Ecosystem and Framework Comparison
|
This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production. The reference material consulted while preparing these pages is listed in the section bibliography. |
This page was written on 2026-10-17 against Vapor 4.122.2 (the latest 4.x release) on Swift 6 (the local toolchain is
Swift 6.4; the
official template needs swift-tools-version 6.3, while Vapor 4.122.2 itself needs 6.0). Vapor 5 is at 5.0.0-beta.4
and is not generally
available, so everything here is about Vapor 4 unless it says otherwise. It contains no Swift code: it is a map. Its
tables hold the
facts that were read from the GitHub API on 2026-10-17 (whether a repository is archived, the date of its latest push
and the
tag and date of its latest GitHub release), plus the comparison with other frameworks and a lookup table from a need
to the package
and to the page of this section that explains it.
Two limits apply to what follows.
-
The status columns say what GitHub reported on the check date. A recent release does not prove that a package is good, and an old one does not prove that it is broken; read the repository, its open issues and its
Package.swift(tools version and platforms) before depending on it. Thepushed_atdate also moves for reasons such as a bot updating a workflow file, so the tables give the date of the latest release as well. -
The comparison with other frameworks is a description of design, not a benchmark. No performance claim is made, and no numbers were measured for this page. The versions of the other frameworks are not repeated here; their own sections on this site state them.
How the Vapor ecosystem is organised
Four groups publish packages that a Vapor application uses:
-
vapor (https://github.com/vapor) — the framework itself and the packages that the Vapor team maintains: vapor/vapor, the Fluent family, Leaf, Redis, Queues, JWT, APNS and their kits. The versions are in the closing section of each page of this section.
-
vapor-community (https://github.com/vapor-community) — an organisation for packages that the community maintains under the Vapor name. It holds a lot of repositories that have not been touched for years (Vapor 1 to 3 providers), so every package taken from there needs the date check this page performs.
-
Swift Server Workgroup (SSWG) and Apple packages — SwiftNIO, swift-log, swift-metrics, swift-distributed-tracing, AsyncHTTPClient, swift-service-lifecycle, swift-configuration, swift-openapi-generator and swift-crypto. Vapor builds on these and they are shared with every other Swift server framework; see Introduction & Architecture.
-
Independent maintainers — Soto, MongoKitten, Graphiti, APNSwift, VaporSecurityHeaders and similar. Vapor documents some of them, but a Vapor release does not wait for them.
A Fluent or Leaf package that is not yet compatible with Vapor 5 will not resolve next to it, and several community packages declare a dependency on Vapor 4; check the dependency range before planning a move, as described in What’s New, Upgrading and Vapor 5.
Package landscape and maintenance status
Checked on 2026-10-17 with gh api repos/<owner>/<repo> and gh api repos/<owner>/<repo>/releases/latest. "Pushed"
is the date
of the last push to any branch; "release" is the latest GitHub release. "Archived" is the GitHub flag.
