Why do you need it to support V4?

I am trying to find some workaround to have better validation with pact-specification v4 The situation : Our app is written in PHP. We, as company wanna implement Bi-directional Contract Testing. Pact-php 10.0.0 is compatible with Pact-specification v4 but it requires FFI. As a policy, we do not wanna use FFI that's why I am trying to find a workaround. The thing is in my mind is: 1. Providers can publish code-based OSA into Pact broker 2. Consumer can use pact-cypress adepter to test their pacts 3. Finally we can use can-I-deploy feature for safe deployment. how does this idea sound? Is it doable.

Sure, but what does V4 have to do with that? Bi directional works with spec v2-v4 (no benefit to different spec versions)

V4 has more feature including machers

V2 has matchers too. But, Matchers aren't used in bdct though

some security concerns and heavy re-testing main image burden

Can you elaborate on those concerns? It's helpful as we think about going forward

Seconding wanting to understand the concerns with the FFI, as it is a rather central element of Pact and its various language SDKs.

just general concern using FFI like potential security vulnerabilities, debugging challenges and comprehensive testing requirements.

I understand that the debugging experience across the FFI boundary is sub-optimal and that is why we have a test suite to try and reduce the bugs that might originate from within the library. Could you elaborate on the "comprehensive testing requirements" you mention? The FFI has an extensive test suite if that is what you're referring to? And it is perfectly possible to write new tests. Lastly, for the security vulnerabilities, anything in particular you're worried about? The source is available, so would your security concerns be alleviated if you compiled the FFI yourself?