Lts Laravel Package

Technical Evaluation

Architecture Fit

• Purpose Alignment: The package enforces LTS (Long-Term Support) versions of Symfony components, ensuring backward compatibility and stability. This aligns well with projects requiring predictable maintenance windows, security patches, and reduced technical debt—critical for enterprise-grade applications or long-running services.
• Laravel Compatibility: While Symfony and Laravel share core PHP components (e.g., HTTP, routing, dependency injection), Laravel’s ecosystem is opinionated and diverges in some areas (e.g., Blade templating, Eloquent ORM). The package’s strict version enforcement may conflict with Laravel’s default component versions unless explicitly configured.
• Isolation Risk: Laravel’s composer.json may already pin Symfony components to specific versions. Forcing LTS-only versions could break compatibility with Laravel’s bundled packages (e.g., symfony/console, symfony/http-foundation) if they’re not LTS-aligned.

Integration Feasibility

• Composer Constraints: The package works by overriding composer.json constraints to enforce LTS versions. Laravel projects already use Composer, so integration is low-effort but requires:
  • Manual conflict resolution for non-Symfony dependencies (e.g., laravel/framework may pull non-LTS Symfony components).
  • Testing to validate no breaking changes (e.g., deprecated Symfony APIs used indirectly).
• CI/CD Hooks: Can be integrated into pre-commit hooks or CI pipelines (e.g., GitHub Actions) to block non-LTS dependencies early.

Technical Risk

Key Questions

1. Why enforce LTS? Is this for security compliance, long-term stability, or vendor lock-in avoidance? Laravel’s release cycle may already mitigate some risks.
2. Scope of Enforcement: Should this apply to all Symfony components or only critical ones (e.g., symfony/http-client)?
3. Laravel Version Support: How does this interact with Laravel’s supported versions (e.g., Laravel 10 may require Symfony 6.4+)?
4. Custom Components: Does the project use Symfony components outside Laravel’s bundle (e.g., symfony/mailer)?
5. Performance Impact: Could LTS constraints limit access to newer features or optimizations in non-LTS Symfony versions?

Integration Approach

Stack Fit

• PHP/Laravel Ecosystem: The package is native to Composer, making it a zero-dependency addition. Works seamlessly with:
  • Laravel’s composer.json (though may require overrides).
  • Monorepos or multi-package projects using Symfony components.
• Non-Laravel Symfony Projects: Ideal for pure Symfony apps or projects mixing Symfony/Laravel where strict versioning is needed.
• Limitations:
  • Not a drop-in solution for Laravel; requires custom configuration.
  • No UI or runtime enforcement—purely a build-time constraint tool.

Migration Path

1. Assessment Phase:
   • Run composer why symfony/* to audit current Symfony dependencies.
   • Identify non-LTS components and their criticality.
2. Configuration:
   • Install the package:

     composer require --dev symfony/lts
     

   • Override composer.json to exclude Laravel’s bundled Symfony components:

     "replace": {
       "symfony/console": "6.4.*",  // Laravel 10's default
       "symfony/http-foundation": "6.4.*"
     }
     

   • Whitelist non-critical Symfony packages (if needed):

     "extra": {
       "symfony-lts": {
         "ignore": ["symfony/var-dumper"]
       }
     }
     

3. Validation:
   • Run composer validate and test the app.
   • Use composer why-not symfony/mailer:6.4 to check constraints.
4. CI/CD Integration:
   • Add to composer install or a pre-test script:

     # GitHub Actions example
     - run: composer require symfony/lts --dev
     - run: composer validate
     

Compatibility

• Laravel Versions:
  • Laravel 10 → Symfony 6.4 (LTS).
  • Laravel 9 → Symfony 6.2 (LTS).
  • Non-LTS Laravel branches (e.g., 11.x if not yet LTS) may conflict.
• Symfony Components:
  • Enforces LTS versions only (e.g., 5.4, 6.2, 7.0 when LTS).
  • Non-LTS Symfony packages (e.g., 6.3) will be blocked.
• Third-Party Packages:
  • Some packages (e.g., doctrine/orm) may depend on non-LTS Symfony components. Requires vendor patches or alternatives.

Sequencing

1. Pilot in Dev/Staging:
   • Test in a non-production environment first.
   • Monitor for deprecation warnings or missing features.
2. Phased Rollout:
   • Start with non-critical Symfony components.
   • Gradually enforce LTS for core dependencies.
3. Post-Migration:
   • Update documentation to reflect LTS constraints.
   • Plan for future Symfony LTS upgrades (e.g., 7.0 in 2025).

Operational Impact

Maintenance

• Pros:
  • Reduced security risks from unsupported Symfony versions.
  • Predictable upgrade paths (aligns with Symfony’s LTS schedule).
• Cons:
  • Manual intervention required for dependency conflicts.
  • Slower access to new features until Symfony releases LTS versions.
• Tooling:
  • Use composer outdated --direct to track LTS updates.
  • Set up Composer scripts to auto-check for LTS compliance.

Support

• Debugging:
  • Clear error messages from Composer if non-LTS packages are used.
  • Symfony’s LTS policy provides long-term support, reducing support burden.
• Vendor Coordination:
  • May need to escalate to package maintainers if they rely on non-LTS Symfony.
• Community:
  • Limited active maintenance (package is archived), but core logic is stable.

Scaling

• Performance: No runtime overhead; purely a build-time constraint.
• Team Adoption:
  • Developers must understand LTS implications (e.g., delayed features).
  • PMs need to align with Symfony’s release cycle.
• Multi-Repo Projects:
  • Works well if all repos enforce LTS consistently.
  • Challenges arise if some services use non-LTS Symfony.

Failure Modes

Ramp-Up

• Learning Curve:
  • Low for Composer users (familiar with composer.json constraints).
  • Moderate for Laravel teams (need to understand Symfony versioning).
• Training Needs:
  • Document why LTS is enforced and how to handle conflicts.
  • Train teams on composer why and composer why-not commands.
• Onboarding Time:
  • Initial setup: 1–2 hours (configuration + testing).
  • Long-term: Minimal (mostly passive enforcement).