PHP 5.6 Support Timeline

• Version: 0.9
• Date: 2015-12-07
• Author: Zeev Suraski, zeev@php.net
• Status: Draft
• First Published at: http://wiki.php.net/rfc/php56timeline

This RFC proposes to extend the End of Active Support & End of Security Support dates for PHP 5.6, the final version in the PHP 5 family.

The release of PHP 7.0 is the first time a major version of PHP is released under the new Release Process RFC. While the RFC did outline rules for major versions, most of the discussion prior to the RFC, as well as all of the experience we've gained on the ground since its introduction dealt with how we deal with minor versions, as back then a major version wasn't actively being discussed. In addition, the release of PHP 7.0 happened substantially later than the 'standard' mid-year release cycle that most prior versions of PHP adhered to.

The currently published timeline for PHP 5.6 suggests an end to active support on August 28, 2016 and end to security support on August 28, 2017 - approximately 8 months & 20 months (respectively) after the release of PHP 7.0. Many consider these timeline inadequate for two key reasons:

1. In absolute terms, 20 months to upgrade the entire worldwide PHP codebase - after which an app that wasn't migrated would be exposed to security vulnerabilities - appears to be on the short side.
2. In relative terms, it seems awkward that people would have more time to upgrade from PHP 5.5 to 5.6 - an upgrade that is typically completely painless - than they do to upgrade from 5.6 to 7.0 - an upgrade which requires certain levels of code auditing and extensive testing.

It is proposed to reschedule both the End of Active Support and End of Security Support to provide the PHP userbase a longer, but still clear upgrade timeline. Most people feel that it is more important to further push the End of Security Support date, compared to the End of Active Support date.

This RFC provides 3 different options to choose from:

1. 1 year of Active Support (ending Dec 31, 2016), plus 2 years of Security Support (ending Dec 31, 2018).
2. 1 year of Active Support (ending Dec 31, 2016), plus 1 year of Security Support (ending Dec 31, 2017).
3. No change - 8 months of Active Support (ending Aug 28, 2016), plus 1 year of Security Support (ending Aug 28, 2017).

There are two main downsides to pushing the support dates for PHP 5.6:

1. Obviously, it will require the developers of PHP (us) to maintain it for a longer period of time, investing more time and effort than we would otherwise have to.
2. Extending the end of support dates may reduce the sense of urgency of people to upgrade, and may cause people who would have otherwise upgraded sooner to upgrade later.

That said, we believe that sticking with the current timeline (option #3) is simply too aggressive, and we should at least go for option #2 as it gives people at least the same amount of time they had to upgrade from 5.5 to 5.6, to upgrade from 5.6 to 7.0. Further, given the 5.6 -> 7.0 upgrade is more difficult and time consuming - our recommendation is option #1. The importance of giving users a bit more time to upgrade was also alluded to in the https://wiki.php.net/rfc/php57, although it was rejected - mainly due to concerns about defocusing the efforts of releasing PHP 7.0 - concerns which are no longer relevant.

Several people recommended that the Release Process RFC be amended to align the End of Support dates for a given version to the release of subsequent versions, also for minor releases. This is outside the scope of this proposal - which deals specifically with the support timelines of PHP 5.6 - and would be proposed in a separate RFC.

1. Extend the lifetime of PHP 5.6 yes/no
2. If you chose to extend it, extend it to
   • 1 year of Active Support + 2 years of Security Support
   • 1 year of Active Support + 1 year of Security Support

In case the majority chooses to extend the lifetime of PHP 5.6 (>50%) - then the option garnering more votes between the two proposed timelines would win.