fit

• Limited Modern Compatibility: The package is deprecated and last updated in 2018, making it incompatible with modern Symfony (6.x/7.x) and PHPStan (1.x) ecosystems. The core functionality (Symfony-specific static analysis) is now natively supported or superseded by newer tools (e.g., PHPStan’s built-in Symfony extension or phpstan/extension-installer).
• Redundancy Risk: Symfony’s integration with PHPStan has evolved significantly since 2018. This package may introduce technical debt by forcing legacy patterns or conflicting with updated Symfony/PHPStan configurations.
• Use Case Alignment: Only relevant for legacy Symfony 2/3/4 projects still using PHPStan 0.x. For new projects, this package offers zero value.

Integration Feasibility

• High Friction: Requires manual dependency resolution (e.g., pinning PHPStan 0.12.x, Symfony 3.x/4.x) and potential conflicts with modern tooling (e.g., Composer autoloader, Symfony’s container).
• Configuration Overhead: May necessitate custom PHPStan configuration to bypass deprecated features or workarounds for missing Symfony 5+/6+ support.
• Testing Complexity: Integration tests would need to validate backward compatibility with obsolete Symfony versions, adding unnecessary complexity.

Technical Risk

• Security Vulnerabilities: Unmaintained packages risk unpatched CVEs (e.g., Composer dependencies, Symfony core issues).
• Breakage Risk: Symfony’s internal APIs have changed drastically since 2018; this package may fail silently or throw cryptic errors in modern environments.
• Dependency Hell: Conflicts with newer PHPStan extensions (e.g., phpstan/doctrine) or Symfony bundles (e.g., symfony/flex).

Key Questions

1. Why Legacy? Is this package being considered for a Symfony 2/3/4 project with PHPStan 0.x? If not, what’s the justification?
2. Alternatives? Has phpstan/extension-installer or PHPStan’s native Symfony support been evaluated? Are there gaps they don’t cover?
3. Maintenance Burden: Who will handle security patches or compatibility fixes if issues arise?
4. Migration Path: What’s the plan to sunset this dependency in favor of modern tools?
5. Testing Strategy: How will integration be validated against Symfony 5+/6+ or PHPStan 1.x?

Integration Approach

Stack Fit

• Hard Blockers:
  • Symfony 5+: Incompatible (Symfony 4.x may work but with high risk).
  • PHPStan 1.x: This package targets PHPStan 0.x; no migration path exists.
  • Modern PHP (8.0+): Likely to fail due to deprecated syntax/dependencies.
• Partial Fit:
  • Symfony 3/4 + PHPStan 0.12.x: Possible but discouraged. Requires:
    • Locking phpstan/phpstan:^0.12 in composer.json.
    • Disabling Symfony’s built-in PHPStan integration to avoid conflicts.
    • Custom phpstan.neon configuration to exclude modern Symfony features.

Migration Path

1. Assess Project Constraints:
   • If stuck on Symfony 3/4, evaluate forking the package (high effort) or switching to PHPStan 1.x with manual Symfony rules.
   • For Symfony 5+, replace with:
     • phpstan/extension-installer + phpstan/symfony (native extension).
     • Custom PHPStan rules for unsupported features.
2. Phased Rollout:
   • Step 1: Run the package in a staging environment with strict error logging.
   • Step 2: Gradually replace Symfony-specific rules with modern alternatives.
   • Step 3: Deprecate the package in favor of native tools (e.g., via phpstan.upgrade commands).
3. Fallback Plan:
   • If integration fails, disable the package and implement a custom PHPStan baseline for Symfony analysis.

Compatibility

• Symfony:
  • ✅ 3.x/4.x: Possible but unstable (test thoroughly).
  • ❌ 5.x/6.x: No support (Symfony’s internal APIs changed).
• PHPStan:
  • ✅ 0.12.x: Targeted version.
  • ❌ 1.x: Incompatible (breaking changes in rule system).
• PHP Versions:
  • ✅ 5.6–7.2: Likely to work (original target range).
  • ❌ 7.3+: Risk of failures (deprecated functions, strict typing).

Sequencing

1. Pre-Integration:
   • Audit the codebase for Symfony 5+/6+ features (e.g., attributes, new components) that this package won’t support.
   • Document known limitations (e.g., no support for Symfony’s new dependency injection compiler).
2. Integration:
   • Add to composer.json with strict version pinning:

     "lookyman/phpstan-symfony": "dev-maintainer-fork",  // If forking
     "phpstan/phpstan": "^0.12"
     

   • Configure PHPStan to ignore modern Symfony features:

     includes:
       - vendor/lookyman/phpstan-symfony/extension.neon
     excludeChecks:
       - Symfony\.*  # Custom exclusions for unsupported features
     

3. Post-Integration:
   • Run PHPStan in CI/CD with --level=max to catch integration gaps.
   • Plan a 12–18 month sunset for the package.

Operational Impact

Maintenance

• High Effort:
  • No upstream support: All fixes require manual patching or forking.
  • Dependency updates: Must manually test against new PHPStan 0.x patches (if any).
  • Symfony major versions: Breaking changes will require custom workarounds.
• Recommended Actions:
  • Assign a dedicated maintainer to triage issues.
  • Set up automated alerts for PHPStan/Symfony deprecations affecting this package.

Support

• Limited Resources:
  • No community support: Original repo is archived; issues will go unanswered.
  • Debugging complexity: Errors may require reverse-engineering legacy code.
• Mitigation:
  • Maintain a local fork with issue-tracking for custom fixes.
  • Document workarounds for common failures (e.g., "Rule X fails on Symfony 4.4+ due to Y").

Scaling

• Performance Impact:
  • PHPStan 0.x is slower than modern versions; this package adds minimal overhead but doesn’t benefit from optimizations.
• Team Scaling:
  • Onboarding risk: New developers may struggle with legacy tooling.
  • Knowledge silos: Only those familiar with Symfony 3/4 and PHPStan 0.x can maintain it.
• Recommendation:
  • Deprecate in favor of modern tools to reduce technical debt.

Failure Modes

Ramp-Up

• Learning Curve:
  • Moderate for legacy teams: Developers familiar with Symfony 3/4 and PHPStan 0.x can integrate quickly.
  • High for modern teams: Requires context-switching to understand deprecated patterns.
• Onboarding Steps:
  1. Setup: Install PHPStan 0.12.x and the package in a sandbox.
  2. Configuration: Adapt phpstan.neon to exclude modern Symfony features.
  3. Testing: Run against a legacy Symfony 3/4 codebase to validate.
  4. Documentation: Create a cheat sheet for common rules and limitations.
• Training Needs:
  • Legacy Symfony internals: Focus on pre-5.0 DI, routing, and event systems.
  • PHPStan 0.x quirks: Rule syntax, configuration structure.