Removing PHP 5.6?

[Thomas Klausner <wiz%netbsd.org@localhost>]

Hi!

In the last days, a couple major PHP vulnerability was publicized:

Informational advisory: Session upload progress
https://www.php.net/archive/2026.php#2026-10-23-1

Security advisory: Critical remote code execution vulnerabilities, update now
https://www.php.net/archive/2026.php#2026-10-21-5

This made me think if we should finally de-support PHP 5.6 in pkgsrc
(for which no upstream patches are available for these problems).

php 5.6 was desupported upstream on 2018/12/31, more than 7 years ago.

The packages in pkgsrc that only support PHP 5.6 are:

audio/ampache
converters/php-recode
databases/pear-MDB2_Driver_mysql
databases/php-dbx
databases/php-mongo
databases/php-mssql
databases/php-mysql
databases/php-redis4
databases/php-rrd1
devel/php-memcache2
devel/php-pthreads
devel/php-raphf
devel/php-xcache
finance/magento
mail/imp
mail/ingo
mail/mimp
mail/turba
meta-pkgs/php56-extensions
security/php-mcrypt
security/php-oauth1
security/php-ssh2-0
security/php-suhosin
sysutils/collectd-CGP
sysutils/zabbix-frontend
textproc/php-sphinx
textproc/php-wddx
time/kronolith
www/blur6ex
www/gallery2
www/horde
www/matcha-sns
www/php-apcu4
www/php-phalcon
www/php-phrasea2
www/php-propro
www/php-tt-rss
www/phraseanet

Comments?
 Thomas