Upgrade to CI4 for security?

Firstly, I want to express my gratitude to all the individuals involved in the development of the CodeIgniter framework – it's truly outstanding.

We've relied on it for five years to build our Marketplace (with two full-time developers). We began with CI2 and later upgraded to CI3. Monthly, we incorporate new features into our Marketplace, and we now have a developer almost entirely dedicated to it. This context is important to comprehend the complexity of our Marketplace, which also offers Saas features to our users.

Given the critical importance of security in a Marketplace/SaaS, we had plans to migrate to CI4 and PHP 8 (currently on PHP 7.3). Unfortunately, the transition from CI3 to CI4 is a monumental task – it's essentially an application rewrite. I must admit, I felt quite disheartened when I learned that we had to rewrite our app to stay up-to-date and secure.

Now, I see two options:

Upgrade to CI4 to maintain security and accommodate new features. Realistically, I anticipate it will take us 18 months to rewrite everything. I'm also contemplating a migration to Laravel, as it appears to be managed in a more "professional" manner (apologies if this offends anyone). We're investing a significant amount in development, so I want assurance that the framework will continue to be well-maintained in the next 3-5 years.

Remain on CI3 for a few years, but then we'll have to cease adding new features because we know we'll have to rewrite everything in 2-3 years. This doesn't seem like a good return on investment. I'm not even certain if we can stay on CI3 while upgrading to PHP8, as there has been no communication regarding whether CI3 will support PHP8.

To provide some background, I'm not a developer, but I dabble in coding occasionally to assist our developers when necessary, and I like to challenge them.

Any advice or perspectives would be greatly appreciated.

Many thanks!

@kenjis, has created a helper to make it easy to upgrade from CI 3 to CI 4.

CodeIgniter 3 to 4 Upgrade Helper

What did you Try? What did you Get? What did you Expect?

Joined CodeIgniter Community 2009.  ( Skype: insitfx )

Well, in my opinion and based on experience, I don't think it will take you up to 18 months to migrate your application from CI3 to CI4.
Yes, CI4 is a complete rewrite, but it doesn't change the business logic you already have in place in your application.

Here's what I'll advise:
* Study the CI3 to CI4 upgrade guide
* Study the CI4 documentation
* Implement your current business logic in the CI4 way.

Those are the steps I took to migrate an app with over 80k users from CI3 to CI4, and it didn't take up to a month.
The most important thing is to know how to achieve the features you have in your current CI3 application, using CI4, and the docs are very helpful.