On 7 November 2026 15:55:40 GMT, "Rowan Tommins [IMSoP]" <[email protected]> wrote: >On 05/11/2026 20:34, James Titcumb wrote: >> I'd like to introduce an RFC to lay out a timeline to sunset PECL and open >> it for discussion. > >1) Have a longer interim stage, where functionality is limited, and >deprecation clearly flagged, before going fully read-only. > >For instance, registration of new packages could be disabled,
It already is. > and perhaps restrictions placed on version numbers - e.g. allow Swoole 6.1.13 > and 6.2.6 as patching existing series, but force 6.3.0 to be PIE only. This will likely mean changing the peclweb code, and that's something we really shouldn't want to do. Nobody knows the code and it's decades behind the times. >We could also restrict packages from listing compatibility with new PHP >versions - there's probably no reason for anyone to use PECL to install >anything on PHP 8.7 / 9.0. Same >2) Establish a process up front for package maintainers to request publication >of security releases, with only a small number of users granted write access. > >As Andrew points out, if it's suitably restricted, this security process >doesn't need to use the same automation as the original system, it just needs >a way for trusted user to manually upload the releases. > >What do you think? If the long static state is considered a problem, we can just shorten it be a year, and shutting it down a year sooner. cheers Derick
