The company I work has built an API using Laminas API Tools. We are currently still using PHP 8.2, mostly because the api-tools packages are bound to this version. At the end of 2026, security support stops for PHP version 8.2, meaning that we are forced to upgrade PHP versions. The impact of this change is huge, it means that we need to migrate away from Laminas API Tools since PHP >=8.3 is not supported.
As described in the documentation, API Tools is in security-only maintenance mode. Are you planning to add support for PHP 8.3 or higher? I would expect so, since this is a security concern. If so, when could we expect this release? If you’re not planning to add support, are there other options? For example, are you willing to accept PR’s to add support for PHP >= 8.3?
Work on the components will not be continued; instead, they will be marked as abandoned.
The entire API tools section is no longer being worked on because we do not have the capacity for it. We do not have the personnel, and new pull requests also require manpower that we simply do not have.
Of course, it’s unpleasant to give something up, but you also have to face reality and make hard and sad decisions.
Further to @froschdesign’s response, The Mezzio middlware microframework is still being actively developed and supported and it is a solid choice for api design because it encourages loose coupling and reliance on PSRs, and testing is so much easier (Amongst other things).
If you have kept a good separation between domain code and the api-tools framework, a migration wouldn’t be entirely implausible.
I’d encourage you to spend a bit of time getting to know Mezzio if you’re not already familiar with it.
We understand your concern and we can offer a solution. Like @froschdesign wrote, Laminas API Tools is discontinued, but a highly-compatible alternative is available.
We have been working on the Dotkernel API for years. It’s based on the Mezzio microframework and uses Laminas components, very much like API Tools before it. What’s most important is that Dotkernel API is in active development. We believe it’s the best solution to migrate your system to platform that is similar to API Tools, while also allowing you to stay up-to-date with the latest packages and the most recent PHP version.
You should read our docs and presentation page to see if the solution appeals to you. If you choose to work with us, we can talk about a consultancy agreement for your migration to Dotkernel API.
Thanks for your reply. I fully understand the lack of time and I appreciate all the work you and the team have done!
What is unclear to me is what security-only means. The announcement states:
“The Technical Steering Committee for the Laminas Project has decided to mark Laminas API Tools (formerly Apigility) as security-only, indicating that no new features or enhancements will be developed and only security-related updates will be provided going forward.”
If security updates for PHP 8.2 stop at the end of the year, wouldn’t adding support for PHP 8.3 be a “security-related update”? I’m just trying to get clear if it’s completely out of scope to update to PHP 8.3 since my team and I are in the process of starting a lot of work.
Only potential security issues are addressed, such as those covered by the Common Vulnerabilities and Exposures (CVE). The PHP version in the individual packages does not fall under this category.
One option would be to use a Linux distribution that supports older PHP versions for longer than the PHP Foundation itself. This would allow more time for migration.