Authentication, security and web
| Package | Archived | Pushed | Latest release | Notes |
|---|---|---|---|---|
vapor/jwt and jwt-kit |
no |
2026-08-18 |
5.1.2 (2025-01-07) |
Official. The kit has its own releases (jwt-kit 5.7.1 at the time of checking). Covered in JSON Web Tokens. |
no |
2025-10-10 |
2.2.0 (2025-10-10) |
OAuth 2 login with providers such as GitHub and Google. Used on OAuth and Sign in with Apple as one option next to the identity-token verifiers of jwt-kit. |
|
no |
2024-11-03 |
4.2.0 (2024-11-03) |
Security-header middleware, maintained by a company, not by the Vapor team. Used on Security Hardening, where a hand-written middleware is shown as the alternative. |
|
no |
2026-10-14 |
0.7.13 (2026-10-14) |
An authentication package in the community organisation. It is pre-1.0 and was not evaluated for this section; the entry only records that it exists and is active. |
|
no |
2026-09-23 |
26.1.0 (2026-03-10) |
A Stripe API client. The older vapor-community/stripe wrapper last released 15.0.0 in 2023-01 and was last pushed in 2023-08; prefer the kit if you need Stripe. Not evaluated beyond its dates. |
Email, templates and HTML
| Package | Archived | Pushed | Latest release | Notes |
|---|---|---|---|---|
no |
2026-08-19 |
6.1.0 (2026-08-19) |
Vapor service for Mailgun. See Sending Email. |
|
no |
2025-05-17 |
3.1.0 (2025-05-17) |
Framework-independent SendGrid client, the one used on the email page. The wrapper vapor-community/sendgrid is at 6.0.0 (2025-02-01). |
|
vapor/leaf and leaf-kit |
no |
2026-07-17 (leaf) |
4.5.2 (2026-06-27); leaf-kit 1.14.3 (2026-07-23) |
Official template language. See Leaf Templates. |
no |
2026-07-17 |
0.2.2 (2025-12-08) |
Integration of the Elementary type-safe HTML library; pre-1.0. See Leaf Custom Tags and HTML DSLs. |
|
no |
2026-10-08 |
2.8.1 (2022-11-27) |
A type-safe HTML DSL. Pushes are recent but the latest release is from 2022; judge it by the branch you would depend on. |
Queues, caches and databases
| Package | Archived | Pushed | Latest release | Notes |
|---|---|---|---|---|
no |
2026-07-17 |
1.18.0 (2026-03-07) |
Official queue and scheduled-job API. See Queues & Background Jobs and Scheduled Jobs. |
|
no |
2026-07-17 |
1.1.2 (2024-09-19) |
The official Redis driver for Queues. |
|
no |
2026-01-07 |
3.2.0 (2026-01-07) |
Queues driver that stores jobs in a SQL table. It is the maintained successor of m-barthelemy/vapor-queues-fluent-driver, which GitHub reports as archived (last release 3.0.0-beta1, 2022-09-04). |
|
no |
2026-03-05 |
1.2.0 (2026-03-05) |
A Queues driver for Valkey, the Redis fork, on the vapor-community/valkey client (1.2.0, 2026-03-04). Not evaluated beyond its dates. |
|
no |
2023-01-07 |
1.0.3 (2021-01-23) |
Listed in the Vapor documentation, but there has been no push since January 2023. Verify it before use. |
|
no |
2026-07-17 |
4.14.0 (2025-09-12) |
Official Redis client integration (RediStack). See Redis & Caching. |
|
no |
2026-05-20 |
7.16.3 (2026-05-20) |
Independent pure-Swift MongoDB driver, with its own Vapor integration; the other route is fluent-mongo-driver (1.4.0 at the time of checking). See MongoDB. |
|
no |
2026-10-16 |
7.17.0 (2026-10-01) |
The AWS SDK for Swift server code (S3, SQS and the other services), independent of Vapor. Used for object storage on File Uploads and Streaming. |
APIs, push notifications and observability
| Package | Archived | Pushed | Latest release | Notes |
|---|---|---|---|---|
no |
2026-10-16 |
1.14.1 (2026-10-14) |
Spec-first OpenAPI code generation. See OpenAPI with swift-openapi-generator. |
|
no |
2026-10-15 |
2.0.0-beta.1 (2026-10-15); latest 1.x is 1.2.0 (2026-09-02) |
The Vapor transport for the generator. The repository was under swift-server earlier and old links redirect. Use 1.x with Vapor 4 and treat 2.0.0-beta.1 as a beta. |
|
no |
2026-04-06 |
3.1.0 (2026-02-07) |
A type-safe schema library on top of GraphQLSwift/GraphQL (4.3.0, 2026-09-30). Independent of Vapor: you would call its executor from a route yourself. No page of this section builds a GraphQL API, and no Graphiti code was compiled for this page. |
|
no |
2026-10-09 |
5.1.0 (2026-10-08) |
Official integration of APNSwift (swift-server-community/APNSwift, which GitHub reports under kylebrowning/APNSwift; 7.1.0, 2026-10-16). See APNs Push Notifications. |
|
no |
2026-10-16 |
1.6.0 (2026-10-16) |
OpenTelemetry exporter for swift-log, swift-metrics and swift-distributed-tracing. See Tracing, Metrics & OpenTelemetry. |
|
no |
2026-10-14 |
2.3.0 (2026-02-16) |
Prometheus backend for swift-metrics, covered on the same page. |
|
no |
2026-10-07 |
1.36.2 (2026-09-25) |
The HTTP client behind |
Not found or not recommended
Some packages that books and blog posts mention could not be confirmed on 2026-10-17:
-
ml-archive/gatekeeper, the rate-limiting middleware, is archived; the alternatives are in Security Hardening. -
vapor-community/postgresql is archived (last release 2.2.0, 2020-05-18), and many Vapor 1 to 3 providers in the same organisation (for example
mysql-provider,fluent-provider,jwt-provider,leaf-provider) have had no push since 2016 to 2019. They belong to the Droplet era; see What’s New, Upgrading and Vapor 5. -
Repository names such as
vapor-community/vapor-oauth,vapor-community/vapor-sesandvapor-community/sentryreturned "not found" from the GitHub API under those exact names. They may have moved or never existed under that name; this page does not recommend them, and the status of Sentry or Amazon SES integrations was not verified.
