Unless the magical code generation machine can update packages that are no longer being updated, this isn't really a problem that can be solved with magical code generation.
replyThe slop machine can backport the fix to PHP 5, or make your code compatible with PHP 8.
replyBackporting the fix is much lower effort in total. It's just a few dozen minor PHP releases that are affected, but millions of websites still running on older PHP versions.
replyYes but it can't actually upgrade and release packages for discontinued distro release streams, that's a human problem.
replypeople running "older versions that no longer receive security updates" are unlikely to update to some new patch-stream from this tooling, because they're already not maintaining their infrastructure.
replyno. I think they mean how to navigate the non technical organizational challenge, not how to technically fix the thing
replyit’s a quite simple matter to fix a bug once it’s discovered, but how to deploy and where to deploy it when it affects a supply chain?
here’s an example: you can submit a vuln at a downstream dep and they can tell you it should be patched upstream. what should you do? open an issue upstream? maybe, probably not, probably the solution is to contact all downstream deps in order to get them to migrate dep or patch, because you just reported a vuln and they shrugged it off