Re: [RFC] Sunset PECL

On Sat, 7 Nov 2026, at 20:38, Derick Rethans wrote: > > If the long static state is considered a problem, we can just shorten it be a year, and > shutting it down a year sooner. I'd actually be fine with this. as Rowan makes a good point about long-time static unchanging deps. I'm wondering if that's actually already the case. I don't see a way (at least with my permissions) to remove an existing release from PECL in the instance it's deemed vulnerable. If that's the case the biggest impact in that particular instance is new releases that fix any vulnerabilities would only be available through PIE. I would suggest two changes: - a mitigation contingency to this risk: if a serious vulnerability is identified in a listed static package, we remove the affected package version(s) manually. - reduce the overall timeline to 1yr, bring forward all the 2029 dates to 2027. That's 6 months of "heads up", and 6 months of "read only mode plus brownouts" before shutdown ad the end of 2027. If there's no strong objections to these suggestions, I'll amend the RFC to reflect that in the next couple of days Thanks James