Advertising sustains the DA. Ads are hidden for members. Join today

On this page

Current PHP dependencies

Last updated on
6 December 2024

Keep this page updated for dependencies that have a significant security or API surface, or Drupal is very dependent on their release cycles. This includes, Symfony, Twig, and some of the dependencies needed for Automatic Updates.

To find other dependencies see issues tagged "approved dependency evaluation".

Current PHP dependencies

Doctrine
Repository
Release cycle
Security policies Doctrine Security Policy
Security issue reporting security [at] doctrine-project.org
Contact(s)

Guzzle
Repository https://github.com/guzzle/guzzle
Release cycle No fixed schedule. Follows semantic versioning. No overlapping coverage for minor releases. (Guzzle Version Guidance)
Security policies Guzzle documentation: Reporting a security vulnerability
Security issue reporting security [at] guzzlephp.org
Contact(s)

Paragonie: random_compat
Repository https://github.com/paragonie/random_compat
Release cycle No public schedule or documentation. Appears to follow semver. (random_compat releases)
Security policies random_compat security information
(NB: Full disclosure)
Security issue reporting security [at] paragonie.com
Contact(s) N/A

Peast
Repository https://github.com/mck89/peast
Release cycle No fixed schedule, but patch releases every 2-4 months, minor releases every 1-2 years.
Security policies No guaranteed security fixes
Security issue reporting marco.mm89 [at] gmail.com
Contact(s) Marco Marchiò https://github.com/mck89

PSR-17: HTTP Factories
Repository https://github.com/php-fig/http-factory
Release cycle N/A (no ongoing development)
Per Larry Garfield:

PSR specs basically don't change at all. Sometimes we release a .z release to fix a comment typo or something like that, but that's about it.
We just recently approved a new process to release BC or almost entirely BC versions of an interface. So far it's not been used, although I am trying it out with PSR-13. Any new releases there would follow semver very conservatively.
Security policies N/A (interfaces only--no feature code)
Per Larry Garfield:

We don't really have a security release process for them, as they're just interfaces.
Security issue reporting N/A
Contact(s) https://groups.google.com/forum/#!forum/php-fig

PSR-7: HTTP message interfaces
Release cycle N/A (no ongoing development)
(See PSR-17: HTTP Factories.)
Security policies N/A (interfaces only--no feature code)
(See PSR-17: HTTP Factories.)
Security issue reporting N/A
(See PSR-17: HTTP Factories.)
Contact(s) https://groups.google.com/forum/#!forum/php-fig

PEAR: Archive_Tar
Repository
Release cycle
Security policies
Security issue reporting
Contact(s)

Stack-Cors
Repository https://github.com/asm89/stack-cors
Release cycle
Security policies
Security issue reporting
Contact(s)

Symfony
Repository https://github.com/symfony/symfony
Release cycle Symfony Roadmap
Security policies

Symfony security policies

Symfony generally provides 8 months of security coverage for minor releases other than their LTS version. Two of the Drupal core framework managers (alexpott and larowlan) are members of the Symfony Security Team in order to facilitate backports of security issues that affect supported versions of Drupal when necessary.
Security issue reporting security [at] symfony.com
Contact(s) fabpot, MichaelCu (security)

Twig
Repository https://github.com/twigphp/Twig
Release cycle No public schedule or documentation. From fabpot in Aug. 2018:

Twig 1.x is still maintained and there is no plan to EOL it anytime soon.

Twig 1.36 would be the last release with new features. After that, I will still maintain Twig 1 for bug and security fixes. I will also ensure that Twig 1 will continue to work on new PHP versions (PHP 8 might need some tweaks).

In November 2019:

I don't have plans to EOL Twig 1 or 2
All 3 versions are maintained in [parallel]
and with time, I will drop support for older PHP versions (like I've done with Twig 1), but always very conservative
one thing I could do for instance is dropping the C ext for Twig 1, as all supported PHP versions are obsolete now
Security policies No reference available
Security issue reporting ?
Contact(s) fabpot

TYPO3: Phar Stream Wrapper
Repository
Release cycle
Security policies
Security issue reporting
Contact(s)

Zend Feed
Repository https://github.com/laminas/laminas-feed
Release cycle Single master branch with no fixed release schedule or overlapping support.
Security policies https://getlaminas.org/security/
Security issue reporting https://getlaminas.org/security/
Contact(s)

Zend Diactoros
Repository https://github.com/laminas/laminas-diactoros
Release cycle Diactoros 1.8 is the LTS version supported until 2022-03-15 (the table is incorrect, specifying 1.7, see https://github.com/laminas/laminas-diactoros/issues/4)
Security policies https://getlaminas.org/security/
Security issue reporting https://getlaminas.org/security/
Contact(s)

Zend Feed
Repository
Release cycle Single master branch with no fixed release schedule or overlapping support. (Zend Support and Long Term Support Policies)
Security policies
Security issue reporting
Contact(s)

