[crazywhalecc]

What does this PR do?

For older version who still wants to build.

Checklist before merging

• If you modified *.php or *.yml, run them locally to ensure your changes are valid:
  • composer cs-fix
  • composer analyse
  • composer test
  • bin/spc dev:lint-config

[henderkes]

I would prefer not to do this. If someone wants backported fixes to officially unmaintained versions, they can pay someone for a SLA.

[crazywhalecc]

These are the PHP security team's own minimal backports, not something we wrote. They apply cleanly to 7.4.33, 8.0.30 , 8.1.34, and I verified minimal CLI builds with session on all three.

PHP published those backports specifically to help people building from source or without access to an LTS vendor which is exactly the static-php-cli audience.

If the concern is the default behavior, I'm fine changing this to opt-in, e.g. --with-eol-security-backports, plus an explicit "EOL / unsupported" warning. If you'd still prefer not to carry them at all, I'm okay to close it and add a short doc notification instead.

[henderkes]

No, that's fine then, don't want an extra option, just merge like this.