After the PHP CVEs I wrote about in my previous post, one project needed to move from PHP 8.1 to PHP 8.4. Before making that jump, we used PHPCompatibility to check the codebase against the target version. It was compatible.
I’m sharing this as a follow-up to that security update. The earlier post covered patching this blog. This was another project, with a move across several PHP versions, so checking the application code was part of preparing the upgrade.
Checking the codebase with PHPCompatibility
PHPCompatibility is a set of checks for PHP_CodeSniffer. It analyses PHP source for compatibility across PHP versions. PHP_CodeSniffer runs the analysis, and PHPCompatibility provides the version-specific rules.
The setting that matters here is testVersion. It tells the tool which PHP version the code should support. For a PHP 8.4 target, that value is 8.4. The PHP version used to run the scanner is separate from the version you’re checking the code against.
That distinction is useful when preparing an upgrade: you can inspect the source for the intended target before changing the application’s runtime.
The target also keeps the check focused on the project. We were moving an existing codebase from PHP 8.1 to PHP 8.4. A library that still needs to support both would have a different requirement: it would need to remain compatible across that range. PHPCompatibility supports specifying a range as well as a single version.
The codebase was compatible
We ran the compatibility check for this project, and the codebase was compatible with PHP 8.4.
That was the result we needed from this step. The security update had given us a reason to move the runtime, and PHPCompatibility let us check the existing application code against the version we were moving to.
The compatibility check and the PHP update have different jobs. PHPCompatibility analyses the application’s source. Installing the updated PHP runtime is what brings in the runtime’s security fixes. The scan was part of preparing that move.
If you’re preparing a similar move, set the PHPCompatibility target to the version your project is moving to. Keep that setting with the scan results so it’s clear which PHP version was checked.