actra / yuf

v6.5.0 2026-10-11 17:25 UTC

Requires

• php: >=8.5
• ext-bcmath: *
• ext-ctype: *
• ext-curl: *
• ext-dom: *
• ext-fileinfo: *
• ext-iconv: *
• ext-intl: *
• ext-libxml: *
• ext-mbstring: *
• ext-openssl: *
• ext-pdo: *
• ext-simplexml: *

Requires (Dev)

• actra/coding-standard: ^1.27.0
• phpunit/phpunit: ^13.4

MIT AND LGPL-2.1-only AND Apache-2.0

• Actra AG

• framework
• php
• lightweight
• fast
• smart
• actra

Published on Packagist.org on 2026-10-11 17:25 UTC

README

yuf (pronounced "[jʌf]" or "[jʊf]") is a smart, fast and lightweight PHP framework without runtime dependencies, installed and loaded with Composer.

• Routing, views, JSON endpoints and an immutable request object
• Template engine with escaping by default and own tags
• Typed form fields, rules, CSRF and spam protection, checked file uploads
• Session object, login with session fixation protection, Argon2id passwords, IP whitelists
• PDO connection with typed rows and a safe query builder
• Mail via SMTP (incl. XOAUTH2) or the Microsoft Graph API, phone numbers based on libphonenumber
• CSP nonces, ships no JavaScript

Requirements

• PHP 8.5 or higher
• Extensions: mbstring, openssl, pdo, intl, bcmath, simplexml, dom, iconv, curl, libxml, ctype, fileinfo

Installation

Start a new project with the yuf skeleton:

composer create-project actra/yuf-skeleton my-project

Or add yuf to an existing project:

composer require actra/yuf

Composer is needed to build the application (vendor/), not on the server: deploy with composer install --no-dev --optimize-autoloader.

Usage

require __DIR__ . '/../vendor/autoload.php';
$core = Core::fromEnvironment(envFilePath: __DIR__ . '/../.env.php', copyrightYear: 2026);
$core->prepareHttpResponse(routeCollection: $routes)->sendAndExit();

See .env.example.php, index.example.php and the documentation:

• Setup: entry point, environment settings, production (host, client IP, PHP settings), error log
• Views and requests: views, request, path variables, JSON endpoints
• Session and login: session, login, passwords, secret tokens
• Templates: syntax, escaping, snippets and tables, own tags
• Forms: typed values, rules, spam protection, uploads, extension points
• Database: connection, typed rows, query builder, boolean search
• Mail: SMTP (STARTTLS or implicit TLS) and Microsoft 365
• Phone numbers: parsing, formats, validation
• Testing: PHPStan and PHPUnit in projects using yuf, test objects, clock

Upgrading

Read UPGRADE.md before composer update: minor versions may contain breaking changes (marked ⚠️). Libraries that use yuf require it with ~6.0.0 (minor version locked).

Contributing

Follow the Actra coding standard and AGENTS.md. composer check (code style, PHPStan, tests) must be green; with DDEV run ddev start and ddev composer check. The example app in example/ then runs at https://yuf.ddev.site/.

License

© 2026 Actra AG. yuf is licensed under MIT AND LGPL-2.1-only AND Apache-2.0; the @license tag in the header of each file says which applies:

• MIT, see LICENSE: everything not listed below.
• LGPL-2.1-only, see src/mailer/LICENSE: the classes in src/mailer/ derived from PHPMailer (they say so in their header); the original copyright lines are kept.
• Apache-2.0, see src/phone/LICENSE and src/phone/NOTICE: src/phone/, adapted from libphonenumber-for-php.

Projects under any license, including proprietary ones, may use yuf. When you distribute yuf (or software containing it), keep these license files and headers; the LGPL parts must stay replaceable and their source available, which the PHP source of yuf in vendor/ already ensures. Changes to the LGPL parts stay under the LGPL.