Will they keep patching old version of PHP?

  • ipsirc@lemmy.mlEnglish
    42·
    10 months ago

    They’re waiting for Debian developers backporting the patches.

  • Limonene@lemmy.world
    32·
    10 months ago

    In many cases, they will cherrypick security fixes and other major bugfixes from the bleeding edge version, and put those fixes in the old versions of the software.

    This is the same thing the PHP folks would do while the old PHP is supported. Once the old PHP is out of support but Ubuntu LTS is still in support, then the Ubuntu folks have to put in the extra work to do the cherrypicking.

  • Kualk@lemm.ee
    377·
    10 months ago

    Only if there is such a huge vulnerability that they will have no choice.

    That’s just my guess.

    Promise of support is a tricky one.

  • chameleon@kbin.social
    10·
    10 months ago

    There are community backports (like Sury’s Debian builds) for PHP, including a branch of PHP 5.6 originally released in 2014. Most other notable languages and major packages have something likewise as well, right down to major packages like Drupal 6. It’s not always easy, but it’s doable and the work is usually either already done or can be paid for.

    Weird things that are truly too difficult to support are also often excluded. Eg Spectre/Meltdown fixes were non-trivial and had to be backported to a fairly wide range of things but that only went so far back. Some old systems just never got those fixes and instead have to be ran with a workaround (“don’t run untrusted code”). I don’t know how things are with the new offering but large complicated packages with lots of moving parts like OpenStack used to be excluded from the full extended support cycle before as well.

  • db2@lemmy.world
    124·
    10 months ago

    I would think “long term support” can also sometimes mean moving that support to a newer version, especially where it doesn’t break compatibility.

    • Spectacle8011@lemmy.comfysnug.space
      1·
      10 months ago

      That would be the logical conclusion, but I believe Debian uses the old version for years after it’s unsupported and might backport security fixes depending on how severe they are. Either way, I personally wouldn’t trust Debian or Ubuntu to properly fix security issues with a program (or in this case, programming language) that they do not actively develop or maintain themselves.

  • bizdelnick@lemmy.ml
    39·
    10 months ago

    LOL they’ll do nothing as usual. Probably they will apply security patches if someone submit them, but I’m unsure.