SecurityAdvisories VS Serializer

To reduce the chance of introducing vulnerable dependencies into your projects, you can use tools such as "Roave Security Advisories" (roave/security-advisories).

In order to avoid accepting third-party code with well-known security issues you can take advantage of SecurityAdvisories by Roave, a library which uses conflict as shown in this article to block unsafe packages. Give it a look!

roave/security-advisories: Security advisories as a simple composer exclusion list, updated daily

Every composer user should use at least https://github.com/Roave/SecurityAdvisories

Making a class "final" is always a bad decision IMO. You would never know how will other people use your library. For example, we used JMSSerializerBundle and wanted to extend DateHandler to make it not to throw exceptions if a date string is invalid. But the class is final. So we had to just copy-paste it :(

Or this popular alternative: https://jmsyst.com/libs/serializer

JMS Serializer: This library allows you to (de-)serialize data of any complexity. Currently, it supports XML and JSON.

Only took a very brief look, but it looks nice. I like that the DTO class isn't required to extend anything, and that it seems to be for real DTOs used for actual transfer of data between systems - not 'local dtos'. It feels like this might be more comparable to something like schmittjoh/serializer rather than spatie/data-transfer-object.

When it's time to create the PDF, convert the object structure to an XML using an already existing serializer (like JMS or symfony serializer) or do this by hand.

One frequently used serializer is JMS Serializer which allows you to convert JSON or XML to objects (or the other way around if needed). You can then use the objects in your application.