shardj / zf1-future

1.26.0 2026-11-04 01:32 UTC

Requires

• php: >=7.4
• symfony/polyfill-ctype: ^1.30
• symfony/polyfill-mbstring: ^1.30
• symfony/polyfill-php81: ^1.30
• symfony/polyfill-php82: ^1.30
• symfony/polyfill-php83: ^1.30

Requires (Dev)

• friendsofphp/php-cs-fixer: ^3
• php-parallel-lint/php-parallel-lint: ^1.3
• phpcompatibility/php-compatibility: dev-develop
• phpstan/phpstan: ^2.0
• phpstan/phpstan-phpunit: ^2.0
• phpunit/phpunit: ^9
• rector/rector: ^2.0
• yoast/phpunit-polyfills: ^2.0

Suggests

• ext-mbstring: Multibyte strings handling

Replaces

• zendframework/zendframework1: >=1.12.20

BSD-3-Clause

• framework
• ZF1

Published on Packagist.org on 2026-11-04 01:34 UTC

README

_{^{Thanks to WebTigers for the logo}}

Zend Framework 1 now for PHP 8.3!

Classic ZF1 Reborn

Zend may have abandoned the original Zend Framework, but the global Zend Framework Community has not! Since Zend sentenced ZF1 to EOL, the Zend Framework community around the globe has continued to work and build on what we consider to be one of the best PHP frameworks of all time. Framework is supported and tested on PHP 7.4 up to 8.3. PHP 8.4 and 8.5 are part of the regular test suite as well, but may still show deprecation notices; PHP 8.6 is tested as experimental.

ZF1-Future Sponsors

Products and Projects built with ZF1-Future:

Creators of the Tiger Development Platform featuring ZF1-Future

Creators of Seiden PHP+ for IBM i featuring ZF1-Future

ZF1 is Now Version 1.26!

Over 250 updates and bug fixes since 1.12!

The ZF1 community has been hard at work updating Zend Framework with all of the latest features of 8.3.

Documentation

New ZF1-Future Manual: ZF1-Future Docs

Original Docs

The original docs can be found here: https://framework.zend.com/manual/1.12/en/manual.html

Installation

Installable through git clone or through
composer require shardj/zf1-future https://packagist.org/packages/shardj/zf1-future

Composer is the recommended way. If you install from git or from a release archive without Composer, add the library directory to your include_path and make sure the ctype and mbstring extensions are enabled. The Symfony polyfills from composer.json are not loaded in that case.

System Requirements

ZF1 Future runs on any version of PHP between 7.4 and 8.3. PHP 8.4 and 8.5 are tested as well and work in practice, but are not officially supported yet; PHP 8.6 is experimental (see the test matrix in .github/workflows/phpunit.yml).

License

The files in this archive are released under the Zend Framework license. You can find a copy of this license in LICENSE.txt.

Related Projects

• ZF1 Extras Future
• ZF1s - Another community supported continuation of ZF1, with a focus on splitting the frameworks original components into individual packages

Mail: OAuth 2.0 (XOAUTH2) for Gmail and Microsoft 365

Since 1.26.0 Zend_Mail authenticates with an OAuth 2.0 access token where a password is no longer accepted: 'auth' => 'xoauth2' with username and accessToken in Zend_Mail_Transport_Smtp, and accessToken instead of password in Zend_Mail_Storage_Imap / Zend_Mail_Storage_Pop3. Obtaining and refreshing the token is up to the application (e.g. with league/oauth2-google or thenetworg/oauth2-azure).

Security

• unserialize() and CVE-2020-29312. The CVE describes no specific flaw in this library (it names a non-existent version 3.1.3, gives no affected class and no reference, and is marked as disputed by NVD); it restates that unserialize() of untrusted data is unsafe in PHP, whatever classes are loaded. ZF1-Future itself never unserializes request data. Where it unserializes data it wrote itself (cache metadata, locale and date caches, OpenID storage, Lucene index files) it passes allowed_classes to unserialize() since 1.26.0, so no object can be instantiated from such a file. Cache content stored with automatic_serialization, Zend_Serializer, sessions and the priority queues keep unserializing objects, because that is what they are for. In your application: never call unserialize() (or Zend_Serializer::unserialize()) on data a user can influence; use JSON for data exchange; for your own serialized data use the unserialize_class_whitelist option of Zend_Serializer_Adapter_PhpSerialize and/or an HMAC. See #341

Known issues and solutions

• Bootstrap error: Unable to resolve plugin "useragent"; no corresponding plugin with that name
  Fixed in 1.26.0 (#407). On older versions the resource file has to be renamed to Zend/Application/Resource/Useragent.php, see #92
• Zend_Test_PHPUnit_Db (database fixtures for PHPUnit) is not supported. It extends the DbUnit classes PHPUnit_Extensions_Database_*, which only exist for PHPUnit 5 and older; the component is shipped as is, without tests, and is not adapted to the DbUnit forks for current PHPUnit versions (their classes are namespaced and typed). Applications that need DbUnit have to use such a fork directly, see #412