PHP 8.2 to 8.3: one release, before 31 December 2026

The 8.3 changes

PHP 8.3, change by change, for code that runs on 8.2

With only one release to absorb, this route can afford to look at the whole 8.3 list rather than the headlines. It falls into three groups: changes that can stop a request, changes that alter results quietly, and deprecations.

Changes that can stop a request

Changes that alter results without an error

<?php
$list = [];
$list[-5] = 'first';
$list[] = 'second';

var_dump(array_keys($list));
// PHP 8.2: [-5, 0]
// PHP 8.3: [-5, -4]

Deprecated in 8.3

These still work on 8.3 but log a notice. Search for each:

• get_class() and get_parent_class() called without an argument
• incrementing a string that is empty or not alphanumeric, or decrementing one that is empty or not numeric (str_increment() and str_decrement() are the replacements)
• assert_options(), the ASSERT_* constants and non-default assert.* ini settings (use zend.assertions)
• ReflectionProperty::setValue() with one argument (pass null first for a static property)
• ldap_connect() with a separate host and port
• a negative width in mb_strimwidth()
• Phar::setStub() with a resource and a length
• dba_fetch() with the handle as its third argument
• calling FFI::cast(), FFI::new() and FFI::type() statically
• the MT_RAND_PHP variant of mt_rand()
• NumberFormatter::TYPE_CURRENCY and the misspelt U_MULTIPLE_DECIMAL_SEPERATORS constant
• SQLite3::enableExceptions(false), and ZipArchive::FL_RECOMPRESS

On Windows, note that 8.3 needs Windows 8 or Windows Server 2012 as a minimum.

The full guide on php.net: backward incompatible changes, deprecated features, other changes, new functions.

Before the next step

8.4 deprecations to get ahead of during 2027

Landing on 8.3 means another move before 31 December 2027. These 8.4 changes can be made in code that still runs on 8.3:

• Parameters made nullable by their default. Type $x = null is deprecated in 8.4. Writing ?Type $x = null today removes the notice in advance.
• Session tuning. Changing session.sid_length, session.sid_bits_per_character or session.use_trans_sid is deprecated, as is the SID constant. php.net's advice is to let session storage accept the default 32-character hexadecimal IDs.
• lcg_value(). Deprecated; Random\Randomizer::getFloat(), available since 8.3, replaces it.
• xml_set_object(). Deprecated, along with passing method names as plain strings to the xml_set_*_handler() functions; pass callables instead.
• exit() with odd arguments. From 8.4 an invalid type throws TypeError, so keep exit values to strings and integers.

php.net: deprecated in PHP 8.4

Testing and rollout

Run 8.3 next to 8.2, then switch

1. A second PHP version on the same host. Add 8.3.36 or later as its own PHP-FPM pool, or select it for a staging site in your control panel, so production stays on 8.2.35.
2. The same extensions. Compare php -m and a web-served phpinfo() for both versions; on systems that package extensions per PHP version, each one has to be installed again for 8.3.
3. Composer told about 8.3. Set config.platform.php to 8.3.36 in a branch, run composer update, and on the staging site run composer check-platform-reqs, which checks the real platform rather than the configured one.
4. Notices on, display off. error_reporting = E_ALL and log_errors = On with display_errors = Off. The production template that ships with PHP excludes deprecations, so set the level explicitly on staging.
5. A full walk-through. Every template, form, payment and email, plus scheduled jobs and command line scripts, which may use a different php.ini (php --ini shows it).
6. The switch. Point production at the 8.3 pool or setting in a quiet period, restart PHP, and watch the log.