PHP, PHP-FIG and Composer standards #

This page is for developers who write code for Exponential or package extensions for it, and for administrators who choose a PHP version or install with Composer. It answers: which PHP versions are supported and tested, which PHP-FIG standard recommendations (PSRs) the code follows, how Composer and Packagist are used, and how Exponential's version numbers compare with Semantic Versioning. Each statement names the file it was checked against.

Summary #

Supported PHP versions #

What it is. PHP is maintained by the PHP Group; each minor version gets two years of active support and one or two of security fixes.

How Exponential complies.

• composer.json require: "php": "^7.4 || ^8.0 || ^8.1 || ^8.2 || ^8.3 || ^8.4 || ^8.5 || ^8.6 || ^8.7 || ^8.8". The ranges for 8.6 to 8.8 are forward-looking; those versions do not exist yet and are not tested.
• PHP 8.0 is the oldest supported version from 6.0.15, for sites that cannot move to PHP 8 yet; PHP 8.0 matters because it is the stock PHP of Red Hat Enterprise Linux 9; see Why Exponential supports PHP 7.4 and PHP 8.0 support. PHP functions newer than 7.4 come from symfony/polyfill-php80 and symfony/polyfill-php81, and from lib/phpcompat.php, which autoload.php loads only when PHP_VERSION_ID < 80100. Composer selects the extension packages per PHP version through the metapackage se7enxweb/exponential-php-floor.
• Exponential Velocity, the application server, runs on PHP 8.0 to 8.5 from its release 0.0.4.54 and is in require at ~0.0.4.57 (until then it needed PHP 8.1 and was only in suggest).
• Required PHP extensions in composer.json: dom, libxml, mbstring, pcre, json, iconv, reflection, session, spl, simplexml. Database and image extensions are in suggest.

How it is tested (.github/workflows/):

Status: Complies for PHP 8.0 to 8.5 (PHP 7.4 usable without support).

Known gaps.

• PHPUnit does not run on PHP 8.0 (PHPUnit 10 and later need 8.1); 8.0 is covered by syntax, install and boot only.
• phpstan.neon.dist analyses as PHP 8.1 (phpVersion: 80100), not 8.0.
• Default extension distribution still says the PHP requirement is ^8.1 || ^8.2 ...; composer.json says ^8.0.

PHP-FIG recommendations (PSRs) #

What they are. The PHP Framework Interop Group (PHP-FIG) publishes PHP Standard Recommendations. Exponential's kernel was inherited from eZ Publish 4, which predates most of them; the project has chosen to keep the code style of that kernel and not to adopt the interface PSRs. CONTRIBUTING.md still says "Follow the PSR standards"; the rules that are actually checked are those of phpcs.xml.dist (see Coding standards).

PSR-1, Basic Coding Standard #

• Files start with the full <?php tag (Generic.PHP.DisallowShortOpenTag in phpcs.xml.dist) and are UTF-8.
• Class files declare classes and do not produce output; scripts in bin/php/ are separate.
• Class names do not follow StudlyCaps: expHelpAudience, eZContentObject, ezpAutoloader start with a lower-case prefix.
• Class constants are upper case (ExponentialSDK::VERSION_MAJOR in lib/version.php). Methods are camelCase.
• PSR-1 requires classes to be in a namespace for autoloading by PSR-0 or PSR-4; the kernel classes are global.

Status: Partly complies.

PSR-2 (deprecated), PSR-12 and PER Coding Style #

phpcs.xml.dist enforces the opposite of several PSR-12 rules on purpose: one space inside parentheses (foo( $a ), if ( $a )), array( ... ) instead of [ ... ], opening braces of functions on their own line (PSR-12 has that too, but also for classes and not for control structures), and no type declarations. It reuses one PSR-2 sniff (PSR2.ControlStructures.ControlStructureSpacing) with changed properties.

Status: Does not comply, by design.

PSR-4, Autoloading Standard #

• The root composer.json has no psr-4 or psr-0 section; its autoload only lists files: ["autoload.php"].
• autoload.php includes Composer's vendor/autoload.php, whose class maps load the ezc* classes of the expcomponents (the fork of the Zeta Components since 6.0.15), and registers ezpAutoloader (the kernel's and the extensions' class maps); ezcBase::autoload is registered only when EZCBASE_ENABLED is defined as true, which a Composer installation does not do.
• The kernel class map autoload/ezp_kernel.php and the extension class map (under var/autoload/) are generated by bin/php/ezpgenerateautoloads.php; Composer's post-install-cmd and post-update-cmd run it ("legacy-scripts" in composer.json).
• About 390 files in kernel/ and lib/ declare a namespace (for example Exponential\Command\Kernel, Exponential\View\Kernel\Content), but their paths (such as kernel/private/classes/commands/clusterpurge.php) do not mirror the namespace; they are loaded through the class map too.

Status: Does not comply. Class maps are compatible with any file layout, which is why the kernel uses them.