Zend Diactoros
Repository https://github.com/zendframework/zend-diactoros
Release cycle LTS version available. (Zend Support and Long Term Support Policies). Diactoros 1.8 is the LTS version supported until 2022-03-15 (the table is incorrect, specifying 1.7, see https://github.com/zendframework/zend-diactoros/issues/373#issuecomment-...)
Security policies
Security issue reporting
Contact(s)

Dev dependencies

Composer
Repository https://github.com/composer/composer
Release cycle https://github.com/composer/composer/releases
Security policies N/A
Security issue reporting N/A
Contact(s) https://packagist.org/packages/composer/composer

Dealerdirect:composer-installer
Repository https://github.com/PHPCSStandards/composer-installer
Release cycle Likely to change only when composer or PHP_CodeSniffer changes.
Security policies None. This is a dev tool and will not be present on production. This is a composer installer plugin that allows for easy installation of PHP_CodeSniffer coding standards (rulesets).
Security issue reporting N/a
Contact(s) franck.nijhof [at] dealerdirect.com

PHPUnit
Repository
Release cycle Supported versions of PHPUnit
Security policies PHPUnit maintainers consider the package a development tool that should not be used in production; therefore, they do not have a security release process.
Security issue reporting N/A
Contact(s)

PostCSS
Repository https://github.com/postcss/postcss
Release cycle Based on the history of the library, there has been a new major release every 2 years. Only single major release is supported at the time.
Security policies PostCSS does not have security release process (as the maintainers do not consider it necessary for a development tool that's not intended for production use).
Security issue reporting Security issues can be reported using Tidelift.
Contact(s) https://github.com/orgs/postcss/people

Terser
Repository https://github.com/terser/terser
Release cycle There have been 3 major releases in the last 7 years. Minor releases are tagged every few days for at least the past year. Changelog is regularly updated.
Security policies Terser is a development only tool that should not be used in production; therefore, they do not have a security release process.
Security issue reporting N/A
Contact(s) https://github.com/orgs/terser/people

PHPStan
Repository https://github.com/phpstan/phpstan
Release cycle Frequent. Version 1.0 was released in Nov 2021. We are already on 1.3.3
Security policies PHPStan is a development only tool that should not be used in production. Security policy exists.
Security issue reporting https://github.com/phpstan/phpstan/blob/260513fc8d06403dfe82e7665262ca1c...
Contact(s) https://github.com/ondrejmirtes

PHPstan:extension-installer
Repository https://github.com/phpstan/extension-installer
Release cycle Likely to change only when to composer changes.
Security policies None. This is a dev tool and will not be present on production. This is a composer plugin to make it easy to use libraries which add PHPStan rules.
Security issue reporting N/A
Contact(s) https://github.com/ondrejmirtes

PHPstan:phpstan-drupal
Repository https://github.com/mglaman/phpstan-drupal
Release cycle Will change when an upstream change in PHPStan forces it to. Likely to change as more rules are added because of usage by core :)
Security policies See https://github.com/mglaman/phpstan-drupal/blob/main/.github/SECURITY.md. This is a dev tool and will not be present on production.
Security issue reporting https://github.com/mglaman/phpstan-drupal/blob/main/.github/SECURITY.md
Contact(s) https://github.com/mglaman

PHPstan:phpdoc-parser
Repository https://github.com/phpstan/phpdoc-parser
Release cycle Frequent. Version 1.0 was released in Sep 2021. We are already on 1.5.1.
Security policies None. This is a dev tool and will not be present on production. This is a next generation phpDoc parser with support for intersection types and generics, which is used by Coder.
Security issue reporting N/a
Contact(s) https://github.com/ondrejmirtes

PHPstan:phpunit
Repository https://github.com/phpstan/phpstan-phpunit
Release cycle Not as regular or prolific as PHPStan itself, but still several releases this year - more is not expected given that it is a much smaller target that PHPStan itself, and PHPUnit is fairly stable so it does not need to chase a moving target.
Security policies TBA
Security issue reporting https://github.com/phpstan/phpstan-phpunit/security/policy
Contact(s) https://github.com/ondrejmirtes
Contact(s) https://github.com/webflo

Slevomat:coding-standard
Repository https://github.com/slevomat/coding-standard
Release cycle Frequently adding new sniffs.
Security policies None. This is a dev tool and will not be present on production. This provides sniffs for PHP_CodeSniffer and is used by Coder.
Security issue reporting N/a
Contact(s) https://github.com/kukulich

Webflo:drupal-finder
Repository https://github.com/webflo/drupal-finder
Release cycle Only likely to change if core changes it's directory structure.
Security policies None. This is a dev tool and will not be present on production. It is used by Drush so it present on thousands of Drupal installs already.
Security issue reporting N/a

Help improve this page

Page status: No known problems

You can: