PHP 8 minimum Requirement?

[Moshe1010]

Seems like PHP 7 is going EOL on November 28, which is two weeks from now.

PHP: Supported Versions

www.php.net

 

[Nicolas FR]

PHP 8.0 is recommended since XF 2.2.5

XenForo 2.2.5 and Importers 1.5.0 Released

XenForo 2.2.5 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability. This release changes the default CAPTCHA method from reCAPTCHA to hCaptcha. If...

xenforo.com

 

[Moshe1010]

PHP 8.0 is recommended since XF 2.2.5

XenForo 2.2.5 and Importers 1.5.0 Released

XenForo 2.2.5 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability. This release changes the default CAPTCHA method from reCAPTCHA to hCaptcha. If...

xenforo.com

Recommended is not required

 

[Chris D]

The minimum requirement for XF 2.3 will be PHP 7.2.5.

PHP 7.x is still very prevalent among customers.

It doesn’t really matter what versions are EOL. This doesn’t dictate what our minimum requirement is.

If you’re a developer and you wish to impose a higher PHP requirement tor add-ons then you can feel free to do so.

 

[Moshe1010]

The minimum requirement for XF 2.3 will be PHP 7.2.5.

PHP 7.x is still very prevalent among customers.

It doesn’t really matter what versions are EOL. This doesn’t dictate what our minimum requirement is.

If you’re a developer and you wish to impose a higher PHP requirement tor add-ons then you can feel free to do so.

If security updates aren't initiated, isn't that a security risk to keep system on PHP 7?

 

[Mendalla]

If security updates aren't initiated, isn't that a security risk to keep system on PHP 7?

It's a security risk for the admin, not XF. As long as XF can write secure code that works on a supported version of PHP they have done their job. The rest is on the admin. There's no onus on XF to force the issue and some people may still need time to get their PHP upgraded, esp. if they have custom (vs. off-the-rack) add-ons that need updating. After all, a lot of current Windows software still works on 7 and 8, even if they are no longer supported and using them is like painting a bullseye on your back unless you run them completely offline.

 

[Moshe1010]

It's a security risk for the admin, not XF. As long as XF can write secure code that works on a supported version of PHP they have done their job. The rest is on the admin. There's no onus on XF to force the issue and some people may still need time to get their PHP upgraded, esp. if they have custom (vs. off-the-rack) add-ons that need updating. After all, a lot of current Windows software still works on 7 and 8, even if they are no longer supported and using them is like painting a bullseye on your back unless you run them completely offline.

If it’s a security risk for the admin, it’s a security risk for the user as well since the user keeps his/her data at admin’s possession.

Anyway I just noticed that IPB set PHP 8 as the minimum requirement. I think XF should follow, but it’s tour choice at the end of the day.

 

[Paul B]

Setting the minimum PHP version to 8 would rule out thousands of customers from being able to upgrade unless they switched hosting providers.

That's not something we would do.

 

[Forsaken]

If it’s a security risk for the admin, it’s a security risk for the user as well since the user keeps his/her data at admin’s possession.

Anyway I just noticed that IPB set PHP 8 as the minimum requirement. I think XF should follow, but it’s tour choice at the end of the day.

IPB has been pushing people towards their cloud services, and hosted instances are no longer their primary focus or customer base.

The issue is not as big a problem as you are making it either.

 

[TPerry]

Anyway I just noticed that IPB set PHP 8 as the minimum requirement. I think XF should follow, but it’s tour choice at the end of the day.

Errr.... I wouldn't put a WHOLE lot of weight into what IPB requires..... In fact, they would MUCH rather you convert your site over to their cloud service.
As long as the OS developers support older PHP versions (which RedHat/CentOS/Ubuntu) tend to do, then why worry about an arbitrary "drop dead" date by PHP.ORG developers. As long as the code line repositories are kept fresh and secure by the OS developers, that is MORE important. Realistically, how many admins do you think ACTUALLY go out and add the "official" PHP repository to their list of where to get the latest PHP installs from. From my experience with helping other admins that run a VPS or a dedicated server.. then tend to use the default repositories.

If it’s a security risk for the admin, it’s a security risk for the user as well since the user keeps his/her data at admin’s possession.

No it's not.. if you have the "gumption" to run your own server, then the presumption is that you know how to do so.
As I said above... for certain OS installs... PHP will be "updated" with security fixes even if it may be considered EOL by the developers at PHP.ORG. If you, as an admin, can't be troubled to make sure your hosting provider is meeting minimum standards, then maybe you need to hire an admin that knows what he's doing... or simply give up and go to a cloud solution. If you are on shared hosting, then it is INCUMBENT upon YOU as an admin to make sure they meet minimum standards. To often, what is "required" is that they meet "minimum costs".