PHP 8.2 to 8.4: two releases, supported until the end of 2028

Second release: 8.4

PHP 8.4 in full: failures, deprecations and quiet changes

The implicit nullable deprecation has a variant that is easy to miss, where the parameter sits in front of a required one:

<?php
// Before, deprecated in PHP 8.4: $rate is nullable only through its default
// function price(Product $product, Rate $rate = null, string $currency) {}

// After, php.net's form: explicit nullable, no default, as $currency is required
function price(Product $product, ?Rate $rate, string $currency) {}

Changes that can stop a request

Deprecated in 8.4

Each of these still works but logs a notice. Most of the fixes also run on 8.2, so they can ship ahead of the switch. A few replacements only arrived in 8.3, namely DatePeriod::createFromISO8601String(), ReflectionMethod::createFromMethodName(), Random\Randomizer::getFloat() and stream_context_set_options(), so adopt those once 8.2 is gone.

• typed parameters made nullable only by a null default (see the example above)
• trigger_error() with E_USER_ERROR, and the E_STRICT constant
• omitting $escape in fputcsv(), fgetcsv(), str_getcsv() and the SplFileObject CSV methods
• mysqli_ping(), mysqli_kill(), mysqli_refresh() and the MYSQLI_REFRESH_* constants
• changing session.sid_length, session.sid_bits_per_character, session.use_only_cookies or session.use_trans_sid; the SID constant; session_set_save_handler() with more than two arguments
• lcg_value() (use Random\Randomizer::getFloat())
• xml_set_object() and method names passed as plain strings to the xml_set_*_handler() functions
• the ISO-string DatePeriod constructor (use DatePeriod::createFromISO8601String())
• ReflectionMethod::__construct() with one argument (use ReflectionMethod::createFromMethodName())
• stream_context_set_option() with two arguments, and unserialising strings with the uppercase S tag
• the two-argument forms of pg_fetch_result(), pg_field_prtlen() and pg_field_is_null()
• ldap_connect() with more than two arguments and ldap_exop() with more than four
• raising zero to a negative power with ** or pow(), and naming a class _

Behaviour and configuration changes

php.net: incompatible changes, deprecated features, removed extensions, new functions, new classes.

Tooling

One pass of open source checks across 8.2 to 8.4

While production stays on 8.2, every fix has to run there too, so check against the full range rather than 8.4 alone. These tools analyse source code; they do not run it.

• PHPStan accepts a phpVersion range (PHPStan 2.0 onwards), as in the configuration below.
• PHPCompatibility, a standard for PHP_CodeSniffer, takes --runtime-set testVersion 8.2-8.4. Its coverage of recent PHP versions is in the 10.0 pre-releases (10.0.0-alpha2 is the latest, from November 2025), which its README installs with ^10.0.0@dev.
• Rector can apply its PHP sets up to 8.4 with withPhpSets(php84: true), but some of those rules rewrite code to use features 8.2 lacks. Review the --dry-run diff with that in mind, or hold the 8.4 set until production has switched.
• php -m on the current server, filtered for imap, oci8, pdo_oci and pspell, tells you at once whether the unbundling affects you.

# phpstan.neon: keep the code valid on 8.2, 8.3 and 8.4 during the move
parameters:
    phpVersion:
        min: 80200
        max: 80400

Project documentation: PHPStan, PHPCompatibility, PHP_CodeSniffer, Rector.

• Nextcloud: 33 and 34 mark 8.2 deprecated and 33 recommends 8.4; 35 drops 8.2 altogether.
• Magento 2: 2.4.7 covers 8.2 and 8.3; for 8.4 you need 2.4.8.
• Moodle: 5.0 and 5.1 have 8.2 as their minimum and can use 8.4.
• Laravel: 11, 12 and 13 all support 8.4; 13 requires at least 8.3.
• Drupal: 10.4 to 10.6 accept 8.2 to 8.4; 11.1 to 11.4 accept 8.3 and 8.4.
• PrestaShop 9.0 and Joomla 6 both name 8.4 as their recommended version.
• WooCommerce: needs at least 8.3, and its testing goes up to 8.4.
• OpenMage: supports 8.4, noting that some warnings may be logged.

Server side: PHP update guides for Linux, cPanel, Plesk, PHP-FPM, Docker, Apache and Windows and IIS. Neighbouring routes: 8.2 to 8.3, 7.4 to 8.4, 8.1 to 8.4, 8.0 to 8.4, 7.4 to 8.3 and 8.1 to 8.3.