php: 8.2 -> 8.3

[Ma27]

PHP 8.2 will only receive security patches starting at the end of
November[1], so it makes sense to bump the default version forward.

I looked through all modules with the substring pkgs.php[2] and all of
the usages looked fine or were fixed in a commit before this one.

[1] https://www.php.net/supported-versions.php
[2] I didn't take with/let ... in things into account, but honestly,
if an application doesn't work with a newer PHP, it should probably
be pinned down instead of blindly relying on pkgs.php.

We'll probably have to delay this until 25.05 given we're past the freeze.
Opinions on this @nixos/php ?

---

cc @AleXoundOS for pending castopod update.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[drupol]

Shouldn't we add a release note ?

[patka-123]

LGTM. Agreed that we should indeed wait for 25.05.

Not checking with and let is fine I think. I skimmed through it and couldn't find stuff that could potentionally break. If there is, it's indeed a good opportunity to pin versions, like you said.

[Ma27]

Shouldn't we add a release note ?

Sure, but given that we'll probably target 25.05 I figured it doesn't make sense to write anything now since the file doesn't even exist.

And after sleeping over it, I think it's the right call to not do a last minute bump.

Going to add release notes after branchoff.

Not checking with and let is fine I think. I skimmed through it and couldn't find stuff that could potentionally break. If there is, it's indeed a good opportunity to pin versions, like you said.

So I think previously it was always someone else was doing the default package bumps, but now that I had to do it, it got me thinking: it's a pretty annoying task to find modules that are using pkgs.php and then having to find out if the package is in a version supporting the new interpreter (especially painful if said package fails to have a composer.json with said metadata in 2024).

My suggestion would be fairly simple: let's not do that anymore (duh!).
I mean, I'd expect the package maintainer to know the PHP interpreter situation best (from all NixOS maintainers). And if it's clear that the package won't be able to bump quickly[1], I'd expect them to pin PHP to the correct minor release and if not I'd consider that a bug.

If a package keeps up with new PHP versions quickly (and also keeps supporting older interpreters), it may be fine to just use pkgs.php, but that's it basically.

WDYT?

[1] We're pretty slow to bump the default right now anyways and should probably establish some rules around that.

[patka-123]

I still agree with your idea (even with more context ^^). Currently we are lucky that the php package set is not that big, but as it slowly grows it becomes untenable to check the minimum version for every package.

I'd put the burden onto the package maintainer indeed. The package here and there that breaks and doesn't have a maintainer fixing it is more acceptable than not updating PHP versions.

[Ma27]

(even with more context ^^)

I don't remember anymore if I just had to be grumpy for a moment or if I misread your answer ;-)

Anyways, now that the branchoff happened, I added a release note to 25.05.