Re: Changing to a more recent-ish PHP_VERSION_DEFAULT ?

[Jean-Yves Migeon <jym%NetBSD.org@localhost>]

Le 09/11/2023 à 01:13, Takahiro Kambe a écrit :
> Hi,

Hey taca@,

> In message <649f8f29-76b6-4e8c-b7b2-f7c1d6512fab%NetBSD.org@localhost>
> 	on Tue, 7 Nov 2023 18:08:03 +0100,
> 	Jean-Yves Migeon <jym%NetBSD.org@localhost> wrote:
> > Version   EOL
> > 8.0 	  26 Nov 2023
> > 8.1 	  25 Nov 2024
> > 8.2 	  8 Dec 2025
> >
> > Any reason not to switch PHP_VERSION_DEFAULT to 8.1 or 8.2?
> No, there is no reason and it should be updated to 8.1 at least.

Alright

> > I admit I am dodging all things PHP-related each time deemed possible,
> > and I am barely using it besides FPM and roundcube (and to some extent
> > davical), but so far I have been running 8.2 on pkgsrc-current without
> > not much hiccup to report
> New version of PHP tends to cause unexpected warning/error, so we need
> to be careful to updating default version.

I know. That is why I am asking, I had a share of these in the past (too 
many to be honest). And my PHP-fu is quite low

My concern is that as 7.4 has been EOL for a bit now, most vulnerability 
reports will ignore that version for CPE version checks, so pkg_admin 
audit might likely not report CVEs that would be otherwise visible for 
8.0 and up

Build breaks are easily caught by bulkbuilds, runtime ones is another 
matter -- do you think I should wait for Q4 and then make the change to 
give it more time? Or proceed anyway?

--
jym@
https://www.NetBSD.org