softcreatr/jsonpath
A fast, eval-free JSONPath implementation for PHP 8.5+. Query arrays, objects, and ArrayAccess/traversables with unions, slices, wildcards, filters, regex, and deep equality. Includes tokenized parsing and internal caching.
Architecture fit: Still strong, and 2.2.0 makes the fit more deliberate. The opt-in JSONPath::RFC9535 mode separates "standards-compliant querying" from "legacy behavior," which maps cleanly onto Laravel's layered architecture: legacy mode for existing service/controller code, RFC mode for new middleware and validation layers where strictness matters. findPaths() returning normalized RFC result paths is the most architecturally interesting addition for a TPM—it enables provenance, audit logging, and mapping matched nodes back to source documents, which is otherwise hand-rolled in most Laravel JSON pipelines. Eager type validation and content-independent rejection of invalid queries mean expressions can be validated at config/boot time or inside a Laravel validation rule without needing a representative document, which is a better fit for form requests than the previous parse-then-evaluate model.
Integration feasibility: High and improved. Composer installation is unchanged, no framework hooks required, and mode isolation means adoption is per-call-site rather than all-or-nothing. The package can now be wrapped behind a JsonPathService that pins an explicit mode, making the dependency swappable and the semantics explicit. The compliance suite (715 pinned cases checking values and normalized paths together) gives us a credible reference implementation to test our wrapper against—previously we would have had to write that harness ourselves.
Technical risk: Materially reduced on the two biggest unknowns from the last assessment. Test coverage is no longer an open question: 100% CI-enforced coverage, a pinned external compliance suite, retained compatibility tests, and added regression coverage for mode isolation and nested absolute queries. The "behavioral break on upgrade" risk is largely retired because RFC semantics are opt-in and existing calls retain previous behavior. Residual risks: (1) license remains NOASSERTION—still the only risk that can block a release outright; (2) low adoption (~164 stars) means bus-factor exposure persists despite the engineering investment; (3) the future-dated release timestamp from 2.1.0 is still unexplained and should be verified against the registry, not the notes; (4) a dual-mode API is a long-term liability—two semantics to document, test, and eventually deprecate; (5) no performance data for the RFC mode, where eager validation adds per-parse cost; (6) PHP/Laravel version support still unconfirmed in the notes.
Key questions:
composer.json? Eager type validation may require newer syntax than 7.4.RFC9535 mode for the same expression? "Existing calls retain previous behavior" implies divergence—we need a documented diff to know which call sites should migrate.findPaths() normalized paths stable and ordered deterministically for duplicate matches? Downstream audit/logging consumers will depend on it.Stack fit: Ideal for Laravel API projects doing dynamic JSON querying, and now defensible for untrusted input: RFC mode's content-independent rejection of invalid queries plus I-Regexp limits make it usable inside middleware and form requests without bespoke sanitization. findPaths() fits audit trails, webhook routing tables, and diffing payloads across versions.
Migration path: Unchanged for existing code—nothing forces a move. New code should adopt RFC mode explicitly rather than inheriting the default:
JsonPathService that requires an explicit mode argument (no implicit default) so semantics are visible at every call site.^2.2, cache parsed/validated expressions keyed by mode + expression string.findPaths() where normalized output paths are needed (logging, provenance, response shaping).
Compatibility: Nominal semver-minor with explicit backward compatibility for existing calls—lower risk than 2.1.0's type-checker tightening. The real compatibility question is no longer "will the upgrade break us" but "which mode are we on," and that is a documentation and code-review problem, not a runtime one. PHP/Laravel floor still needs verification from composer.json.
Sequencing:^2.2 with no behavior change; add the explicit-mode wrapper; confirm legacy paths still pass.findPaths() for provenance where useful.whereJsonContains/whereJsonLength prove insufficient.Maintenance: Improved and now credible. CI-enforced 100% coverage, a pinned external compliance suite, PHP CS Fixer as sole style tool, and retained compatibility tests describe a maintained project with real guardrails—this is the single largest change from the prior assessment. Counterweight remains: small contributor base, so assume bus-factor risk and keep the option to vendor or fork. New maintenance line item: tracking RFC 9535 errata and the package's legacy-vs-RFC divergence.
Support: Still no commercial support. Escalation is upstream issues only. Mitigation unchanged: encapsulate behind our own facade with the mode pinned, so we can swap to json-path/json-path (more stars, older Goessner draft) if the project stalls or licensing blocks us—accepting a semantics change if we do.
Scaling: Parse plus eager validation is now an explicit up-front cost in RFC mode, predictable but not free—cache compiled expressions at boot or in a keyed cache, never per request on hot paths. I-Regexp with PCRE resource limits bounds adversarial CPU, which is a scaling win, but defaults must be reviewed so legitimate large-payload matches aren't silently truncated. findPaths() on high-cardinality documents (many duplicate matches) is a new output-volume consideration for logging pipelines.
Failure modes:
jsonpath intuition transfers—RFC mode's filter, slice, and union semantics plus eager type validation differ from the Goessner subset most people know. Plan a short internal guide covering when to use each mode, the function extensions, the rejection behavior, and the PCRE-limit failure mode. The compliance suite is an excellent teaching artifact; the fail-fast validator shortens the debug loop. Remaining ramp cost is standards literacy and mode discipline, not tooling.How can I help you explore Laravel packages today?