Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103977
MIME-Version: 1.0
Date: Fri, 1 Feb 2019 12:27:28 +0100
Message-ID: <CAF+90c-B=xU9phGNxcRvZE+2c1RkKvsiDXU0qzWJdU_U3Tskag@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000903a530580d36e68"
Subject: Disable PEAR by default
From: nikita.ppv@gmail.com (Nikita Popov)

--000000000000903a530580d36e68
Content-Type: text/plain; charset="UTF-8"

Hi internals,

I would like to suggest that installation of PEAR is disabled by default in
PHP 7.4. PR: https://github.com/php/php-src/pull/3781

I think the reasons for this should be obvious. It's not really the recent
security breach itself, but rather the underlying issue that PEAR simply
isn't actively maintained anymore.

Currently PEAR is broken on master due to the removal of each(), which was
deprecated in PHP 7.2. Apparently, since that time nobody noticed that PEAR
is throwing deprecation errors, or at least nobody bothered to fix them.
(I've submitted https://github.com/pear/Console_Getopt/pull/3 to fix at
least this particular issue.)

It's somewhat unfortunate that PEAR and PECL are coupled projects, but I
don't think that should prevent us from changing this default.

Regards,
Nikita

--000000000000903a530580d36e68--