Surviving a Symfony Upgrade

Symfony is evolving and you may ask yourself whether your application can keep up. This presentation aims to show coding techniques and design patterns that will make future Symfony upgrades much easier, even if we don't know what the future holds!

Transcript

1. @afilina@phpc.social Surviving a Symfony Upgrade SymfonyCon Amsterdam November 28, 2025
2. @afilina@phpc.social A framework upgrade can take 10 minutes or several years.
3. I Stand With Ukraine @afilina@phpc.social Anna Filina • Coding since 1997 • PHP, C#, Java … • Symfony since v1 in 2007 • Legacy archaeology • Project rescue • Mentorship • Open for work
4. I Stand With Ukraine @afilina@phpc.social Depends On… • Symfony version: minor or major, big gap • Features used: experimental, deprecated • Coupling with Symfony • Automation: tests, tools to fix • Runtime environment neglect (including PHP) ⟡
5. @afilina@phpc.social PHP Templates
6. @afilina@phpc.social // Symfony 4.3 <?php $view->extend('base.html.php') ?> <?php $view['slots']->set('title', 'SymfonyCon') ?> <h1> Hello <?= $name ?> </h1>
7. I Stand With Ukraine @afilina@phpc.social Breaks in 5.0 • Removed support for PHP templates1 • Need to use Twig for those templates ⟡ 1 https://symfony.com/blog/new-in-symfony-4-3-deprecated-the-templating- component-integration
8. I Stand With Ukraine @afilina@phpc.social Warning Signs • Feature deprecated in 4.3 • Can see in deprecation log: Using the "templating" service is deprecated since version 4.3 and will be removed in 5.0; use Twig instead. • 6 months until 5.0 to start migrating to Twig ⟡
9. I Stand With Ukraine @afilina@phpc.social PHP Templates Feature • Supported and documented • First clear upcoming removal signal in a blog1 • A month before 4.3 release ⟡ 1 https://symfony.com/blog/new-in-symfony-4-3-deprecated-the-templating- component-integration
10. I Stand With Ukraine @afilina@phpc.social Coupling • Embedded control syntax = tightly coupled • Meaning of {% block ... %} or {% extends … %} aren’t universal ⟡
11. I Stand With Ukraine @afilina@phpc.social Automation • Deprecations show up when you execute code • Your own automated tests will surface deprecations • Tests: need integration & application, not just unit ⟡
12. I Stand With Ukraine @afilina@phpc.social Types of Tests • Different goals • Unit: internal logic correctness, execution paths • Integration: wiring stability, component interaction, database • Application: observable behavior, request lifecycle ⟡
13. @afilina@phpc.social // MyUnitTest extends TestCase $templating = $this->createMock( \Symfony\Component\Templating\EngineInterface::class ); $templating->method('render') ->with('example.php') ->willReturn('Symfony Rocks!');
14. I Stand With Ukraine @afilina@phpc.social Integration Tests • Test interaction between components • Interaction can break when you upgrade • Symfony provides testing tools ⟡
15. @afilina@phpc.social // Symfony 7.3 + Twig // MyIntegrationTest extends KernelTestCase self::bootKernel(); $container = static::getContainer(); $twig = $container->get(TwigEnvironment::class); $renderedHtml = $twig->render('pages/index.html.twig'); $this->assertStringContainsString('SymfonyCon', $renderedHtml);
16. @afilina@phpc.social // Symfony 7.3 // MyApplicationTest extends WebTestCase $client = static::createClient(); $client->request('GET', '/'); $this->assertResponseIsSuccessful(); $this->assertSelectorTextContains('h1', 'SymfonyCon');
17. @afilina@phpc.social Native Types Example: Console Commands
18. @afilina@phpc.social // MyCommand extends Command // Symfony 6.4 protected function execute(InputInterface $input, OutputInterface $output) // Symfony 7.0 protected function execute(InputInterface $input, OutputInterface $output): int
19. @afilina@phpc.social // Symfony 6.4 protected function execute(InputInterface $input, OutputInterface $output) { return; }
20. I Stand With Ukraine @afilina@phpc.social Breaks in 7.0 • Added native return type declaration • Native types introduced over many years and versions ⟡
