Product Decisions This Supports

Build vs. Buy — still "buy", now with stronger patch-coverage evidence. v5.4.54 is flagged as a [SECURITY] release and backports three hardening fixes to the 5.4 LTS line. That means the same protections are available on both the current v8.1 line and the LTS branch that many of our older Laravel 8/9 services still sit on. A custom shell_exec/proc_open wrapper we own would have to be re-patched per branch; Symfony patches once, for all of them. This materially strengthens the maintenance-cost argument used to justify adoption.
Environment-variable capability — corrected scope (important). Fix #65739 now ignores invalid env var names and non-scalar env values. The "pass nested arrays as env vars" behaviour assumed in the previous assessment is not supported and must not be promised to stakeholders or written into roadmap items. Structured payloads must be serialized (JSON/base64) into a scalar env var or passed as CLI arguments. Net effect: a security gain (malformed input can no longer reach a subprocess environment) and a scope reduction (array env vars are out).
Security & compliance posture. Fix #65738 stops CGI/FastCGI request-context variables leaking into subprocesses — request headers, auth context and similar data can no longer bleed into a spawned Docker/Kubernetes/Ansible call. That is an auditable control we can cite in SOC 2 / ISO 27001 evidence and a straightforward data-minimisation argument for GDPR reviews. Combined with env validation, this is a "we removed a class of injection/leak risk without writing code" story.
Reliability in stripped-PATH environments. Fix #65784 resolves the cmd.exe fallback via absolute path on Windows, which unblocks agents and services started with a minimal PATH (systemd units, containers, hardened CI runners). Relevant only if we commit to Windows self-hosted runners or Windows-scheduled tasks — otherwise a low-priority win.
Roadmap alignment / zero migration cost. No breaking changes, no deprecations. v8.1.x (PHP 8.1+) remains the target for new work; 5.4 LTS remains viable for legacy services because it is demonstrably still receiving security backports. This lets us defer risky platform upgrades on legacy apps without accepting an unpatched security posture.

When to Consider This Package

Adopt symfony/process when:

Your Laravel app executes external commands (Docker, Terraform, Ansible, ffmpeg, linters) and you want setEnv(), timeouts, and streamed stdout/stderr instead of shell_exec string-building.
You are on a legacy branch (PHP 7.2.5–8.0, Laravel 8/9) and had assumed 5.4 LTS was stale — v5.4.54 shows active security maintenance, so adoption on LTS is justified.
The process runs in a multi-tenant, containerized, or shared-host context where leaking request-context variables into a child process is a compliance problem.
You run on Windows CI/agents with a stripped PATH, where a broken cmd.exe lookup currently causes intermittent failures.
You want validation-by-default: bad env names/values are dropped rather than silently propagated.

Avoid or look elsewhere if:

You need to pass structured/nested data through environment variables. Non-scalar values are now ignored (not an error, not coerced). Serialize the payload or pass it as an argument/stdin instead — if the design requires array env vars, this package will fail silently and you need a different approach.
Your app has no subprocess needs, or you need low-level control (signal handling, PTY, real-time process supervision) — go to pcntl/proc_open directly.
You are pinned to a branch older than 5.4 — the fixes are backported to 5.4 LTS, not further; that requires a branch upgrade, not a package bump.
You hit Windows environment-size limits (~32KB) and cannot refactor the payload.
You already delegate process execution to a dedicated orchestrator (e.g. Symfony Messenger workers or a queue-based job runner) and get nothing from these primitives.

How to Pitch It (Stakeholders)

For Executives

"Symfony Process standardises how our Laravel services execute external commands and just shipped a security release that closes two real risks: request data (headers, auth context) can no longer leak into subprocess environments, and malformed environment variables are now rejected instead of passed through. Crucially, those fixes were backported to the LTS branch, so our older apps get the same protection without a platform upgrade. It stays a drop-in replacement for our custom shell scripts, under MIT licence, with no migration work for this release. The one scope correction: we should not promise array/nested environment variables — that capability doesn't exist, so anything on the roadmap that assumed it needs re-scoping to a serialized payload."

Metrics to track: subprocess failures in CI/CD per month; number of custom scripts/wrappers retired; security findings attributable to subprocess invocation; count of services on a still-patched branch.

For Engineering Leaders

"This release is a patch-only security update — no API changes, no deprecations, no migration. Three things matter:

#65738 stops CGI/FastCGI request-context vars leaking into child processes — closes an information-disclosure path in containerized/shared environments.
#65739 ignores invalid env var names and non-scalar values, killing a class of malformed-input bugs. Corollary: do not design around array env vars — serialize to a scalar or pass as an argument.
#65784 resolves cmd.exe by absolute path on Windows, fixing intermittent failures on minimal-PATH agents.

Because these landed on 5.4 LTS as well as the main line, we can keep legacy services on their current branch and still be patched. Next steps: confirm which of our services sit below 5.4 (they do not get these fixes); audit existing setEnv() calls for non-scalar values that were silently working and are now dropped; keep the pilot on non-critical CLI tools and roll out by branch."

For Developers

"A low-drama security patch — but one behaviour change to know about: non-scalar env values and invalid env names are now ignored. If you were passing arrays through setEnv(), that silently stops working. Serialize instead:

// Structured data must be serialized — non-scalar env values are ignored
$process = new Process([
    'docker', 'build',
    '--build-arg', 'MANIFEST=' . base64_encode(json_encode($manifest)),
    '.',
]);
$process->setEnv(['BUILD_ID' => $buildId, 'CI' => 'true']); // scalars only
$process->setTimeout(600);
$process->run();

Also in this release: subprocesses no longer inherit CGI/FastCGI request-context variables (good for container/shared-host work), and the Windows cmd.exe fallback uses an absolute path (fixes minimal-PATH agents). Audit action: grep for setEnv( and fromShellCommandline( and check every value is a scalar — arrays/objects are now dropped without an exception.

Process Laravel Package