-
Notifications
You must be signed in to change notification settings - Fork 534
/
ChangeLog-8.php
6932 lines (6635 loc) · 291 KB
/
ChangeLog-8.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?php
$_SERVER['BASE_PAGE'] = 'ChangeLog-8.php';
include_once __DIR__ . '/include/prepend.inc';
include_once __DIR__ . '/include/changelogs.inc';
$MINOR_VERSIONS = ['8.3', '8.2', '8.1', '8.0'];
changelog_header(8, $MINOR_VERSIONS);
?>
<a id="PHP_8_3"></a>
<section class="version" id="8.3.12"><!-- {{{ 8.3.12 -->
<h3>Version 8.3.12</h3>
<b><?php release_date('26-Sep-2024'); ?></b>
<ul><li>CGI:
<ul>
<li>Fixed bug <?php githubsecurityl('php/php-src', 'p99j-rfp4-xqvq'); ?> (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)</li>
<li>Fixed bug <?php githubsecurityl('php/php-src', '94p6-54jq-9mwp'); ?> (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)</li>
</ul></li>
<li>Core:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15408); ?> (MSan false-positve on zend_max_execution_timer).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15515); ?> (Configure error grep illegal option q).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15514); ?> (Configure error: genif.sh: syntax error).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15565); ?> (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15587); ?> (CRC32 API build error on arm 32-bit).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15330); ?> (Do not scan generator frames more than once).</li>
<li>Fixed uninitialized lineno in constant AST of internal enums.</li>
</ul></li>
<li>Curl:
<ul>
<li>FIxed bug <?php githubissuel('php/php-src', 15547); ?> (curl_multi_select overflow on timeout argument).</li>
</ul></li>
<li>DOM:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15551); ?> (Segmentation fault (access null pointer) in ext/dom/xml_common.h).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15654); ?> (Signed integer overflow in ext/dom/nodelist.c).</li>
</ul></li>
<li>Fileinfo:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15752); ?> (Incorrect error message for finfo_file with an empty filename argument).</li>
</ul></li>
<li>FPM:
<ul>
<li>Fixed bug <?php githubsecurityl('php/php-src', '865w-9rf3-2wh5'); ?> (Logs from childrens may be altered). (CVE-2024-9026)</li>
</ul></li>
<li>MySQLnd:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15432); ?> (Heap corruption when querying a vector).</li>
</ul></li>
<li>Opcache:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15661); ?> (Access null pointer in Zend/Optimizer/zend_inference.c).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15658); ?> (Segmentation fault in Zend/zend_vm_execute.h).</li>
</ul></li>
<li>SAPI:
<ul>
<li>Fixed bug <?php githubsecurityl('php/php-src', '9pqp-7h25-4f32'); ?> (Erroneous parsing of multipart form data). (CVE-2024-8925)</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15552); ?> (Signed integer overflow in ext/standard/scanf.c).</li>
</ul></li>
<li>Streams:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15628); ?> (php_stream_memory_get_buffer() not zero-terminated).</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.11"><!-- {{{ 8.3.11 -->
<h3>Version 8.3.11</h3>
<b><?php release_date('29-Aug-2024'); ?></b>
<ul><li>Core:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15020); ?> (Memory leak in Zend/Optimizer/escape_analysis.c).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15023); ?> (Memory leak in Zend/zend_ini.c).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13330); ?> (Append -Wno-implicit-fallthrough flag conditionally).</li>
<li>Fix uninitialized memory in network.c.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15108); ?> (Segfault when destroying generator during shutdown).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15275); ?> (Crash during GC of suspended generator delegate).</li>
</ul></li>
<li>Curl:
<ul>
<li>Fixed case when curl_error returns an empty string.</li>
</ul></li>
<li>DOM:
<ul>
<li>Fix UAF when removing doctype and using foreach iteration.</li>
</ul></li>
<li>FFI:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14286); ?> (ffi enum type (when enum has no name) make memory leak).</li>
</ul></li>
<li>Hash:
<ul>
<li>Fix crash when converting array data for array in shm in xxh3.</li>
</ul></li>
<li>Intl:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15087); ?> (IntlChar::foldCase()'s $option is not optional).</li>
</ul></li>
<li>Opcache:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13817); ?> (Segmentation fault for enabled observers after pass 4).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13775); ?> (Memory leak possibly related to opcache SHM placement).</li>