Note After adding or renaming a kernel class, run php bin/php/ezpgenerateautoloads.php -k; for an extension class, -e. A class missing from the map is not found.

PSR-3, PSR-6, PSR-7, PSR-11, PSR-14, PSR-15, PSR-16, PSR-17, PSR-18 #

A search of kernel/, lib/, bin/ and the extensions in the repository for Psr\Log, Psr\Http, Psr\Container, Psr\Cache, Psr\SimpleCache, Psr\EventDispatcher, Psr\Clock and Psr\Link found nothing.

vendor/psr/log is present only as a dependency of mongodb/mongodb.

Status: Does not comply (not used). This means Exponential does not plug into PSR-based libraries directly; an adapter is needed.

Composer #

What it is. Composer is the dependency manager for PHP; composer.json follows its published JSON schema.

How Exponential complies.

• composer validate --no-check-all --no-check-lock --no-check-publish on the repository prints ./composer.json is valid (run for this page).
• name: se7enxweb/exponential, type: ezpublish-legacy (the type the legacy installer plugin understands), license: GPL-2.0-or-later (an SPDX identifier).
• require pins every se7enxweb/* extension with a tilde constraint (~6.0.28, ~1.4.43, ~1.0.0.50): the last position floats, the positions above it do not.
• require-dev: phpunit/phpunit ^9.6 || ^10.5 || ^11.5 || ^12.0 || ^13.4, nothing else.
• extra.branch-alias: "dev-main": "6.0.x-dev", so packages that require se7enxweb/exponential: ^6.0.14 can resolve against main. CI sets COMPOSER_ROOT_VERSION=dev-main for the same reason.
• config.allow-plugins allows only the legacy installer plugins.
• composer.lock is not committed (.gitignore); every installation resolves from the constraints.
• The development tools (PHP_CodeSniffer, PHPCompatibility, PHPStan) are in a separate composer.dev.json, installed into .devtools/ with make devtools, never into vendor/. Its config.platform.php is 8.0.30.

Status: Complies.

Packagist #

What it is. Packagist.org is the default public Composer repository.

How Exponential complies.

• The root package se7enxweb/exponential is listed on Packagist (its p2 metadata answered on 2026-10-18).
• The GitHub repository has a Packagist webhook configured, so a pushed tag reaches Packagist (checked through the GitHub API on 2026-10-18).
• The push gate checks that every se7enxweb/* constraint in composer.json matches a release Packagist already lists, before CI's composer update would fail on it (Continuous integration, "The local gates and CI").

Status: Complies.

Warning Packagist reads a tag once. A tag that is moved after Packagist has read it produces two different packages with the same version. See Source control and releases.

Semantic Versioning #

What it is. Semantic Versioning 2.0.0 (semver.org) defines MAJOR.MINOR.PATCH: exactly three numbers, with the meaning of each increment.

How Exponential's versions work.

• The kernel is versioned 6.0.x: lib/version.php (ExponentialSDK, VERSION_MAJOR = 6, VERSION_MINOR = 0, VERSION_RELEASE = 15) and the tags from v6.0.0 on. 6.0.15 is the current line (6.0.15 changelog). Feature work lands in patch releases of the 6.0 line, which is not what SemVer intends for PATCH.
• Extensions use three or four positions: exp_adminui ~1.0.0.50, bcgooglesitemaps ~1.1.6.6, expai ~0.0.1.18, and Exponential Velocity 0.0.4.x. A four-part number is not valid SemVer 2.0.0, but Composer accepts up to four numeric positions and compares each numerically.
• The last position counts on. After 0.0.4.9 comes 0.0.4.10, never 0.0.5.0 (Extensions guide, "Release it"; Velocity changelog). Moving a higher position is a separate decision about what the release means.
• Tags are permanent: a bad release is followed by a new one, never re-cut.

Status: Partly complies. Versions are ordered and immutable, and Composer handles them correctly, but four-part numbers and features in patch releases are outside SemVer 2.0.0.

Note Sort tags by version, not by name: git tag -l 'v*' --sort=version:refname. By name, 0.0.4.10 sorts before 0.0.4.8.

Known gaps #

1. No PSR-4 autoloading; new classes need the autoload generator.
2. No PSR-3, PSR-7, PSR-11, PSR-14 or caching PSR interfaces; integrating a PSR-based library needs an adapter.
3. CONTRIBUTING.md asks for "the PSR standards" and links CODING_STYLE.md, which does not exist in the repository.
4. PHPUnit does not run on PHP 8.0; PHPStan analyses as PHP 8.1.
5. Four-part version numbers are not SemVer 2.0.0.
6. The php constraint names PHP versions (8.6 to 8.8) that cannot have been tested.

Related pages #

• PHP 8.0 support
• PHP 8 support
• Coding standards
• Testing and continuous integration
• Source control and releases
• Develop with Git