Re: Removing PHP 5.6?

[P Gman <patrickgunsolley%gmail.com@localhost>]

Backported patches exist IIRC. I'm not sure if those would be
compatible with pkgsrc philosophy or licensing, etc. Just my 2 cents.

On Mon, Oct 26, 2026 at 2:38 PM Thomas Klausner <wiz%netbsd.org@localhost> wrote:
>
> Hi!
>
> In the last days, a couple major PHP vulnerability was publicized:
>
> Informational advisory: Session upload progress
> https://www.php.net/archive/2026.php#2026-10-23-1
>
> Security advisory: Critical remote code execution vulnerabilities, update now
> https://www.php.net/archive/2026.php#2026-10-21-5
>
> This made me think if we should finally de-support PHP 5.6 in pkgsrc
> (for which no upstream patches are available for these problems).
>
> php 5.6 was desupported upstream on 2018/12/31, more than 7 years ago.
>
> The packages in pkgsrc that only support PHP 5.6 are:
>
> audio/ampache
> converters/php-recode
> databases/pear-MDB2_Driver_mysql
> databases/php-dbx
> databases/php-mongo
> databases/php-mssql
> databases/php-mysql
> databases/php-redis4
> databases/php-rrd1
> devel/php-memcache2
> devel/php-pthreads
> devel/php-raphf
> devel/php-xcache
> finance/magento
> mail/imp
> mail/ingo
> mail/mimp
> mail/turba
> meta-pkgs/php56-extensions
> security/php-mcrypt
> security/php-oauth1
> security/php-ssh2-0
> security/php-suhosin
> sysutils/collectd-CGP
> sysutils/zabbix-frontend
> textproc/php-sphinx
> textproc/php-wddx
> time/kronolith
> www/blur6ex
> www/gallery2
> www/horde
> www/matcha-sns
> www/php-apcu4
> www/php-phalcon
> www/php-phrasea2
> www/php-propro
> www/php-tt-rss
> www/phraseanet
>
> Comments?
>  Thomas