</ul></li>
<li>Output:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15179); ?> (Segmentation fault (null pointer dereference) in ext/standard/url_scanner_ex.re).</li>
</ul></li>
<li>PDO_Firebird:
<ul>
<li>Fix bogus fallthrough path in firebird_handle_get_attribute().</li>
</ul></li>
<li>PHPDBG:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13199); ?> (EOF emits redundant prompt in phpdbg local console mode with libedit/readline).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15268); ?> (heap buffer overflow in phpdbg (zend_hash_num_elements() Zend/zend_hash.h)).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15210); ?> use-after-free on watchpoint allocations.</li>
</ul></li>
<li>Soap:
<ul>
<li><?php bugfix(55639); ?> (Digest autentication dont work).</li>
<li>Fix SoapFault property destruction.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15252); ?> (SOAP XML broken since PHP 8.3.9 when using classmap constructor option).</li>
</ul></li>
<li>Standard:
<ul>
<li>Fix passing non-finite timeout values in stream functions.</li>
<li>Fixed <?php githubissuel('php/php-src', 14780); ?> p(f)sockopen timeout overflow.</li>
</ul></li>
<li>Streams:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 15028); ?> (Memory leak in ext/phar/stream.c).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 15034); ?> (Integer overflow on stream_notification_callback byte_max parameter with files bigger than 2GB).</li>
<li>Reverted fix for <?php githubissuel('php/php-src', 14930); ?> (Custom stream wrapper dir_readdir output truncated to 255 characters).</li>
</ul></li>
<li>Tidy:
<ul>
<li>Fix memory leaks in ext/tidy basedir restriction code.</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.10"><!-- {{{ 8.3.10 -->
<h3>Version 8.3.10</h3>
<b><?php release_date('01-Aug-2024'); ?></b>
<ul><li>Core:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13922); ?> (Fixed support for systems with sysconf(_SC_GETPW_R_SIZE_MAX) == -1).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14626); ?> (Fix is_zend_ptr() for huge blocks).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14590); ?> (Memory leak in FPM test gh13563-conf-bool-env.phpt.</li>
<li>Fixed OSS-Fuzz #69765.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14741); ?> (Segmentation fault in Zend/zend_types.h).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14969); ?> (Use-after-free in property coercion with __toString()).</li>
</ul></li>
<li>Dom:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14702); ?> (DOMDocument::xinclude() crash).</li>
</ul></li>
<li>Fileinfo:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14888); ?> (README.REDIST.BINS refers to non-existing LICENSE).</li>
</ul></li>
<li>Gd:
<ul>
<li>ext/gd/tests/gh10614.phpt: skip if no PNG support.</li>
<li>restored warning instead of fata error.</li>
</ul></li>
<li>LibXML:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14563); ?> (Build failure with libxml2 v2.13.0).</li>
</ul></li>
<li>Opcache:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14550); ?> (No warning message when Zend DTrace is enabled that opcache.jit is implictly disabled).</li>
</ul></li>
<li>Output:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14808); ?> (Unexpected null pointer in Zend/zend_string.h with empty output buffer).</li>
</ul></li>
<li>PDO:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14712); ?> (Crash with PDORow access to null property).</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14603); ?> (null string from zip entry).</li>
</ul></li>
<li>PHPDBG:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14596); ?> (crashes with ASAN and ZEND_RC_DEBUG=1).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14553); ?> (echo output trimmed at NULL byte).</li>
</ul></li>
<li>Shmop:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14537); ?> (shmop Windows 11 crashes the process).</li>
</ul></li>
<li>SPL:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14639); ?> (Member access within null pointer in ext/spl/spl_observer.c).</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14775); ?> (range function overflow with negative step argument).</li>
<li>Fix 32-bit wordwrap test failures.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14774); ?> (time_sleep_until overflow).</li>
</ul></li>
<li>Streams:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14930); ?> (Custom stream wrapper dir_readdir output truncated to 255 characters in PHP 8.3).</li>
</ul></li>
<li>Tidy:
<ul>
<li>Fix memory leak in tidy_repair_file().</li>
</ul></li>
<li>Treewide:
<ul>
<li>Fix compatibility with libxml2 2.13.2.</li>
