---
title: "Half of PHP Projects Still Promise an Unsupported PHP Version"
url: https://www.exakat.io/half-of-php-projects-still-promise-an-unsupported-php-version/
date: 2026-11-05
modified: 2026-11-05
lang: en
author: "dams"
description: "Growing Old With PHP, 2026 In 2020, Exakat looked at its corpus of PHP projects and reviewed them by the date of their last commit. Six years later, we are..."
categories:
  - "Code auditing"
tags:
  - "OSS"
  - "php"
  - "project"
image: https://www.exakat.io/wp-content/uploads/2026/11/older.640.jpg
word_count: 1777
---

# Half of PHP Projects Still Promise an Unsupported PHP Version

# Growing Old With PHP, 2026

In 2020, Exakat looked at its corpus of PHP projects and reviewed them by the date of their last commit. Six years later, we are running the same analysis, with a modernized sample, with the same questions: how alive are PHP code bases. The original from 2020 is available at [exakat.io](https://www.exakat.io/growing-older-with-php/).

## Sourcing PHP Codes

The corpus is the basis for the internal tests of Exakat, the static code analysis. It covers currently 3314 projects, extracted from packagist, and various other public sources, published as archived or different source host like github, gitee, gitlab or framasoft.

In these projects, we set aside 850 of them which are not hosted with git. That leaves **2,462 repositories**, with an existing remote hosting. As a rule of thumb, the corpus measurements stabilize with any set of 300 random of these projects, and this goes well beyond.

## Last Commits Per Year

The chart shows the calendar year of each project's last commit, for the last ten years. Anything older is grouped as "Before 2017". This illustrates is how recently PHP projects are updated: the more recent the better.

[![](https://www.exakat.io/wp-content/uploads/2026/11/chart-last-commit-per-year-1024x478.png)](https://www.exakat.io/wp-content/uploads/2026/11/chart-last-commit-per-year-scaled.png)

 

Within last year, 34.9% of projects have been update, or 859 repositories. Within two years, that is 41.2%. Within five years, it is 60.0%. Within ten years, 92.7%. The "Before 2017" group holds 190 projects, last updated before 2016. That category includes PHP nuke, though that famous project has a more modern version, if you really want it.

The 2020 article reported 45% within a year and 77% within two years. This is a notable discrepancy. The main effect is attributable to the larger sample, which favor the number of stale projects.

The 2026 bar is the tallest by far, at 818 projects, and it counts everything up to 3 November. Before that, the bars are fairly flat: between 122 and 236 projects per year from 2017 to 2025, peaking at 236 for 2021. It seems that projects are dying at a constant rate over the years.

## Last Commits By Month

The chart covers the last two years, from November 2024 to the collection date: this time, the interval are by month. Only November 2026 is partial, with 42 projects in its first three days: there aren't too many updates in such a truncated month.

 

[![](https://www.exakat.io/wp-content/uploads/2026/11/chart-last-commit-per-month-1024x478.png)](https://www.exakat.io/wp-content/uploads/2026/11/chart-last-commit-per-month-scaled.png)

Through 2025, the months stay between 7 and 21 projects. From January to August 2026 they rise to 25 to 50 projects a month, and September reaches 85. Then October arrives with 396, the largest month in the whole dataset. You have to understand that a project that is updated in January, then February, then.. is only counted once. There is a fract effect with the previous graph, where the number of last update is very recent, and then, it flattens over time.

October is not a spike: it is the freshness ramp. Between 1 and 18 October, about 5 projects a day had their last commit. From 19 to 27 October, 266 projects did, peaking at 61 on the 26th. Then it falls back to about 8 a day for the last four days of the month. It gives an idea that live projects are usually active in the last month.

The 2020 article found two peaks: May 2020 and the run-up to PHP 7.4 in late 2019. The 2026 ramp sits on the release candidates for PHP 8.6, with the release scheduled for 19 November 2026, and php.net reports [8.6.0RC4 on 21rst October](https://www.php.net/archive/2026.php#2026-10-21-6).

One caveat. Of the 396 projects with a last commit in October, 211 or 53% contain at least one bot commit in their history, against 21% for the whole sample. Dependabot and Renovate may be doing some of the updating. I have not checked who made each last commit, so I cannot say how much of the ramp is people, or bots or AI. So many... things are adding their grain of salt in our code bases.

## Commits by weeks and days

The weekly chart covers the last two years, from the week of 4 November 2024 to the 3 November 2026 collection date. The final bar is partial: it counts only November 2nd and 3rd.

 

[![](https://www.exakat.io/wp-content/uploads/2026/11/chart-last-commit-per-week-1024x478.png)](https://www.exakat.io/wp-content/uploads/2026/11/chart-last-commit-per-week-scaled.png)

Through 2025, no week has more than 10 projects touched. Summer 2026 settles around 10 a week, then the counts rise from late August (24 in the week of 31 August) and reach 36 and 50 in early October. The two busiest weeks are the last full ones of October, with 176 projects in the week of 19 October and 139 in the week of 26 October.

