Drop PHP 5.3 support, Require PHP 5.4

[mattab]

The goal of this issue is to officially drop support for PHP 5.3 and require PHP 5.4.

We announced this in a blog post few months ago: https://piwik.org/blog/2014/10/announcing-piwik-will-end-php-5-3-support-six-months-may-2015/

Notes

• Update requirements
• Update api.piwik.org/1.0/getLatestVersion/ to return 3.0.0 only when PHP >= 5.4.0
• Change CI build and remove PHP 5.3 builds
• maybe some part of codebase can be simplified in case we were doing custom logic for PHP 5.3

[ThaDafinser]

@mattab will 2.13 be the last php 5.3 release?

[mnapoli]

Right now it is planned that 2.14 will be the last (then we jump to 3.0 with PHP 5.4).

[ThaDafinser]

@mnapoli @mattab 5.4 is already near EOL (security fixes only). No chance to skip 5.4 with 3.0 and go directly to 5.5?

http://php.net/eol.php
http://php.net/supported-versions.php

[mattab]

No chance to skip 5.4 with 3.0 and go directly to 5.5?

Unfortunately we can't skip 5.4 as many of our users are still using it: about 35% are on PHP 5.3, 35% on PHP 5.4, 20% on PHP 5.5 and 6% on PHP 5.6.

[gaumondp]

Dear Big Brother (aka @mattab ), how did you get those stats ?

Are these actual PHP-Piwik stats or from the world of PHP in general ?

[mattab]

Hi @gaumondp we do collect the PHP versions of Piwik users during the Piwik update check. We use this data only for purpose like I did here, to help us decide whether we can increase the minimum required PHP version. Later we'll provide a way to disable sending any data to Piwik.org in #6324

[ThaDafinser]

@mattab @gaumondp when PIWIK 3.0 will be released, PHP 5.4 will already be EOL

When i read sentences like
Security is a top priority at Piwik ( http://piwik.org/security/ )

How can you then release a new major version on an outdated version?

From another perspective: With the remove of 5.3 support, already 35% have to upgrade to a higher version and they'll not leave Piwik because of this reason.
The other 35% on 5.4 also have to upgrade better sooner than later....since they are on an EOL version...

[gaumondp]

It's not fair to blame Piwik's team for lack of PHP upgrades by its users.

Even if 5.3 is already more than EOLed, SUSE produced a fix to PHP 5.3 : http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00003.html

Not everyone can upgrade servers twice a day. ;)

[ThaDafinser]

@gaumondp i know what u mean and its nothing personal against Piwik.
The hoster says: "The software still runs on PHP 5.4 why i should upgrade?"
The software dev see: "Many people still use PHP 5.4, i can't upgrade my requirement"
So it was and always will be the chicken & egg problem 😄

Not everyone can upgrade servers twice a day. ;)

Twice a day? 5.5 was released in summer 2013

IMO: If someone wants to use the latest version of a software, he should also take the time once every two year to upgrade his PHP stack....

[gaumondp]

Just wanna add that my ranting about upgrading was for "anything" and not PHP in general. I upgrade Piwik on a 3 months schedule anyway but not once a year.

One of the problem is also due to Linux distros that are not too speedy in their adoption of recent packages... And then you have those cheap hosters (not my case hopefully).

[marclaporte]

Hi!

Since RHEL / CentOS / ClearOS 6.x are still supported for a long while, this would be a great time to introduce a Long Term Support (LTS) version of Piwik.

Piwik 2.13.x could continue for a while, with just security fixes, thus supporting PHP 5.3, while 3.0 is wide open for development with PHP 5.4 The upgrade script should only offer to upgrade to 3.x if PHP 5.4 is detected. Otherwise, it continues 2.13.5 -> 2.13.6 -> 2.13.7. With an LTS with only security fixes (and not even bug fixes), it shouldn't be too much work. Every future security fix in 3.x would need to be checked against LTS code base to see if it applies. In some cases, the vulnerability will apply to both branches, in which case, the fix is likely the same. In other cases, the vulnerability won't apply to the LTS branch because it was introduced via a new feature of Piwik 3.x

I installed Piwik for a government ministry. The OS is RHEL 6 and I was actually one of the first to have it as most others have RHEL5. RHEL 7 is simply not available in this case, as they have procedures to validate distros and this takes a lot of time.