</ul></li>
<li>XML:
<ul>
<li>Move away from to-be-deprecated libxml fields.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14834); ?> (Error installing PHP when --with-pear is used).</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.9"><!-- {{{ 8.3.9 -->
<h3>Version 8.3.9</h3>
<b><?php release_date('04-Jul-2024'); ?></b>
<ul><li>Core:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14315); ?> (Incompatible pointer type warnings).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12814); ?> (max_execution_time reached too early on MacOS 14 when running on Apple Silicon).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14387); ?> (Crash when stack walking in destructor of yielded from values during Generator->throw()).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14456); ?> (Attempting to initialize class with private constructor calls destructor).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14510); ?> (memleak due to missing pthread_attr_destroy()-call).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14549); ?> (Incompatible function pointer type for fclose).</li>
</ul></li>
<li>BCMatch:
<ul>
<li>Fixed bug (bcpowmod() with mod = -1 returns 1 when it must be 0).</li>
</ul></li>
<li>Curl:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14307); ?> (Test curl_basic_024 fails with curl 8.8.0).</li>
</ul></li>
<li>DOM:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14343); ?> (Memory leak in xml and dom).</li>
</ul></li>
<li>FPM:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14037); ?> (PHP-FPM ping.path and ping.response config vars are ignored in status pool).</li>
</ul></li>
<li>GD:
<ul>
<li>Fix parameter numbers for imagecolorset().</li>
</ul></li>
<li>Intl:
<ul>
<li>Fix reference handling in SpoofChecker.</li>
</ul></li>
<li>MySQLnd:
<ul>
<li>Partially fix bug <?php githubissuel('php/php-src', 10599); ?> (Apache crash on Windows when using a self-referencing anonymous function inside a class with an active mysqli connection).</li>
</ul></li>
<li>Opcache:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14267); ?> (opcache.jit=off does not allow enabling JIT at runtime).</li>
<li>Fixed TLS access in JIT on FreeBSD/amd64.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11188); ?> (Error when building TSRM in ARM64).</li>
</ul></li>
<li>PDO ODBC:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14367); ?> (incompatible SDWORD type with iODBC).</li>
</ul></li>
<li>PHPDBG:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13681); ?> (segfault on watchpoint addition failure).</li>
</ul></li>
<li>Soap:
<ul>
<li><?php bugfix(47925); ?> (PHPClient can't decompress response).</li>
<li>Fix missing error restore code.</li>
<li>Fix memory leak if calling SoapServer::setObject() twice.</li>
<li>Fix memory leak if calling SoapServer::setClass() twice.</li>
<li>Fix reading zlib ini settings in ext-soap.</li>
<li>Fix memory leaks with string function name lookups.</li>
<li><?php bugfix(69280); ?> (SoapClient classmap doesn't support fully qualified class name).</li>
<li><?php bugfix(76232); ?> (SoapClient Cookie Header Semicolon).</li>
<li>Fixed memory leaks when calling SoapFault::__construct() twice.</li>
</ul></li>
<li>Sodium:
<ul>
<li>Fix memory leaks in ext/sodium on failure of some functions.</li>
</ul></li>
<li>SPL:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14290); ?> (Member access within null pointer in extension spl).</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14483); ?> (Fixed off-by-one error in checking length of abstract namespace Unix sockets).</li>
</ul></li>
<li>Streams:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 11078); ?> (PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors).</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.8"><!-- {{{ 8.3.8 -->
<h3>Version 8.3.8</h3>
<b><?php release_date('06-Jun-2024'); ?></b>
<ul><li>CGI:
<ul>
<li>Fixed buffer limit on Windows, replacing read call usage by _read.</li>
<li>Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)</li>
</ul></li>
<li>CLI:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14189); ?> (PHP Interactive shell input state incorrectly handles quoted heredoc literals.).</li>
</ul></li>
<li>Core:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13970); ?> (Incorrect validation of #[Attribute] flags type for non-compile-time expressions).</li>
</ul></li>
<li>DOM:
<ul>
<li>Fix crashes when entity declaration is removed while still having entity references.</li>
<li>Fix references not handled correctly in C14N.</li>
<li>Fix crash when calling childNodes next() when iterator is exhausted.</li>
