Refreshing the policy#
This page explains how bin/refresh-policy.php keeps every support date, patch and new line in policy/policy.json tied to a canonical source, so nobody types a date by hand.
Sources per component#
PHP dates come from php.net, Node dates from the Node.js release schedule, and Laravel, MySQL, Vue and Composer from endoflife.date; patches come from php.net, nodejs.org, Packagist and npm.
Change classes#
Each run sorts every change into a class:
| Class | What it is | What happens |
|---|---|---|
tighten |
a date moves earlier, or a current line gets its first end date |
written |
neutral |
a new latest_patch, or a new line above every listed line |
written |
loosen-warning |
active_until moves later (a warning tier, never a failure) |
written |
loosen-fail |
security_until moves later, or an EOL line would be supported again |
held, unless two independent sources agree (php.net and endoflife.date for PHP, schedule.json and endoflife.date for Node) or policy/sources.json shows the same value from the same source for 14 days |
refused |
removing a line or a date, or any change to tools or rules |
never automatic; reported (a Composer minimum on an EOL line shows up here) |
When a source is down#
A source that is down, slow or returns something unreadable changes nothing: its fields keep their last good value. A line missing from a feed is never removed. Where a first-party source and endoflife.date disagree, the first party wins and the disagreement is reported.
Running the refresher#
php bin/refresh-policy.php [--dry-run] [--offline <dir>] [--policy <path>]
[--sources <path>] [--report <file>] [--today YYYY-MM-DD] [--touch]
--report writes JSON with changes, held, refused, disagreements and source_errors. --touch sets refreshed_on to today even when nothing else changed (the weekly heartbeat). policy/sources.json records, per value, which source said it, and the first and last day it was seen.
Exit codes#
Exit codes: 0 nothing worth committing (always 0 with --dry-run); 1 hard failure; 3 something was written to policy/policy.json or policy/sources.json, including a released loosen-fail (the policy robot raises the alert from the report); 4 something was held or refused; nothing is committed for that run. Written changes are always written.
bin/refresh-patches.php still works as before.