Similarly, I am involved with ClearOS, a fantastic distro: https://www.clearos.com/
http://distrowatch.com/table.php?distribution=clearos
ClearOS 6.x has PHP 5.3 while ClearOS 7.x will have PHP 5.4, but it's not released yet. ClearOS does a great job of integrating all kinds of apps in a clean, unified interface. But this takes time, and thus, it always lags behind the Prominent North American Enterprise Linux Vendor from which it's derived. This is how to install Piwik:
https://www.clearos.com/support/documentation/clearos/content:en_us:kb_howtos_piwik

So if Piwik doesn't offer an LTS, I don't have a viable solution.

Please see https://info.tiki.org/Version+Lifecycle for an example of a time-based, "Release early, Release often" approach with Long Term Support (LTS) versions, to balance the needs of stability and innovation.

In the case of Tiki, thanks to the LTS, we can have aggressive requirements for new PHP versions, and we were able to make PHP 5.5 a dev requirement at the end of 2013. For anyone for whom this was a problem, they could just stay on LTS: http://doc.tiki.org/Requirements#PHP

Best regards,

M ;-)

[mattab]

this would be a great time to introduce a Long Term Support (LTS) version of Piwik.

Hi @marclaporte

Thanks for writing your suggestion. We've discussed this topic internally few times and our conclusion was that we won't offer a LTS version for Piwik. Fragmentation of user base across many versions is a big problem for many open source projects, and we're trying to avoid this by aggressively pushing users to upgrade to latest version. Plus we don't have the resources (nor the willingness) to support multiple versions of Piwik (LTS would take our time away from higher value work). Also it's really important for us that users use the latest Piwik version since we always fix so many bugs and make dozens of improvements each month.

[gaumondp]

@mattab , at least, make sure it's almost impossible to upgrade to version 3 of Piwik when PHP 5.3 is detected... From web interface updater and CLI so no one is stucked with a Piwik 3.0 on a PHP 5.3 server.

@marclaporte , I feel your pain and frustration... My TYPO3 CMS universe also endorse LTS versions.

[mnapoli]

@mattab , at least, make sure it's almost impossible to upgrade to version 3 of Piwik when PHP 5.3 is detected... From web interface updater and CLI so no one is stucked with a Piwik 3.0 on a PHP 5.3 server.

very good point @mattab I don't think the updater checks the PHP version right now? If not, we need to put this in 2.14 else it will be too late

[mattab]

very good point @mattab I don't think the updater checks the PHP version right now? If not, we need to put this in 2.14 else it will be too late

it's already implemented. the API for getLatestVersion checks for PHP versions and anyone who don't have PHP 5.3.0 won't be able to upgrade to 2.0.0, and anyone with less than 5.3.3 won't be able to use 2.7.0+

[mnapoli]

Great I had no idea!

[mattab]

I've added to list of steps in issue: Update api.piwik.org/1.0/getLatestVersion/ to return 3.0.0 only when PHP >= 5.4.0

[mattab]

Now we're even considering dropping support for PHP 5.4, and require PHP 5.5! Join the discussion in #8156

[mattab]

Considering we introduced Long Term Support version for Piwik in #8546 - we will skip PHP 5.4 and directly require PHP 5.5 - let the fun begin! Thanks everyone for the discussion.

Next step is: #8156

[marclaporte]

PHP 5.4.x has reached end of life:
"Please note that according to the PHP version support timelines, PHP 5.4.45 is the last scheduled release of PHP 5.4 branch. There may be additional release if we discover important security issues that warrant it, otherwise this release will be the final one in the PHP 5.4 branch. If your PHP installation is based on PHP 5.4, it may be a good time to start making the plans for the upgrade to PHP 5.5 or PHP 5.6."
Source: http://php.net/archive/2015.php#id2015-09-04-4

[beoss]

I found a work around for this issue, here is what I did; I had a similar requirement to run code on an older version of PHP.

• Create a new docker image with the PHP requirements I have
• Add it as an additional container to the project (the same way the docs mention adding Solr)
• I made sure this new container was exposed via a link to the standard web container
• I modified the web image to enable mod_proxy and to proxypass requests to my new container

This worked well for my requirements. I did not spend any time to get Mailhog working but it could be updated to work and now I have a CentOS PHP 5.4 container to run legacy code on with DDEV.