<li>Fix crash in ParentNode::append() when dealing with a fragment containing text nodes.</li>
</ul></li>
<li>Filter:
<ul>
<li>Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)</li>
</ul></li>
<li>FPM:
<ul>
<li>Fix bug <?php githubissuel('php/php-src', 14175); ?> (Show decimal number instead of scientific notation in systemd status).</li>
</ul></li>
<li>Hash:
<ul>
<li>ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi)</li>
</ul></li>
<li>Intl:
<ul>
<li>Fixed build regression on systems without C++17 compilers.</li>
</ul></li>
<li>MySQLnd:
<ul>
<li>Fix bug <?php githubissuel('php/php-src', 14255); ?> (mysqli_fetch_assoc reports error from nested query).</li>
</ul></li>
<li>Opcache:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14109); ?> (Fix accidental persisting of internal class constant in shm).</li>
</ul></li>
<li>OpenSSL:
<ul>
<li>The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)</li>
</ul></li>
<li>XML:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14124); ?> (Segmentation fault with XML extension under certain memory limit).</li>
</ul></li>
<li>XMLReader:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 14183); ?> (XMLReader::open() can't be overridden).</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.7"><!-- {{{ 8.3.7 -->
<h3>Version 8.3.7</h3>
<b><?php release_date('09-May-2024'); ?></b>
<ul><li>Core:
<ul>
<li>Fixed zend_call_stack build with Linux/uclibc-ng without thread support.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13772); ?> (Invalid execute_data->opline pointers in observer fcall handlers when JIT is enabled).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13931); ?> (Applying zero offset to null pointer in Zend/zend_opcode.c).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13942); ?> (Align the behavior of zend-max-execution-timers with other timeout implementations).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14003); ?> (Broken cleanup of unfinished calls with callable convert parameters).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 14013); ?> (Erroneous dnl appended in configure).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 10232); ?> (If autoloading occurs during constant resolution filename and lineno are identified incorrectly).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13727); ?> (Missing void keyword).</li>
</ul></li>
<li>Fibers:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13903); ?> (ASAN false positive underflow when executing copy()).</li>
</ul></li>
<li>Fileinfo:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13795); ?> (Test failing in ext/fileinfo/tests/bug78987.phpt on big-endian PPC).</li>
</ul></li>
<li>FPM:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13563); ?> (Setting bool values via env in FPM config fails).</li>
</ul></li>
<li>Intl:
<ul>
<li>Fixed build for icu 74 and onwards.</li>
</ul></li>
<li>MySQLnd:
<ul>
<li>Fix shift out of bounds on 32-bit non-fast-path platforms.</li>
</ul></li>
<li>Opcache:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13433); ?> (Segmentation Fault in zend_class_init_statics when using opcache.preload).</li>
<li>Fixed incorrect assumptions across compilation units for static calls.</li>
</ul></li>
<li>OpenSSL:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 10495); ?> (feof on OpenSSL stream hangs indefinitely).</li>
</ul></li>
<li>PDO SQLite:
<ul>
<li>Fix <?php githubissuel('php/php-src', 13984); ?> (Buffer size is now checked before memcmp).</li>
<li>Fix <?php githubissuel('php/php-src', 13998); ?> (Manage refcount of agg_context->val correctly).</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13836); ?> (Renaming a file in a Phar to an already existing filename causes a NULL pointer dereference).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13833); ?> (Applying zero offset to null pointer in zend_hash.c).</li>
<li>Fix potential NULL pointer dereference before calling EVP_SignInit.</li>
</ul></li>
<li>PHPDBG:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13827); ?> (Null pointer access of type 'zval' in phpdbg_frame).</li>
</ul></li>
<li>Posix:
<ul>
<li>Fix usage of reentrant functions in ext/posix.</li>
</ul></li>
<li>Session:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13856); ?> (Member access within null pointer of type 'ps_files' in ext/session/mod_files.c).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13891); ?> (memleak and segfault when using ini_set with session.trans_sid_hosts).</li>
<li>Fixed buffer _read/_write size limit on windows for the file mode.</li>
</ul></li>
<li>Streams:
<ul>