## Commits by weekday

By weekday, the pattern is clearer:

| Day | Projects |
| --- | -------- |
| Monday | 427 |
| Tuesday | 394 |
| Wednesday | 383 |
| Thursday | 394 |
| Friday | 396 |
| Saturday | 225 |
| Sunday | 243 |

The split is flat across Monday to Friday, with Thursday level with Tuesday and Friday. The weekend is where it drops: Saturday and Sunday are each about 40% below an average weekday. Packages are mostly worked on during the working week, and far less at weekends. On the other hand, they get something on Monday.

This counts the day each project was last touched, not every commit, so it shows when projects were last worked on rather than the full rhythm of development.

## Idea: What About A 'Commit Day' for 2027?

PHP's birthday is June 8th, and in 2026 it turned 31. Four projects had their last commit that day. June as a whole averaged about 1.3 last commits a day, so four is three times the usual.

The PHP birthday count be a celebration of time that pass, and act as a reminder to update your composer.json file, and its dependencies. It falls in June, half a year away from the November releases, which makes it a good reminder for everyone to actually take into account the newest requirements. The question for each project is which PHP version it still promises, and whether that version is still supported.

 

[![](https://www.exakat.io/wp-content/uploads/2026/11/chart-requested-php-version-1024x620.png)](https://www.exakat.io/wp-content/uploads/2026/11/chart-requested-php-version.png)

Of the 2,462 repositories, 1,573 or 64% declare a PHP requirement. The rest are split between 704 projects with a `composer.json`that names no PHP version, and 185 with no `composer.json` at all. The lowest version requested, as a share of all 2,462 projects, reads as follows:

- PHP 8.3 and later: 195 projects (8%)
- PHP 8.2: 168 projects (7%)
- PHP 8.0 to 8.1: 320 projects (13%)
- PHP 7.x: 566 projects (23%)
- PHP 5.x: 313 projects (13%)

PHP 8.1 and older are out of support as of today, and PHP 8.2 reaches end of life on 31 December 2026 ([endoflife.ai](https://endoflife.ai/article-php-eol.html) lists the dates; check php.net for the authoritative table). Applying that to the pie:

- 1,199 projects (49% of the sample) still accept a PHP version that is no longer supported. This is 313 on PHP 5.x, 566 on 7.x, and 320 on 8.0 to 8.1.
- Of those, 344 were touched in the last year. These are active projects that still tell Composer they will run on unsupported PHP.
- Another 168 declare 8.2 as their floor. In less than two months, that floor becomes unsupported too.

These are the projects that a composer review would reach first. The count of 344 is the actionable number: they are being worked on, so someone will read the requirement.

## Still Committing, Still Promising Old PHP

Each project's `composer.json` names a floor, and that is the oldest PHP it promises to run on. Setting that floor against the year of the last commit separates three kinds of project: those still maintained with an old promise, those that stopped while their floor was still supported, and those that are slow to raise it.

 

[![](https://www.exakat.io/wp-content/uploads/2026/11/chart-floor-vs-last-commit-1024x837.png)](https://www.exakat.io/wp-content/uploads/2026/11/chart-floor-vs-last-commit.png)

Each row is a PHP version. The black step line marks the year that version lost security support. A blue dot sits to the right of the line: the project was committed to after its floor had expired. A grey dot sits on or left of the line: the project stopped while its floor was still supported.

Of the 1,562 projects with a parseable floor, 843 (54%) were last committed after their floor's end of support. The largest blue groups sit on the 5.x, 7.x and 8.0 to 8.1 rows, which is where the unsupported promises are.

The most important group is the one still moving. 759 projects were last committed in 2025 or 2026, and 380 of them or 50%, still promise a PHP version that is out of support. These are not dead projects with a stale requirement. They are maintained projects that have not yet looked at the line in `composer.json`.

The grey dots are the projects that died with their version. On the 7.1 row, 46 of 141 projects stopped by 2019, while 7.1 was still supported, and 95 were committed later, after it had died. Those 46 are the case where a composer review has no point: nobody was going to raise the floor, because nobody was still there.

The slow group is harder to read. On the 8.1 row, 104 of 192 projects were last committed after 8.1 lost support in 2025. Those are living projects that can raise their floor with a single line, and simply have not. The chart cannot tell the difference between a project that is slow and one that is waiting for a reason. The commit history can, and that is the next thing to look at.

The change should come with a cool-down. A floor is a promise to users, and raising it will drop some of them. Announce the new floor, give a few months for dependent projects to adapt, then raise it. Do it on the same day each year, and the birthday turns into a habit rather than a fever. It actually brings everyone, maintainer and users together. Everyone would know that early June, compatibility numbers would change. It gives time and reasons to get ready.

# Growing old with PHP

Age by last commit tells you when a project last moved. It does not tell you why it stopped. A library untouched for five years may be finished, doing one job well and waiting for nothing. Or it may be dead, stopped in its tracks, by simple lack of steam. The same timestamp fits both. So the question is not only how old a project is, but what would have to be true for it to count as finished rather than abandoned.

If we run this audit again in 2032, will we still be measuring the age of the last commit, or will we have learned to measure what the commit was for?

If you want other measurements over large number of PHP code bases, join me on [discord](https://discord.phpc.chat/) or on [mastodon](https://phpc.social/@dseguy) or your favorite communication system.