Not a bug mcrypt_create_iv deprecated in php 7.1

[Mouth]

XF 1.5.14

Re: http://php.net/manual/en/function.mcrypt-create-iv.php

mcrypt_create_iv found within both library/XenForo/Application.php and library/Zend/Filter/Encrypt/Mcrypt.php

 

[Xon]

Xenforo will attempt to use random_bytes (php7+) function before mcrypt_create_iv, same for XF2.

Both only try to call mcrypt_create_iv if it exists.

 

[Mike]

As noted, versions where it's deprecated will never use it. It is needed to help generate secure random numbers in older PHP versions.