Validator Laravel Package

Technical Evaluation

Architecture fit. yiisoft/validator is a framework-agnostic Yii3 validation library, not a Laravel package. It ships no Laravel service provider, no facade, no Blade/error-bag integration, and no DB-aware rules (unique, exists). Architecturally it fits underneath Laravel rather than inside it: it is a good candidate only where you deliberately want a validation layer that is not coupled to Illuminate\Validation — domain commands/DTOs, a shared namespace consumed by both Yii and Laravel services, or a hexagonal/ports-and-adapters boundary. For ordinary HTTP request/form validation it duplicates a capability Laravel already owns with better ergonomics.

Integration feasibility. Composer-installable and PSR-friendly, so a POC is cheap (hours, not weeks). Real work sits in three adapters: (1) a translator bridge implementing Yiisoft\Translator\TranslatorInterface over Laravel's Translator; (2) a result mapper from the library's Result/error tree into a Laravel MessageBag so @error, Inertia, and API error envelopes keep working; (3) a container binding so rule objects and #[Validate] attribute metadata resolve through Laravel's container. All three are small but are our code to own forever.

Technical risk. Moderate. 166 stars and a single-vendor maintainership (Yii core team) means bus factor and roadmap are tied to Yii3 adoption. Version pinning and a vendored-fork exit path are mandatory. The larger risk is organizational: two validation grammars in one codebase invites drift, and attribute-based rules on DTOs are invisible to developers accustomed to $request->validate() — silent-bypass risk when a DTO is persisted without being validated. Error-message and i18n parity will not be 1:1 out of the box.

Key questions.

• Do we have a bounded context where Laravel-coupled validation is genuinely the wrong tool?
• Is there an existing Yii service or shared package forcing a common validator?
• Who owns the translator/result adapters after the champion moves on?
• What are the packagist download counts, open-issue latency, and PHP/Laravel version bounds versus our supported matrix?
• Can we accept "no commercial support, BSD-3-Clause, community SLA of best effort"?

Verdict. Approve as a tactical, bounded dependency; reject as a replacement for Illuminate\Validation. Composite score (35.1) and opportunity score (21.2) are consistent with "pilot with a defined sunset," not platform commitment.

Integration Approach

Stack fit. Target Laravel 10–12 / PHP 8.2+. Confirm the library's PHP floor and transitive Yii dependencies before committing; the package must not drag in PSR-7/PSR-15 stacks it does not need. It coexists cleanly with Eloquent and the container as long as nothing expects Laravel rule objects.

Scope discipline. Draw the line explicitly: Illuminate\Validation continues to own all HTTP ingress validation, form requests, authorization-coupled rules, and DB-aware checks. yiisoft/validator is confined to domain/application-layer invariants — value objects, command DTOs, imported payloads — behind a single first-party interface (DomainValidator::validate(object): ValidationOutcome) so the library never appears in feature code.

Migration path.

1. One-week spike: proof-of-concept DTO with #[Validate], translator adapter, and result-to-MessageBag mapping against a real endpoint.
2. Publish a thin internal package (acme/domain-validation) owning the adapters, a rule allow-list, and error-message fixtures.
3. Pilot on one non-customer-critical bounded context; instrument validation failure paths.
4. Ratchet: forbid direct Yiisoft\Validator imports outside the internal package via a static-analysis rule.
5. Decide expand/hold/sunset at a 90-day gate.

Compatibility. No migration of existing rules — never port Illuminate rules 1:1; re-express only the invariants that belong to the domain. Pin an exact version, commit the lockfile, and require a changelog review on every bump. Verify attribute discovery works under OPcache/preloading and that error paths map to the existing API error contract before rollout.

Sequencing. Adapters before adoption, adoption before convention, convention before any widening of scope. Do not start with a customer-facing flow.

Operational Impact

Maintenance. Low code volume, non-trivial ownership: ~300–600 LOC of adapters to maintain indefinitely, plus a dependency whose releases are driven by an external framework's roadmap. Budget a recurring review per Laravel major upgrade and per library minor release. BSD-3-Clause is permissive; the license is not the constraint, the maintainer concentration is.

Support. Community issues only — no vendor SLA, no security-response commitment. Establish an internal policy: monitor advisories, be prepared to fork and patch, and record the fork procedure in the runbook. This is acceptable for a bounded internal dependency, unacceptable for anything on the payment or auth critical path in year one.

Scaling. Validation is stateless and CPU-bound; throughput impact is negligible relative to I/O. Watch two things at scale: rule-object instantiation on large nested payloads (the library's expressiveness invites deep nesting) and per-request translator adapter overhead. Benchmark at p99 on a representative payload before the pilot exits.

Failure modes.

• Silent bypass — a DTO crosses a boundary unvalidated; mitigate with a static-analysis gate and contract tests.
• Grammar drift — the same business rule expressed differently in the two validators; mitigate with a single-source-of-truth table in the ADR.
• Message regression — untranslated or reformatted errors leaking to users/API clients; mitigate with message fixtures asserted in CI.
• Upgrade breakage — a Laravel or library major bump breaks adapters; mitigate with a pinned version and an upgrade calendar entry.
• Abandonment — upstream goes quiet; mitigate with vendored-fork readiness and a defined trigger (e.g., no release in 12 months).

Ramp-up. Roughly one to two days per engineer for the core API, about a week to idiomatic use including testing patterns and error mapping. Most of the cost is unlearning Laravel's validator, so front-load a written ADR, one reference implementation, and a short walkthrough. Keep the blast radius to one or two engineers until the 90-day gate.