3.0.0 (2026-06-14)
WebFiori Framework v3.0.0
Highlights
WebFiori v3 is a ground-up modernization of the framework, targeting PHP 8.1+ with attribute-driven development, pluggable storage backends, and a security-
first design.
What's New
ServiceRouter — Zero-Boilerplate API Routing
- ServiceRouter::discover() auto-registers routes from #[RestController] classes, plain WebService subclasses, and WebServicesManager managers
- Recursive namespace scanning with kebab-case URL derivation from directory structure
- Dynamic runtime resolution via ServiceRouter::dynamic()
- services:list CLI command for introspection
- Production route caching (routes:cache / routes:clear)
Security & Authorization
- RBAC + ABAC with role inheritance and policy evaluation
- #[PreAuthorize] and #[RequiresAuth] attributes for declarative endpoint protection
- Access::can() falls back to SecurityPrincipal::getRoles() when no internal mapping exists
- Session encryption at rest (AES-256-GCM)
- SRI integrity hashes on external resources
Middleware
- Transitive dependency auto-resolution — assign a leaf middleware, the entire chain is pulled in automatically
- Priority-based execution with topological sort
- Built-in: CSRF, CORS, rate limiting, HTTP caching (ETag/304), session, maintenance mode, authorization
Database
- Migrations with full lifecycle: run, rollback, fresh, status, dry-run, skip, step (interactive)
- Database seeders
- Connection pooling and performance monitoring
- Repository pattern with pagination (offset + cursor)
Sessions
- CacheSessionStorage — back sessions with any cache backend (Redis, file)
- Fixed: session cookie reuse when storage is cleared (no more infinite loop)
Health Checks
- HealthCheck::getChecks() for introspection
- HealthCheck::afterAll() lifecycle hook for notifications
Job Queue
- Priority-based dispatch with delayed execution
- Automatic retry with configurable backoff
- Payload encryption (AES-256-GCM)
- Pluggable storage via QueueStorage interface
Dependency Injection
- Container with bind(), singleton(), instance(), and auto-resolution
- Integrated with ServiceRouter for constructor injection in API services
Observability
- Structured file-based logging with daily rotation and level filtering
- Health check HTTP endpoint (200/503)
Breaking Changes
None. v3 is backward compatible with v3.0.0-RC applications.
Requirements
- PHP 8.1 or later
- Extensions: json, mbstring, fileinfo, openssl
Upgrade
bash
composer require webfiori/framework:^3.0
Documentation
Full documentation at webfiori.com/learn