Advisory: PHP 8.1 not currently supported

Hello all,

PHP 8.1 was recently released. We cannot currently work with this PHP version for the reason outlined in this article - you can not (for now) upgrade to it / start with it.

This version of PHP deprecates support for PHP's strftime function, which is critical to how Composr generates dates and times. Many years ago we migrated to this from date, as strftime supports different languages (for month names and so on) while date does not.

PHP is moving towards removing the function because multi-threaded versions of PHP are unreliable due to reliance on locale which may be altered by other PHP requests in the same process but a different thread. It has typically been the case that PHP has discouraged using multi-threaded PHP for this reason, but it looks like they may be trying to fix such issues.

Regardless, this will affect us in a big way once PHP 9 roles along. Any translations for date strings in Composr are based on the strftime syntax. For PHP 8.1 we can suppress any deprecation warnings, but to support PHP 9 when that comes we will have to map these to date syntax automatically (while dropping easy internationalised dates/times), map them to datefmt_format automatically with a dependency on the intl extension, or break compatibility with existing translations.

There may be other compatibility issues, as the PHP 8.1 release has not been tested against yet. In the near future we will do a full review and make a patch release addressing any issues.

EDIT: Updated article to reflect that PHP 8.1 only deprecated strftime, so for now we can still use it - but with modifications to suppress warnings.

EDIT 2: Composr 10.0.39 has now been released, which provides preliminary PHP 8.1 support. All automated testing is now passing, along with cursory testing. Our internal PHP version (used for development due to extra strictness) has been updated to include PHP 8.1's main point of new strictness (not discussed in this article, disallowing null values to PHP function string parameters). We expect we will find some more bugs over time, and these will be fixed as they are identified.

Edited

← Previous Article

Two new XSS security holes, and resolutions

Next Article →

Facebook login integration disabled on compo.sr