Vapor and Hummingbird 2
Hummingbird is the main alternative among Swift server frameworks. On 2026-10-17
hummingbird-project/hummingbird
was not archived, its latest release was 2.28.0 (2026-10-13), the previous ones 2.27.1 (2026-10-09) and 2.27.0
(2026-09-21), and its
Package.swift declared swift-tools-version:6.2. Two companion packages in the same organisation were also active:
hummingbird-auth 2.5.0 (2026-09-27) and hummingbird-fluent 2.0.0 (2025-01-10, which lets Hummingbird use Fluent).
| Aspect | Vapor 4.122 | Hummingbird 2.28 |
|---|---|---|
Shape |
Batteries included: routing, Content, validation, sessions, authentication helpers, commands, a test helper and an application lifecycle in the one package, with Fluent, Leaf, Queues and Redis as sibling packages. |
A small core (router, middleware, server, request context) and separate packages for authentication, Fluent, WebSocket, and so on. You assemble what you need. |
Concurrency |
SwiftNIO under an async/await API; |
SwiftNIO and structured concurrency; the HTTP server is built to run as a swift-service-lifecycle service. |
Per-request state |
The |
A generic request context type that you define, with the data a handler needs. |
Data access |
Fluent, with SQLKit underneath, is the default and is documented as part of the framework. |
You choose: hummingbird-fluent, or a database driver such as PostgresNIO, directly. |
Documentation and books |
The most documentation, books (the three consulted for this section) and community packages in Swift server development. |
Its own official documentation; fewer books were found and fewer third-party integrations are listed in this section. |
Next major |
5.0.0-beta.4, not generally available (see What’s New, Upgrading and Vapor 5). |
Version 2 is the current major. |
The rows describe design as documented by the two projects and as seen in their repositories; no benchmark was run.
Both are built on
SwiftNIO and the SSWG libraries, so many packages (AsyncHTTPClient, swift-log, swift-otel, Soto, MongoKitten,
swift-openapi-generator,
APNSwift) work with either. Choose Vapor for an integrated stack with a large body of tutorials; consider Hummingbird
for a small
service or when you want to choose each piece. Neither choice is irreversible: handlers written against Content,
services behind
protocols and a separate data layer move more easily, as discussed in
Services, Storage and Dependency Injection.
Kitura and Perfect: history
Kitura (originally from IBM) and Perfect (PerfectlySoft) were the other early Swift server frameworks, from the Swift 2 and 3 era. The Yeung book is the one consulted for this section that uses Kitura 2.5 next to Vapor 3. Neither is marked archived on GitHub, but both are dormant:
| Framework | Archived flag | Last release | Last commit on the default branch (2026-10-17) |
|---|---|---|---|
no |
3.0.0 (2022-09-18) |
2022-10-07, "Update Kitura-NIO to 3.1.1 to better support OpenSSL3". The repository’s |
|
no |
v1.0.0 (2016-03-21); the tags include 4.0.1 |
2021-02-08, a merged pull request about Apple M1 build issues. The repository’s |
This section documents no Kitura or Perfect code. Do not start a new project on either; read about them only to understand the books of that period. The Kitura and Perfect chapters of the Yeung book, and its Vapor 3 chapters, are covered by the "where the books are outdated" tables of the pages of this section.
