Update minimum PHP requirements

[avoidthehack]

Hi!

PHP 8.0 is completely deprecated as of Nov 2023. It is no longer receiving any security updates: https://endoflife.date/php

Recommend updating dependency/system checks for at bare minimum PHP 8.1 - it still has security updates for at least another year before it is completely deprecated as well. Ideally, it should be 8.2 as it has active support for at least another year, security support for 2 years.

[JulianPrieber]

LinkStack is fully compatible up to PHP 8.3 and our dependencies reflect that. We follow our own timeline, we may require at least PHP 8.1 in Q1 2024 and 8.2 from 2025 onwards.

I'd prefer if we would still support PHP 7.4, but we do make sure we are getting active security updates.

The docker version is running PHP 8.2. All our hosted servers are running at least PHP 8.2.

[avoidthehack]

I missed that in your security policy.

If backwards compatibility (within reason) is your focus, that's fine. Outdated minimums still kind of make me recoil, but that could be because I work in security. Naturally, the security burden rests on the admin but... ah, I digress.

In any case, perhaps it could just be an item to include in the docs for those interested. I still just wanted to flag it in any case.

[JulianPrieber]

Riight, I just looked at your profile. I saw your post on Mastodon like a week ago.
If you don't mind me asking, what field in security are you working in?
Any chance you'd be open to helping us out in the future? We're looking for someone with expertise in security to join our volunteer team as a consultant.

[avoidthehack]

Hmm. I work in threat intelligence. I'm open to the idea of helping out, but not quite sure how much help I can really be. Web AppSec kind of came with the territory of running my own web server, but it's not what I do in my day-to-day.

[JulianPrieber]

We mostly need help with Pentests. Otherwise, general threat detection and assessment.
We can't really offer any bug bounties, so we are dependent on the help from the open source community.
We need someone who knows how to perform more specialized attacks/use specialized tools.

[avoidthehack]

I see. That's a little outside what I do in a day-today (though, it is something I'm always learning). Ah, maybe one day. I think I'm going to stay the threat intel route though, haha.