<li>Fixed file_get_contents() on Windows fails with "errno=22 Invalid argument".</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13264); ?> (Part 1 - Memory leak on stream filter failure).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13860); ?> (Incorrect PHP_STREAM_OPTION_CHECK_LIVENESS case in ext/openssl/xp_ssl.c - causing use of dead socket).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11678); ?> (Build fails on musl 1.2.4 - lfs64).</li>
</ul></li>
<li>Treewide:
<ul>
<li>Fix gcc-14 Wcalloc-transposed-args warnings.</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.6"><!-- {{{ 8.3.6 -->
<h3>Version 8.3.6</h3>
<b><?php release_date('11-Apr-2024'); ?></b>
<ul><li>Core:
<ul>
<li>Fixed <?php githubissuel('php/php-src', 13569); ?> (GC buffer unnecessarily grows up to GC_MAX_BUF_SIZE when scanning WeakMaps).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13612); ?> (Corrupted memory in destructor with weak references).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13446); ?> (Restore exception handler after it finishes).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13784); ?> (AX_GCC_FUNC_ATTRIBUTE failure).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13670); ?> (GC does not scale well with a lot of objects created in destructor).</li>
</ul></li>
<li>DOM:
<ul>
<li>Add some missing ZPP checks.</li>
<li>Fix potential memory leak in XPath evaluation results.</li>
</ul></li>
<li>FPM:
<ul>
<li>Fixed <?php githubissuel('php/php-src', 11086); ?> (FPM: config test runs twice in daemonised mode).</li>
<li>Fix incorrect check in fpm_shm_free().</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12019); ?> (add GDLIB_CFLAGS in feature tests).</li>
</ul></li>
<li>Gettext:
<ul>
<li>Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.</li>
</ul></li>
<li>MySQLnd:
<ul>
<li>Fix <?php githubissuel('php/php-src', 13452); ?> (Fixed handshake response [mysqlnd]).</li>
<li>Fix incorrect charset length in check_mb_eucjpms().</li>
</ul></li>
<li>Opcache:
<ul>
<li>Fixed <?php githubissuel('php/php-src', 13508); ?> (JITed QM_ASSIGN may be optimized out when op1 is null).</li>
<li>Fixed <?php githubissuel('php/php-src', 13712); ?> (Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded).</li>
</ul></li>
<li>Random:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13544); ?> (Pre-PHP 8.2 compatibility for mt_srand with unknown modes).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13690); ?> (Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used).</li>
</ul></li>
<li>Session:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13680); ?> (Segfault with session_decode and compilation error).</li>
</ul></li>
<li>SPL:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13685); ?> (Unexpected null pointer in zend_string.h).</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 11808); ?> (Live filesystem modified by tests).</li>
<li>Fixed <?php githubissuel('php/php-src', 13402); ?> (Added validation of `\n` in $additional_headers of mail()).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13203); ?> (file_put_contents fail on strings over 4GB on Windows).</li>
<li>Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)</li>
<li>Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)</li>
<li>Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)</li>
<li>Fixed bug GHSA-fjp9-9hwx-59fq (mb_encode_mimeheader runs endlessly for some inputs). (CVE-2024-2757)</li>
<li>Fix bug <?php githubissuel('php/php-src', 13932); ?> (Attempt to fix mbstring on windows build) (msvc).</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.4"><!-- {{{ 8.3.4 -->
<h3>Version 8.3.4</h3>
<b><?php release_date('14-Mar-2024'); ?></b>
<ul><li>Core:
<ul>
<li>Fix ZTS persistent resource crashes on shutdown.</li>
</ul></li>
<li>Curl:
<ul>
<li>Fix failing tests due to string changes in libcurl 8.6.0.</li>
</ul></li>
<li>DOM:
<ul>
<li>Fix unlikely memory leak in case of namespace removal with extremely deep trees.</li>
<li>Fix reference access in dimensions for DOMNodeList and DOMNodeMap.</li>
</ul></li>
<li>Fileinfo:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13344); ?> (finfo::buffer(): Failed identify data 0:(null), backport).</li>
</ul></li>
<li>FPM:
<ul>
<li><?php bugfix(75712); ?> (getenv in php-fpm should not read $_ENV, $_SERVER).</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12019); ?> (detection of image formats in system gd library).</li>
</ul></li>
<li>MySQLnd:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 11950); ?> ([mysqlnd] Fixed not to set CR_MALFORMED_PACKET to error if CR_SERVER_GONE_ERROR is already set).</li>
</ul></li>
<li>PDO:
<ul>
<li>Fix various PDORow bugs.</li>
</ul></li>
