Drupal 7 currently supports PHP 5.3 up to PHP 7.4 (although patches are not always tested on every version in between).

As we consider support for PHP 8 (and MySQL 8) and the newly extended EOL, is it time that we dropped support for older PHP versions?

Perhaps that would mean dropping support for anything before PHP 5.6

It's burdensome for d.o to maintain the infrastructure for testing on versions as old as PHP 5.3, and it's not ideal if maintaining backwards compatibility with such old versions generates extra work - and possibly compromises elegant solutions - in issues such as #2978575: Mysql 8 Support on Drupal 7.

Are there any good stats available to show how many D7 sites still run on older versions?

PHP 5.3 itself was EOL a long time ago, but there are probably linux distros which support it (Centos/RHEL 6 maybe?)

Comments

mcdruid created an issue. See original summary.

mcdruid’s picture

mcdruid commented

I should mention that we'd still retain the old array() syntax and try not to introduce things that we know would cause problems on older versions, but the idea would be we'd stop testing every patch on e.g. PHP 5.3

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented

RHEL 6 still officially supports PHP 5.3 but even that is finally end of life in November 2020. However, RHEL 7 ships with PHP 5.4 and that is not EOL until June 2024.

It would be nice if we could send back PHP version via update.module but obviously too late for that in D7.

ayesh’s picture

ayesh commented

I imagine if we were to set a higher PHP version, people will start to send patches to make use of PHP 5.2..5.6 changes (such as __DIR__ instead of dirname(__FILE__)), which will add a lot of maintenance burden.

I'd vote with both hands to drop PHP 5.3 just to have the lambda functions for the MySQL 8 fix. With the remaining time for Drupal 7, I don't personally think the potential hassle of upgrading the code is not worth it.

mcdruid’s picture

mcdruid commented

https://core.trac.wordpress.org/ticket/51043

...is an interesting and relevant discussion.

Obviously WP works quite differently to Drupal in terms of upgrade paths and BC, so there's no direct comparison.

As far as I'm aware we don't have the sort of detailed telemetry that the WP project seems to have about the PHP versions in use, which is a shame (as @longwave mentioned in #3).

My feeling is that it's hard to justify testing every change against e.g. PHP 5.3

Having to (test on and) support every PHP version from 5.3 up to the latest releases does not seem feasible with the limited resources available.

The fact that at least one linux distro is still backporting security fixes to an ancient version of PHP doesn't necessarily mean D7 needs to continue supporting that version.

Personally, I'd vote for dropping active support for everything before PHP 5.6 (by which I mean something like "we'll stop testing on anything earlier, but will not deliberately introduce obviously BC-breaking changes - e.g. we keep the old array syntax etc..")

mcdruid’s picture

mcdruid commented

#3355216: Fix regression caused by ::class constant was a regression in early PHP 5.x versions caused by a change made in https://www.drupal.org/sa-core-2023-005

We're doing a hotfix release for that issue, but I think it's a good illustration that supporting the really old PHP versions is not sustainable.

Without going into too much detail, the process for testing private security patches is different to public issues and it's considerably more laborious (if it's possible at all) to test on every possible PHP version.

I don't think there's a compelling business case for the DA to expend resources on maintaining / improving the testing infrastructure for e.g. PHP versions before 5.6

In https://dri.es/the-end-of-php-5 (November 2018) Dries actually stated that:

Drupal 7 will drop support for older versions of PHP 5 on December 31st, but will continue to support PHP 5.6 ...

Without digging into it too much, that doesn't seem to have happened but it was probably a good plan.

I propose that we put that into action now and officially withdraw support for everything before PHP 5.6

In practice we will not do anything to actively break D7 on earlier PHP versions; this change would really just be recognising the fact that it's not feasible to thoroughly test every patch on all versions from PHP 5.3 up to the latest releases.

Any D7 sites still running on really old PHP versions should update to a more modern supported version as soon as possible.

Dave_Martin’s picture

Dave_Martin commented

IMO you shouldn't be supporting anything older than PHP 7.4 at this point given that that is the oldest version of PHP that is still supported. By the end of the year, 2023, only PHP 8.0 and above should be supported. There are far too many known vulnerabilities in older versions of PHP for people to continue to use them.

solideogloria’s picture

solideogloria commented

I agree that versions before PHP 5.6 should not be supported. For reference, PHP 5.6 was released in August of 2014.

j_s’s picture

j_s commented

Comments from #7 and #8 are valid in most cases, but #3 notes that the enterprise Linux distribution RHEL 7 will continue to support and make security backports to 5.4 through its EoL in June 2024. That means there are very likely going to be enterprise business use cases that can and will use this patched 5.4 version for another year. People on that distribution could use Software Collections to update, but SC is not directly supported by Red Hat, leading to the business decision to stick with 5.4.

But this is just to point out that there can and will be groups that may not be in a position to upgrade regardless of the commented recommendations/concerns.

I don't really have an opinion, but if Drupal wants/needs to drop support of older versions due to lack of 'resources', that sounds like a fine plan. As long as it's communicated as effectively as possible so as to not blindside people like with the regression introduced in 7.96, it could prompt people on lingering versions to update in some way, contribute a patch for anyone still interested, or migrate to another CMS/platform.

solideogloria’s picture

solideogloria commented

It should also be noted that support for Drupal 7 itself is going to be dropped at some point. So does it make sense to drop PHP support earlier than dropping D7 support?

poker10’s picture

poker10 commented

Linking the new PSA also here: https://www.drupal.org/psa-2023-06-07

This means that we are going to drop support of PHP 5.5 and below from August 2023. This does not mean that we are going to introduce incompatible changes with these old PHP versions intentionally. But keep in mind that there will be no automated testing on these old PHP versions anymore.

poker10’s picture

poker10 commented

I have created a child issue: #3379524: Update PHP requirements for D7 according to the PSA-2023-06-07 to handle all changes mentioned by the PSA-2023-06-07.

Status: Active » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.