Vapor and other backend frameworks
The sections of this site on Axum, NestJS, FastAPI, Laravel and Spring Boot describe those frameworks in depth. The table puts their design next to Vapor’s. It compares the way each framework is built, not speed, and it does not repeat their version numbers, which the linked sections state.
| Aspect | Vapor (Swift) | Axum (Rust) | NestJS (TypeScript) | FastAPI (Python) | Laravel (PHP) | Spring Boot (Java) |
|---|---|---|---|---|---|---|
Style |
Integrated framework with sibling packages (Fluent, Leaf, Queues) |
Small router library on Tokio and tower; you add crates |
Opinionated framework with modules, controllers and providers |
Small framework over Starlette and Pydantic |
Full-stack, convention-based framework |
Full-stack platform of starters and auto-configuration |
Route handlers |
Closures or controller methods taking a |
Async functions with extractors in the parameters |
Controller methods with decorators |
Async or sync functions with type-hinted parameters |
Controller methods or closures |
|
Dependency injection |
No container; services are stored on |
No container; shared state through |
A container with providers and module scoping |
|
A service container |
A container (beans) with annotations |
Validation and input |
|
Extractors with serde; validation through a crate |
Pipes with class-validator or similar |
Pydantic models, built in |
Form requests and validation rules |
Bean Validation annotations |
Database access |
Fluent ORM ( |
sqlx or another crate; no built-in ORM |
TypeORM, Prisma or others, through modules |
SQLAlchemy or SQLModel, your choice |
Eloquent ORM, query builder, migrations |
Spring Data JPA, JDBC, Hibernate |
Templates |
Leaf, or a Swift HTML DSL |
A templating crate of your choice |
A template engine of your choice |
Jinja2, if you want server rendering |
Blade |
Thymeleaf or another engine |
OpenAPI |
Spec-first: swift-openapi-generator generates types and handlers from a document |
Code-first crates such as utoipa |
|
Generated automatically from type hints |
Packages |
springdoc-openapi or the spec-first generator |
Background jobs |
Queues with Redis, Fluent or other drivers; scheduled jobs |
A crate, or tokio tasks |
Bull or BullMQ through a module, scheduling module |
Celery, ARQ or background tasks |
Queues, scheduler and Horizon |
Spring Batch, |
Concurrency model |
SwiftNIO event loops with async/await and Swift 6 data-race safety ( |
Tokio async runtime; ownership and borrowing enforced by the compiler |
Node.js single-threaded event loop |
asyncio with ASGI, plus thread pool for sync functions |
Process or worker per request under PHP-FPM, or a long-lived server such as Octane |
Thread per request, or virtual threads and WebFlux |
Deployment unit |
A native executable per platform, usually a Docker image or systemd service |
A native executable |
A Node.js process |
A Python process under an ASGI server |
PHP code under FPM or a worker server |
A JAR or native image on the JVM |
When Vapor is a good fit: you want one language across an iOS or macOS client and the backend and can share model types (see Full-Stack Swift with iOS Clients); you want strong typing with a compiler that checks data-race safety; the team already writes Swift. When it is not: you need the larger hiring pool, library choice and operational experience that the Java, JavaScript and Python ecosystems offer, or integrations that only have a Java, PHP or Node client. These are judgements, not measurements.
A broader comparison of backend and web frameworks across all the languages of this site is planned in issue #263; this table covers only the five frameworks named above.
Which package to use for what
Each row names the package or the framework feature, and the page of this section that covers it. "Built in" means that vapor/vapor itself provides it.
