Code auditing

Growing Older With PHP

Posted on by dams

Getting Older With PHP

Exakat runs continuous audits on over 1750 Open source applications, components and frameworks. This is a reality torture test : any error or unexpected results are reviewed and help update the analysis library and the Exakat engine itself. This is a golden mine of tests and real code : an exceptional complement to unit tests. Many, many thanks to all the developers of the PHP community!

Sourcing PHP Codes

Those applications are accumulated as the days passes : from security web sites (www.phpsecure.info), PHP on reddit, PHP weekly interesting applications, or serial authors like Nino Maduro or Mathieu Napoli. It takes some luck to realize that Open Cimetiere is an Open Source graveyard management system, written in PHP.

Although new code bases are welcome and sought after so as to check the new PHP 8.0 features in real code (Keep them coming!, some very old code bases are in this corpus, so as to ensure that fantastic syntaxes are still correctly managed.

Last Commits Per Year

This lead to an interesting question : however this wide range of projects is neded for quality control with Exakat, what does it tell us about the impact of time on PHP code bases? To check this, we collected the date of last commit on 1161 projects. We took the date of the last project commit, and measured the interval with now.

Age of the last commit, in PHP OSS repositories, by year

In terms of years, about 45% were updated during the last year, and 77% were within two years. It decreases exponentially, as expected : the older projects are rarer.

Last Commits By Month

We also detailed the same dates by monthly intervals, instead of a year. This lead to a more fine-grained graph.

Again, we see 2 peaks : the first dates back from 5 months ago, which is May 2020. It is not clear if we can link this to the pandemic and to more contributions before the lock down relaxing from June.

 

Age of the last commit, in PHP OSS repositories, by month

The second peak dates back one year ago, exactly. Last year, early November, we were also getting ready for the next version of PHP : PHP 7.4. This sparked a frenzy of update, which stopped after the publication. Interestingly, this shows that a significant number of PHP projects are stable and mature. They may require some maintenance for forward compatibility, but they don’t need more care later.

Commits by weeks and days

Finally, we broke down the data to weeks and days : this ended up as a white noise, with nothing significant emerging. Apparently, the cycle of development of PHP projects focuses around its version, and not holidays or yearly events. Even thursdays, which are the official day for new minor versions, doesn’t appear in those stats.

What About A ‘Commit Day’ for 2021?

Not even PHP birthday’s, on June 8th, create a commit fever. Maybe we could declare it the year’s ‘Commit day’ and make it a special moment next year! What a celebration!