PHP platform config in composer.json mismatch?

gunnicom · 14 June 2024 11:28

In composer.json PHP platform seems to be configed to PHP 7.4,0 but SuiteCRM 7.14 is compatible with PHP 8.1 and 8.2 only.
Shouldn’t it be adapted, or removed from composer.json so the installed version is expected?

It seems to be hardcoded in 2 places, and at least the first 7.4.0 seems to be blocking for newer packages as the second one is >=

github.com

salesagility/SuiteCRM/blob/504d6f0ebd5847169d73c52d312e91916a7280bb/composer.json#L28


      
          },
          "config": {
            "vendor-dir": "vendor",
            "platform": {
              "php": "7.4.0"
            },
            "optimize-autoloader": true,
            "sort-packages": true,
            "allow-plugins": {
              "wikimedia/composer-merge-plugin": true
            }
          },
          "minimum-stability": "dev",
          "prefer-stable": true,
          "suggest": {
            "ext-imap": "Needed for emails module"
          },
          "require": {
            "php": ">=7.4.0",
            "ext-curl": "*",
            "ext-gd": "*",

pgr · 14 June 2024 14:33

It’s possible that this is correct, if everything under computer works fine with PHP 7.4, even if the rest of the SuiteCRM code needs 8.0.

But I wouldn’t be surprised if this is just because somebody forgot to change it. It would be interesting to test if changing composer.json to 8.0, everything works fine or not.

gunnicom · 14 June 2024 18:31

Of course everything can work, but if a library dumps PHP7 support (which becomes more likely each day), the library may not get any security updates anymore, thus leaving Suite vulnerable to such unpatched bug.
Considering how few work seems to be put towards Suite 7 regarding the always growing collection of open PRs and Issues I am quite sure that it got overlooked and nobody cares at Salesagility.

pgr · 14 June 2024 18:38

SalesAgility have many clients still on v7! I think they are que serious about maintaining it for the time specified in the roadmap. Of course, they will try to minimize these efforts and keep their focus on v8, which is understandable.

If the change to composer.json works well, then I would simply put that up as a PR, I believe sooner or later they’ll find the time to test it and merge it. As you correctly pointed out, this will eventually have security implications.

chris001 · 15 June 2024 18:26

I had noticed the same. The min and max PHP version should be set in composer.json , according to the compatibility matrix, for each release of 7.x and 8.x, and the when you use the app, it should work correctly with the compatible PHP version, with zero language related fatal errors.