PHP 8.2 is approaching the end of its security support window on 31 December 2026. I would rather deal with that during an ordinary maintenance cycle than discover it while everyone is trying to finish work before Christmas. A supported runtime is a fairly basic requirement, even when the application itself has barely changed.
The official support table distinguishes active support from security-only support. Those are different promises. Staying on a security-only branch can be a temporary choice, but it needs an end date and an owner. The absence of a recent bug in your application does not extend the runtime’s support window.
I would start with the application’s actual dependencies: the framework, Composer packages, extensions and any deployment image. Pick a supported target that those components can use, then test the real application paths rather than only checking that PHP starts. Background jobs and command-line scripts deserve attention too; they are easy to forget when the website looks fine.
An upgrade does not need to include every new language feature. Get the existing code running correctly first, ship that change, and tidy up separately if there is a useful reason. Runtime maintenance becomes much less dramatic when it is treated as regular work instead of an occasional rescue operation.