21. I Stand With Ukraine @afilina@phpc.social Warning Signs • Released as @return int|null • Stabilized as @return int since 4.4 • Tool to scan and patch return types since 4.41 Method " [...]\Command::execute()" will return "int" as of its next major version. • 4 years until 7.0 to fix code ⟡ 1 https://github.com/symfony/symfony/pull/33283
22. I Stand With Ukraine @afilina@phpc.social Coupling • Commands are tightly coupled with Symfony • But don’t have to extend since 7.3 (in standalone Console component since 7.4 – yesterday) ⟡
23. @afilina@phpc.social // Symfony 7.3 #[AsCommand(name: 'app:my-command')] class MyCommand { public function __invoke(): int { return Command::SUCCESS; } }
24. @afilina@phpc.social public function __invoke(): int public function __invoke(OutputInterface $output): int public function __invoke(#[Argument('User e-mail.')] string $email): int
25. I Stand With Ukraine @afilina@phpc.social Interface Guarantee • Safe to use interfaces1 • Symfony won’t break them • Unless marked @experimental or @internal • Unless security fix ⟡ 1 https://symfony.com/doc/current/contributing/code/bc.html
26. I Stand With Ukraine @afilina@phpc.social Automation • Scan and patch type declarations1 ./vendor/bin/patch-type-declarations • Fix body if needed (manual) • Unit tests for internal logic • Integration tests with CommandTester2 ⟡ 1 https://wouterj.nl/2021/09/symfony-6-native-typing 2 https://symfony.com/doc/current/console.html
27. @afilina@phpc.social // MyTest extends KernelTestCase self::bootKernel(); $application = new Application(self::$kernel); $command = $application->find('app:my-command'); $commandTester = new CommandTester($command); $commandTester->execute(); $commandTester->assertCommandIsSuccessful();
28. @afilina@phpc.social Structural vs Semantic Breaks
29. @afilina@phpc.social // Symfony 4 $this ->get('session') ->getFlashBag() ->add('notice', 'Saved!'); // Symfony 5 $this ->addFlash('notice', 'Saved!');
30. @afilina@phpc.social ->add( $obj->method(), $array[$index] );
31. I Stand With Ukraine @afilina@phpc.social PHPStorm • Replace Structurally feature • Syntax-aware changes • Easy to use ⟡
32. @afilina@phpc.social // Search template $this ->get('session') ->getFlashBag() ->add($arguments$); // Replace template $this ->addFlash($arguments$);
33. I Stand With Ukraine @afilina@phpc.social Rector • Refactors PHP code • Rules written in PHP • Existing rules for Symfony1 • Write custom rules ⟡ 1 https://getrector.com/find-rule?query=symfony
34. I Stand With Ukraine @afilina@phpc.social Structural Changes • Renames • Relocations • Config format • Signature changes with same behavior • Detectable with static analysis • Fixable with automation ⟡
35. @afilina@phpc.social // Symfony 5 $ids = $request ->query ->get('ids', []);
36. @afilina@phpc.social Expected a scalar value as a 2nd argument to "Symfony\Component\HttpFoundation\InputBag::get()", "array" given. InvalidArgumentException
37. I Stand With Ukraine @afilina@phpc.social Deprecation • trigger_deprecation since 5.1 • Shows up in Symfony profile bar • Also @param mismatch → highlight in PHPStorm • Also reported if you use PHPStan or similar • Also shows up in error log • Also shows up in tests ⟡
38. I Stand With Ukraine @afilina@phpc.social Semantic Changes • Type enforcement • Different behavior • New default config values • Event reorder • Detectable mostly at runtime (tests!) • Hard to infer intent for automated fixes ⟡
39. @afilina@phpc.social // Symfony 5.3 IpUtils::checkIp4('1.2.3.4', '0.0.0.0/0'); string(7) "0.0.0.0"
40. @afilina@phpc.social $isBlocked = IpUtils::checkIp4($ip, $disallowedRanges); if (!is_string($isBlocked)) { grantIntranetAccess(); }
41. I Stand With Ukraine @afilina@phpc.social Winning Combination • Automate tests • Use static analysis • Keep up with deprecations • Limit inheritance (implement, compose, inject interface) • Upgrade dependencies & infrastructure often ⟡
42. @afilina@phpc.social Questions? SymfonyCon Amsterdam November 28, 2025