PhpSpreadsheet: PHP 8.2 as the floor, and a master branch scoped to fixes

Three release lines shipped inside the same half hour

The release history for this project is not a single line. On 2026-09-17 the same day produced 5.10.0, 3.10.8 and 2.4.8, three separate lines each receiving a tagged version inside the same half hour. The repository is not archived and the last push to master is 2026-11-01, so activity is current, but current activity says nothing about which of those lines your code belongs on. Nothing in the README maps a branch to a PHP version, a feature set, or a support window, and there is no table telling you whether the 2.x line still receives new capability or only corrections. For a library where the last step of adoption is a version constraint in composer.json, that gap is the first one to close. Pin the major line deliberately, then read the changelog for that line rather than the newest tag. CHANGELOG.md and CHANGELOG.PHPExcel.md both sit at the repository root, so the history of the rewrite from PHPExcel is kept alongside the history of the current project rather than in an archive.

PHP 8.2 is the floor and 30th June 2027 is the clock

The stated minimum is PHP 8.2, and the project commits to supporting that version until 30th June 2027. The policy around that number is spelled out in the version support section: for maintained branches, support for a PHP version continues for six months beyond that version's end of life, and dropping support after that date is explicitly not treated as a breaking change. That last sentence carries direct consequences for anyone running this in production. A routine dependency update can remove support for the PHP version your application targets without any major version change on the PhpSpreadsheet side, so an update that runs clean on an older host can leave you holding a library that no longer claims to support that host. The same section points at composer.json for the other requirements rather than enumerating them here, which means your real floor is whatever that file declares, extension requirements included. Check the PHP version and that file together before you call a release deployable.

Master is scoped to security and bug fixes, so new work has no named home

The first substantive line of the README is a scope statement: this is the master branch, and it is maintained for security and bug fixes. That is a narrower promise than the usual meaning of master, and the page does not follow it by naming another branch where new functionality lands. No development branch, next branch, or release candidate line appears in the README, and the repository metadata names only master as the default branch. What follows for an adopter is practical. The same README, in its PHPExcel section, says contributions including patches and new features should target the master branch, and it gives no timeline for new capabilities. It also means the two routes you have, master and the tagged release lines, differ in kind and not only in version number: one takes fixes, the other takes whatever its line carries. That turns the version decision into a support decision, made once and revisited when your own PHP floor moves.

Feature guides run behind Patreon for six months before they become public

Some of the clearest explanations of how this library behaves sit behind a paywall for a defined window. The maintainer runs a Patreon and posts articles taking a detailed look at an Excel feature and how to use it in PhpSpreadsheet. Two are already available to supporters: The Dating Game, on how MS Excel and PhpSpreadsheet handle date and time values, and Looping the Loop, on advice for iterating through rows and cells. Behind the Mask, a look at number format masks, is held back for patrons at levels actively using PhpSpreadsheet, and a fourth, Formula for Success, on debugging formulae that do not produce the expected result, is listed as work in progress. Planned topics include Tables, Structured References, AutoFiltering, Array Formulae, Conditional Formatting, Data Validation, Value Binders, Images and Charts. The stated rule is that after six months exclusive to supporters, articles are folded into the public documentation. Until that window closes, those particular articles are available only to supporters.

A dozen documentation configs at the root for two public sites

The top level of this repository holds six `.readthedocs` yaml files covering material, materialx, mkdocs, properdocs, readthedocs and zensical variants, two zensical.toml files, five mkdocs yml variants, and a properdocs.yml, all next to the docs/ directory. The documented way in is two hosts: the official documentation at phpspreadsheet.readthedocs.io and the API documentation at phpoffice.github.io/PhpSpreadsheet. Installation itself is delegated to one page on the first host, the install instructions anchor, and composer.json is cited for the other requirements. None of those configuration files is discussed in prose, so which generator feeds which host is not stated, and a contributor touching documentation faces a dozen candidates where one would be the norm. For a reader the effect is smaller but still real: install help, API reference, and the source of both live in three different places. Send task questions to the readthedocs host, signatures to the github.io host, and treat the root configs as contributor territory.

Coming from PHPExcel is a migration project, not a version bump

The project positions itself as the next version of PHPExcel and states plainly that it breaks compatibility, listing what that buys: namespaces, PSR compliance, and use of latest PHP language features. PHPExcel itself is no longer maintained, and all contributions, patches, and new features are directed at PhpSpreadsheet master. An automated tool exists for the move, linked from the README as docs/topics/migration-from-PHPExcel.md. Two consequences follow for anyone arriving from the old library. There is no compatibility shim and no deprecation runway, so an import change cannot be deferred by pinning an older constraint. And the tool is a starting point rather than a promise, because the break is deliberate and the page does not enumerate every renamed class or altered behaviour, so a clean run still needs human review of the diff. CHANGELOG.PHPExcel.md remains in the repository as the record of the earlier line, which is the place to look when you need to know what a behaviour was before it moved.

A phpstan baseline sits beside the config, so a clean run is not the whole story

The configuration files at the repository root include phpstan.neon.dist and phpstan-baseline.neon, alongside .php-cs-fixer.dist.php, .phpcs.xml.dist and phpunit.xml.dist. A baseline file next to an analyser config is where findings already accepted are recorded, and the repository listing offers no count, no date, and no stated policy for shrinking it. That matters the moment you read a project that depends on this library and reports a clean static analysis: the run means the baselined findings are tolerated, not that they are absent. If your dependency policy refuses warnings, this repository is not configured to make that check meaningful on its own, and you would have to open the baseline to learn what you are inheriting. Two neighbours answer narrower questions. SECURITY.md is where vulnerability reporting is defined, and sbom.xml is a software bill of materials for what the release ships.

Editorial conclusion

PhpSpreadsheet fits teams on PHP 8.2 or newer who need to read and write Excel and LibreOffice Calc files in pure PHP and are willing to supply their own feature knowledge. Note that the README describes master as maintained for security and bug fixes, while also directing new features to master, and that some in-depth feature articles appear on Patreon six months before the public documentation. Before adopting, pin a major line deliberately, read composer.json for the requirements the README defers to, and open phpstan-baseline.neon so a clean analysis run means what you think it means.

Frequently asked questions

Official sources

1. License: MIT
2. PHPOffice/PhpSpreadsheet on GitHub
3. Project website
4. README
5. Releases