| Need | Use | Page |
|---|---|---|
Routing, route groups, parameters |
Built in (routing-kit) |
|
Request and response bodies, JSON, query strings |
Built in ( |
|
Input validation |
Built in ( |
|
Middleware, CORS, error responses |
Built in |
|
Dependency injection and shared state |
Built in ( |
|
Configuration, environment, secrets |
Built in ( |
|
SQL database through an ORM |
Fluent with the PostgreSQL, MySQL or SQLite driver |
Fluent Overview and Database Drivers, Fluent Models, Fluent Relations, Fluent Queries and Pagination, Migrations & Schema and Transactions, Model Middleware & Soft Delete |
Hand-written SQL |
SQLKit |
|
MongoDB |
fluent-mongo-driver, or MongoKitten |
|
Redis, caching, rate-limit counters |
vapor/redis; the cache API built into Vapor |
|
Background jobs and scheduled jobs |
vapor/queues with the Redis driver or the community Fluent driver |
|
Password hashing, cryptography |
Built in (bcrypt) and swift-crypto |
|
Login for a user: sessions and cookies |
Built in sessions and authenticators |
Sessions and Cookies, Session Authentication and Web Login and Authentication |
API tokens stored in a database |
Fluent tokens and authenticators |
|
JSON Web Tokens |
vapor/jwt (jwt-kit) |
|
Social login, Sign in with Apple |
jwt-kit identity-token verifiers, or Imperial |
|
Roles and permissions |
Built in (authenticators and guards) |
|
Security headers, CSRF, rate limits |
A middleware you write, or VaporSecurityHeaders |
|
Server-side HTML |
Leaf, or Elementary or another HTML DSL |
Leaf Templates, Leaf Custom Tags and HTML DSLs and Server-Rendered Web Apps and Forms |
Static files |
Built in ( |
|
File uploads, object storage such as S3 |
Built in (multipart-kit); Soto for AWS |
|
WebSockets |
Built in (websocket-kit) |
|
Server-sent events |
Built in streaming responses |
|
Calling other HTTP services |
Built in |
|
Transactional email |
sendgrid-kit, Mailgun or SMTP behind your own protocol |
|
Apple push notifications |
vapor/apns (APNSwift) |
|
OpenAPI documents and generated clients |
swift-openapi-generator with swift-openapi-vapor |
OpenAPI with swift-openapi-generator and API Design, Versioning and DTOs |
GraphQL |
Graphiti on GraphQL (independent; not covered by a page here) |
The package table above; the GraphQL section of this site covers the protocol itself |
Logging |
swift-log (built in) |
|
Traces, metrics, OpenTelemetry |
swift-distributed-tracing, swift-metrics, swift-prometheus and swift-otel |
|
Command-line tasks |
Built in (console-kit commands) |
|
Tests |
VaporTesting with Swift Testing |
|
Server and HTTP settings, TLS, HTTP/2 |
Built in ( |
|
Packaging and containers |
Docker multi-stage build; systemd or other targets |
|
Tuning a production service |
Built-in settings and the observability packages |
|
Several services behind a gateway |
Vapor services and |
|
Concurrency and Sendable |
Swift language features |
|
Project layout and SwiftPM targets |
Swift Package Manager |
|
Application start-up and shutdown |
Built in ( |
A checklist for adding a dependency
-
Open the repository and note whether it is archived and the date of the latest release; a package that has not changed in three years may still be fine if it is small, but you own that decision.
-
Read
Package.swiftfor the swift-tools-version and the platforms. A tools version of 5.x compiles as Swift 5 code, which does not get the Swift 6 data-race checks in your build for that target. -
Check which Vapor major it depends on. A dependency on Vapor 4 will not resolve with Vapor 5.
-
Pin it with
from:orexact:and let Dependabot or a manualswift package updatereview the changes; see Security Hardening. -
Put it behind a protocol of your own when it is a service you may replace (email, push, storage), as the pages for email and Apple push notifications do.
What could not be verified
-
Whether the packages marked "not evaluated" work with Vapor 4.122.2 on Swift 6. Only their GitHub status was read.
-
The GitHub status of repositories whose exact names could not be found (see "Not found or not recommended").
-
No benchmark and no feature count of the other frameworks was taken; the framework table reflects design, not measured behaviour.
-
The Kitura and Perfect dates come from the GitHub API on 2026-10-17 and may differ on other branches.
References
-
hummingbird-project/hummingbird and Hummingbird documentation
-
Soto, MongoKitten and Graphiti
-
GitHub REST API (used for the maintenance data)
-
Packt: Hands-On Server-Side Web Development with Swift (Yeung, chapter 1)