SecureHeaders was originally written in PHP 7.
However, I wanted as many people as possible to be able to use these browser security features easily, and didn't want it to be unusable by someone just because they were stuck with a lazy hosting provider.
So I backported the codebase all the way back to PHP 5.3 (and I took scalar type exceptions back with me! 😉)
PHP 5.6 initial backport: 4565833
PHP 5.4: 2192058
PHP 5.3: cdab04a
A year(-ish) later and two major versions out, the minimum version has increased to PHP 5.4. I think that's where I'm comfortable drawing the line though. It certainly doesn't make sense to continue supporting versions of PHP that the PHP team themselves don't.
As far as official support goes, PHP 5.6 is the only version on 5.x not to be end of life, and it will no longer receive updates unless they are security related. It'll be that way for a while longer, so it might make sense to still support that. We'd even gain the ... operator for type-hinting collections of objects.
However, we're still missing proper language enforced type safety for scalars, return type hints, and strict mode to disable "type coercion". For these features, I feel it will be worth dropping 5.6 too.
If you really have to use PHP 5.x, 2.x isn't going anywhere. 2.x will likely enjoy quite a few more updates too. This just forewarning that when 3.0 finally rolls around, it'll be modern PHP only.
Edit: Starting a checklist of sub-tasks/issues in this meta-issue, that'll need to be completed when the transition is underway (don't worry, still not yet).
SecureHeaders was originally written in PHP 7.
However, I wanted as many people as possible to be able to use these browser security features easily, and didn't want it to be unusable by someone just because they were stuck with a lazy hosting provider.
So I backported the codebase all the way back to PHP 5.3 (and I took scalar type exceptions back with me! 😉)
PHP 5.6 initial backport: 4565833
PHP 5.4: 2192058
PHP 5.3: cdab04a
A year(-ish) later and two major versions out, the minimum version has increased to PHP 5.4. I think that's where I'm comfortable drawing the line though. It certainly doesn't make sense to continue supporting versions of PHP that the PHP team themselves don't.
As far as official support goes, PHP 5.6 is the only version on 5.x not to be end of life, and it will no longer receive updates unless they are security related. It'll be that way for a while longer, so it might make sense to still support that. We'd even gain the
...operator for type-hinting collections of objects.However, we're still missing proper language enforced type safety for scalars, return type hints, and strict mode to disable "type coercion". For these features, I feel it will be worth dropping 5.6 too.
If you really have to use PHP 5.x,
2.xisn't going anywhere.2.xwill likely enjoy quite a few more updates too. This just forewarning that when3.0finally rolls around, it'll be modern PHP only.Edit: Starting a checklist of sub-tasks/issues in this meta-issue, that'll need to be completed when the transition is underway (don't worry, still not yet).
strict_types=1...operator2.xtoo)