Re: Removing PHP 5.6?

[Stephen Borrill <netbsd%precedence.co.uk@localhost>]

On Mon, 26 Oct 2026, Thomas Klausner wrote:
> In the last days, a couple major PHP vulnerability was publicized:
>
> Informational advisory: Session upload progress
> https://www.php.net/archive/2026.php#2026-10-23-1
>
> Security advisory: Critical remote code execution vulnerabilities, update now
> https://www.php.net/archive/2026.php#2026-10-21-5
>
> This made me think if we should finally de-support PHP 5.6 in pkgsrc
> (for which no upstream patches are available for these problems).

There are backported patches (e.g. in Debian):
https://codeberg.org/oerdnj/deb.sury.org/issues/145#issuecomment-26053535

> php 5.6 was desupported upstream on 2018/12/31, more than 7 years ago.
>
> The packages in pkgsrc that only support PHP 5.6 are:

[trim]
> databases/php-mssql
> databases/php-mysql
> security/php-mcrypt

There is still legacy code requiring these extensions. They were removed 
after 5.6 so any code using them requires substantial rewrites.

PHP 5.6 still builds on -9 onwards. I propose we keep it until it is 
unbuildable.

--
Stephen