Deprecation of php7.3

[ChristophWurst]

Continuation of #19341

php7.3 will run out of security support end of year. So I assume Nextcloud 23 will still support it but for 24 it makes no sense.

Should Nextcloud 23 warn that it's the last version to support 7.3? We did that for previous releases.

Ref https://www.php.net/supported-versions.php

cc @skjnldsv @nickvergessen @juliushaertl

[juliusknorr]

I'm all in for dropping 7.3 with 24 and showing a warning on 23 👍

Distributions seem to have widely adopted 7.4 from the official packages with the latest releases according to https://pkgs.org/download/php. From older release we would basically only loose support for Debian 10 which is still on 7.3. But of course there are 3rdparty repo options like https://deb.sury.org/ or https://rpms.remirepo.net/.

[ChristophWurst]

Deprecation in 23: #29285
Removal in 24: #29286

[MichaIng]

I'm against this. PHP7.3 is still the default PHP version on long supported distro versions, like Debian Buster, which was the latest stable Debian just until 2 months ago, so it is still widely used, with LTS support until 2024 and ELTS until 2026 approx. They backport security patches from upstream, so upstream PHP EOL != distro PHP EOL.

IMHO more important than upstream EOL dates is the question whether Nextcloud would benefit significantly from dropping older PHP version support, e.g. is there a syntax or functions available which we want to use and which are complicated to use only when available?

[ChristophWurst]

Nextcloud 23 will be actively supported for everyone until something like December 2023. You can use PHP7.3 until then.

[MichaIng]

It can all be dealt with, but means additional checks and pinned Nextcloud versions for all implementations which still want to support Debian Buster (and alike). Or users go with deb.sury.org and then wonder why they suddenly have multiple PHP versions installed or the old one removed (breaking webserver access) when a new default version is available in this repo. We had all sorts of issues when Nextcloud dropped support for PHP7.0 while Debian Stretch (which ships it) was still the latest stable Debian. So it adds a burden to inexperienced users and Nextcloud appliance/installer maintainers.

I understand that at some point support for old versions needs to be dropped, as fast as it becomes a burden for you guys to keep up support or when it implies actual downsides, e.g. when newer features or syntax cannot be used. I'm just suggesting to make those two points the major reasons for dropping support, instead of the upstream EOL date only 🙂. I see PR got merged, but probably an opinion/point to keep in mind when it's about whether to make Nextcloud PHP8+ only.

[ChristophWurst]

I checked some stats. Looks like roughly 2% of Nextcloud installations use 7.2, 15% use 7.3, 60% use 7.4 and 25% use 8.0.

From today's view we can't know how well 7.3 will phase out. But it will be at least five more months until Nextcloud 24 will hit production.

There are indeed many reasons why we try to get rid of older php versions. Security is one but obviously the new language features are another. Php7.4 will allow us typed properties, which will up our code quality quite a bit. Even more exciting are the arrow functions. We can write much more expressive functional code without the quirks of the old function syntax. More info at https://medium.com/@daniel.dan/whats-new-in-php-7-4-top-10-features-that-you-need-to-know-e0acc3191f0a.

Generally speaking it's how we've also handled other outdated php versions in the past, so this process isn't new. We rather had severe issues when new versions came out that we didn't yet support, like #29287.

[MichaIng]

Many thanks for showing theses stats and arguments, looks like it's worth it.

Generally speaking it's how we've also handled other outdated php versions in the past, so this process isn't new.

This is why I mentioned that exactly this caused us quite some short and long term trouble in the past 😉. But it's fine, we have a strategy, I was just hoping to have some more time (less affected systems/users) until it takes effect.