Looks good to me (appveyor failure is unrelated - existed before)

Out of curiosity: Do you know why7.2.9 was originally picked as minimal requirement?

I think it's the version Debian ships

Why was the min PHP-version lowered to7.2.5 and not7.2?

.0 versions are always buggy and we don't want to test with them and workaround these early bugs.

mhm, seems to not being accepted?

Note:
7.2.5 -> Security fix
7.2.8 -> Security fix

https://www.php.net/ChangeLog-7.php#PHP_7_2

Maybe a good idea to note somewhere that, although Symfony supports 7.2.5, it is advised to always update to latest patch?

Also, I would guess the core team already has ideas/has thought about this, but 7.1 security support is being dropped at the end of the month. Same for 7.2 only receiving security patches as of 30 nov. Haven't seen documentation specifically relating to this? (Symfony 3.4 LTS supports 7.0 and up?)

Could be, but SUSE Linux (up to 15) only has php 7.2.5. This is a major show stopper.

Distributions backport security fixes, that's why ppl pay for them. It's not our job to safeguard ppl from themselves :)

tests are failing for the Cache PdoAdapter and the Lock PdoStore. Not sure whether this is related to the new PHP version or whether they were already broken on Windows.

@stof not related to this PR, I noticed these failures before, reported in#34444

Thank you@nicolas-grekas.

Will this trickle down to the repo

https://github.com/symfony/contracts/blob/master/composer.json

?

@Defcon0 yes, see PR description :)

Should be applied to symfony/*skeleton also

@nicolas-grekas Could you please tag the contracts bundle to 2.0.1? We need the fix quite urgently ;-) Thanks!

Any news on the 2.0.1 contracts tag?

Any news on the 2.0.1 contracts tag?

The core team is probably busy with SymfonyCon right now. Please have a little patience. You can require^2@dev in the meantime, if the missing tag really blocks you.