My Laravel 4.2 package hit 250 thousand downloads

Yes you read that correctly. My Laravel 4.2 package hit 250 thousand downloads (253,916 at the time of writing this article).

First thing to point out is what the package is for. The package overrides Laravel’s Encrypter, which using mycrypt under the hood, to allow it to use a more modern encrypter. There is also a hardcoded check elsewhere in Laravel to check mycrypt is installed. Because of this, it meant you couldn’t upgrade to PHP 7.1 from 5.6, because of mcrypt being deprecated, and this results in a lot of deprecation warnings.

The Encrypter class that gets used instead is a backport from Laravel 5.4, which uses a sha256 encrypter and a cipher of your choice (AES-128-CBC or AES-256-CBC).

This was originally done by someone I worked with (thanks Pete!), on a work project, and later I ported it to a package with unit tests.

Now there are a few things interesting about this.

1 — How old Laravel 4.2 is

Laravel 4.2 was originally released in 2014, which used PHP 5.4. I couldn’t find an official end of life date for Larvel 4.2, but I presume it would have been around version 5 coming out in 2015.

PHP 5.4’s end of life date was 3rd Sep 2015.

So both of these have not had updates in at least 10 years.

2 — What the true reality of upgrading is

Now this will differ per teams or companies, but upgrading could be easier at the start when the application is smaller, but as soon as more features are added, this can become harder. New features are prioritised over maintenance.

Some might say, if the applicaton works, whats the hurry to upgrade. There are new Laravel and PHP versions every year, some include breaking changes, some don’t.

The evolution of the languages and frameworks means at some point, you have to built the bullet and upgrade, but the fact that there are Laravel 4.2 apps running PHP 7.1, shows that people don’t maintain there applications like they should.

These are that old, there could be security related bugs in either 1st or 3rd party packages, or other services required to run PHP 7.1.

3 — I released a useful package

Releasing open source work can be a tricky business. Well, realising it can be relatively simple. Getting people to use it and feedback is the tricky part.

The package may be useful to you, but will it be useful to other people? It was definitely required back in the day, due to how the Laravel framework was structured. Upgrading from 4.2 to 5 may have been tricky for some people, so if you wanted to use Laravel 4.2 for a bit longer, while using a newer PHP version, this package helped with that.

Summary

Its interesting to see the true reality of using old versions of PHP, Laravel and other technology.

While its nice to keep projects up to date, this sometimes doesn’t align with the company or businesses goals, and you are stuck using old technology until it becomes a problem.