Zend Framework: a historical framework and its Laminas migration context

Sources and evidence limits

The only evidence is the Zend Framework home page at https://framework.zend.com/. That page is thin, so many details are marked unknown instead of guessed.

What this project is

Zend Framework is a PHP framework. It is not a standalone PHP runtime, an interpreter, or a CMS. PHP core is the language engine, and Zend Framework is PHP code that runs on top of it. A CMS such as Drupal is a finished content product. A framework supplies building blocks for your own application. The page also lists separate components, for example zend-mail and zend-developer-tools in its security advisories. Components are not CMS products either.

The most important fact on the page is its banner: "Zend Framework is now the Laminas Project!" A blog post titled "Endings and Beginnings: Goodbye, and Please Welcome the Laminas Project!" is also listed. This guide therefore treats Zend Framework as historical and as a predecessor to Laminas. It should not be chosen for new production work. Lifecycle for the Zend-branded project is historical. The current status of Laminas is not covered by the supplied source, so it is unknown here.

Architecture as described by the source

The page describes an "open architecture based on Middleware or MVC, following PHP-FIG standards." It links two starting points:

• an MVC skeleton app
• an Expressive skeleton app, and the page says the website itself is built with zend-expressive

The middleware style composes a request pipeline. The MVC style uses controllers and views. The source gives no further detail on routing, dependency injection or configuration, so this guide does not describe them.

Execution model

The source does not explicitly describe the execution model. Frameworks like this are normally run in the classic request lifetime. PHP starts the application for a request, builds the application objects, sends a response, and discards the request state. A blog post titled "Async Expressive? Try Swoole!" suggests an alternative, but the page gives no details.

If you meet a persistent-worker setup in a legacy project, keep these points in mind:

• Swoole and Open Swoole are different projects. The source mentions only Swoole in a post title. Do not assume the two are interchangeable, and do not assume anything about Open Swoole from this page.
• A persistent worker boots once and handles many requests. Anything stored in static properties, singletons, global variables, or long-lived service objects can survive from one request to the next.
• State leakage is the main risk. Examples are a logged-in user, a request object, a locale, a database transaction, or cached per-user data appearing in a later request.
• Cleanup means designing services to be stateless, or resetting them after every request. Pass request data explicitly, avoid mutable statics, close or reset connections, and test that two consecutive requests with different users do not affect each other.

The source gives no compatibility details for persistent workers with Zend Framework, so treat that as unknown.

Practical use cases today

The realistic use case is maintenance and migration of existing applications, not greenfield development. Typical tasks are:

• finding which Zend-named packages an application depends on
• reading old code that uses MVC or middleware conventions
• reviewing the security advisories listed on the page, such as ZF2019-01, ZF2018-01, ZF2016-04 and ZF2016-03
• planning a move to the successor project or to another stack

The page also lists company users, but those logos say nothing about what is advisable now.

Installation approach

The page has an Install menu with "Get started", "MVC skeleton app", "Expressive skeleton app" and "Archives". It does not show exact commands, package names or versions, so none are given here. For a legacy codebase, do not install anything new. Inspect the existing composer.json and composer.lock instead. The example below does this without depending on Zend Framework.

Strengths and limitations

The site claims performance tuning, extensibility, security practices (it mentions bcrypt password storage and AES-256 encryption) and enterprise readiness "for PHP 7". These are the project's own marketing statements. This guide has not verified them and makes no speed claims.

The limitations matter more for new work:

• The project has been renamed Laminas.
• The page names PHP 7 and a PHP 7.2 support post. Compatibility with PHP 8.4 is unknown, and nothing here suggests it.
• The page lists security advisories, including one about potential remote code execution in zend-mail through the Sendmail adapter. Check any old install against the full advisory list.
• The footer reads "2006-2022 by Zend by Perforce". No license text, price or support policy is in the supplied excerpt, so these are unknown.

Our learning track uses PHP 8.4, with PHP 8.5 planned. The example below targets PHP 8.4 only for our own small script, not for Zend Framework.

Deployment

The source gives no deployment guidance. If you operate a legacy Zend Framework application, keep it behind your normal web server and PHP process manager. Never expose FastCGI publicly. Restrict it to a private interface or socket. Plan migration rather than long-term operation, because the project is historical.

Migration example

The example is a read-only CLI script. It reads a Composer lock file and flags package names containing "zend". This is a name heuristic. It can miss renamed packages and flag unrelated ones, so use it only as a starting inventory. It needs only PHP 8.4 and Composer for the manifest check. It needs no network services and is not a browser exercise.

Links

The only supplied official source is the Zend Framework home page. Use it to read the Laminas announcement and the advisory list, then follow the official Laminas materials it points to.

{
    "name": "learnphponline/zend-lock-audit",
    "description": "Read-only helper that lists Zend-named packages in a Composer lock file.",
    "type": "project",
    "license": "proprietary",
    "require": {
        "php": "^8.4"
    }
}

<?php

declare(strict_types=1);

$path = $argv[1] ?? 'composer.lock';

if (!is_file($path)) {
    fwrite(STDERR, "File not found: {$path}\n");
    exit(2);
}

$data = json_decode((string) file_get_contents($path), true, 512, JSON_THROW_ON_ERROR);

$packages = array_merge($data['packages'] ?? [], $data['packages-dev'] ?? []);
$flagged = [];

foreach ($packages as $package) {
    $name = (string) ($package['name'] ?? '');
    $version = (string) ($package['version'] ?? 'unknown');

    if (str_contains(strtolower($name), 'zend')) {
        $flagged[] = [$name, $version];
    }
}

echo 'Scanned ' . count($packages) . " packages.\n";

foreach ($flagged as [$name, $version]) {
    echo "FLAG {$name} {$version}\n";
}

if ($flagged === []) {
    echo "No Zend-named packages found (name heuristic only).\n";
    exit(0);
}

echo count($flagged) . " package(s) need migration review.\n";
exit(1);

{
    "packages": [
        { "name": "example/zend-mail-fixture", "version": "1.0.0" },
        { "name": "example/logger", "version": "2.0.0" }
    ],
    "packages-dev": [
        { "name": "example/zend-dev-tools-fixture", "version": "0.1.0" }
    ]
}

composer validate
php bin/audit.php fixtures/composer.lock