fix(SetupChecks): Add reasoning/clarity to outdated PHP check

[joshtrichards]

Summary

• Add reasoning based on our existing docs
• Add specific version range suggested for the current Server version
• Tweak the language a bit for improved readability (fewer disparate version numbers)
• Eliminate need to update Server versions in the message before every major release

Note: Decided not to add upper bound check for now.

TODO

Follow-up: A lot of these dependency min/max versions should be moved to constants (maybe in version.php (e.g. PHP, MariaDB, etc.) to ease our recurring release cycle tech debt.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[st3iny]

Suggested change

	return SetupResult::warning($this->l10n->t('PHP %s detected. PHP >=8.2 and <= 8.3 is suggested for optimal performance, security, and stability with this version of Nextcloud. Additionally, the next major release of Nextcloud will likely require >= PHP 8.2.', [PHP_VERSION]), 'https://secure.php.net/supported-versions.php');
	return SetupResult::warning($this->l10n->t('PHP %s detected. PHP >= 8.2 and <= 8.3 is suggested for optimal performance and stability with this version of Nextcloud. Additionally, the next major release of Nextcloud will likely require >= PHP 8.2.', [PHP_VERSION]), 'https://secure.php.net/supported-versions.php');

I don't like having the security aspect in there. PHP 8.1 has official security support until 31 Dec 2025.

[joshtrichards]

I can see going either way. Our docs describe it that way, but admittedly that's also in the context of why we overall as a project drop support for older PHP versions. I guess it's less of a concern with PHP's longer Security fixes only cycles (at least as of 8.1).

One consideration is that, for example, in v27/v28/v29 we find ourselves still listing support for PHP 8.0 even though it's not even receiving security fixes at all. So under those circumstances this message might be perfectly valid in mentioning security too (obviously the specific PHP versions mentioned would be different; this PR is only for what's true as of v30 - just trying to provide a real-world example).

But that sort of situation goes away moving forward based on the PHP's newer post-EOL continued critical security fixes for two-year policy. So admittedly it probably is reasonable to remove the reference to security moving forward given our own release cycles.

Though to muddy the waters a bit again: we have to (or at least have chosen to) account for the individual distros (which I think is both reasonable and mostly unavoidable) which have their own internal security fix policies that sometimes are in conflict with/extend beyond whatever PHP's policy is at the time.

I'm curious what @nickvergessen's opinion might be.

I'm leaning towards leaving it in still myself (at least at the moment hah).

[st3iny]

You are right. We explicitly state the security aspect of updating PHP in our admin documentation so I'm fine with leaving it in.

Nevertheless, could we please have the space between >= 8.2?
Should be: PHP >= 8.2 and <= 8.3 is suggested

[joshtrichards]

Done.

[nickvergessen]

Though to muddy the waters a bit again: we have to (or at least have chosen to) account for the individual distros (which I think is both reasonable and mostly unavoidable) which have their own internal security fix policies that sometimes are in conflict with/extend beyond whatever PHP's policy is at the time.

Well the idea was basically to allow installing on all supported distros at the moment of the release, and after that each Nextcloud major will continue to support those PHP major versions for eternity.
I'm fine with listing security as well. It should just be made clear that 8.1 is an option and there is no immediate update needed (especially since official PHP support is covering it soon, although that doesn't mean the distros are staying on top of security patches all the time).

[come-nc]

🤷

[nickvergessen]

Suggested change

	return SetupResult::warning($this->l10n->t('PHP %s detected. PHP >= 8.2 and <= 8.3 is suggested for optimal performance, security, and stability with this version of Nextcloud. Additionally, the next major release of Nextcloud will likely require >= PHP 8.2.', [PHP_VERSION]), 'https://secure.php.net/supported-versions.php');
	return SetupResult::warning($this->l10n->t('PHP %s detected. While PHP 8.1 is still supported by this version of Nextcloud, it's not recommended and PHP >= 8.2 and <= 8.3 is suggested for optimal performance, security, and stability. Additionally, the next major release of Nextcloud will likely require >= PHP 8.2.', [PHP_VERSION]), 'https://secure.php.net/supported-versions.php');

Maybe keeping it a bit more "open"?

[skjnldsv]

@joshtrichards ? :)