<li>PGSQL:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13354); ?> (pg_execute/pg_send_query_params/pg_send_execute with null value passed by reference).</li>
</ul></li>
<li>SPL:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13531); ?> (Unable to resize SplfixedArray after being unserialized in PHP 8.2.15).</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13279); ?> (Instable array during in-place modification in uksort).</li>
<li>Fixed array key as hash to string (case insensitive) comparison typo for the second operand buffer size (albeit unused for now).</li>
</ul></li>
<li>XML:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13517); ?> (Multiple test failures when building with --with-expat).</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.3"><!-- {{{ 8.3.3 -->
<h3>Version 8.3.3</h3>
<b><?php release_date('15-Feb-2024'); ?></b>
<ul><li>Core:
<ul>
<li>Fixed timer leak in zend-max-execution-timers builds.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12349); ?> (linking failure on ARM with mold).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13097); ?> (Anonymous class reference in trigger_error / thrown Exception).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13177); ?> (PHP 8.3.2: final private constructor not allowed when used in trait).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13215); ?> (GCC 14 build failure).</li>
</ul></li>
<li>Curl:
<ul>
<li>Fix missing error check in curl_multi_init().</li>
</ul></li>
<li>FPM:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12996); ?> (Incorrect SCRIPT_NAME with Apache ProxyPassMatch when plus in path).</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 10344); ?> (imagettfbbox(): Could not find/open font UNC path).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 10614); ?> (imagerotate will turn the picture all black, when rotated 90).</li>
</ul></li>
<li>LibXML:
<ul>
<li>Fix crashes with entity references and predefined entities.</li>
</ul></li>
<li>MySQLnd:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12107); ?> (When running a stored procedure (that returns a result set) twice, PHP crashes).</li>
</ul></li>
<li>Opcache:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13145); ?> (strtok() is not comptime).</li>
<li>Fixed type inference of range().</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13232); ?> (Segmentation fault will be reported when JIT is off but JIT_debug is still on).</li>
</ul></li>
<li>OpenSSL:
<ul>
<li>Fixed LibreSSL undefined reference when OPENSSL_NO_ENGINE not set. (David Carlier).</li>
</ul></li>
<li>PDO_Firebird:
<ul>
<li>Fix <?php githubissuel('php/php-src', 13119); ?> (Changed to convert float and double values into strings using `H` format).</li>
</ul></li>
<li>Phar:
<ul>
<li><?php bugfix(71465); ?> (PHAR doesn't know about litespeed).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13037); ?> (PharData incorrectly extracts zip file).</li>
</ul></li>
<li>Random:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13138); ?> (Randomizer::pickArrayKeys() does not detect broken engines).</li>
</ul></li>
<li>Session:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12504); ?> (Corrupted session written when there's a fatal error in autoloader).</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13094); ?> (range(9.9, '0') causes segmentation fault).</li>
</ul></li>
<li>Streams:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 13071); ?> (Copying large files using mmap-able source streams may exhaust available memory and fail).</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.2"><!-- {{{ 8.3.2 -->
<h3>Version 8.3.2</h3>
<b><?php release_date('18-Jan-2024'); ?></b>
<ul><li>Core:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12953); ?> (false positive SSA integrity verification failed when loading composer classmaps with more than 11k elements).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12999); ?> (zend_strnlen build when strnlen is unsupported).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12966); ?> (missing cross-compiling 3rd argument so Autoconf doesn't emit warnings).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12854); ?> (8.3 - as final trait-used method does not correctly report visibility in Reflection).</li>
</ul></li>
<li>Cli:
<ul>
<li>Fix incorrect timeout in built-in web server when using router script and max_input_time.</li>
</ul></li>
<li>DOM:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12870); ?> (Creating an xmlns attribute results in a DOMException).</li>
<li>Fix crash when toggleAttribute() is used without a document.</li>
<li>Fix crash in adoptNode with attribute references.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 13012); ?> (DOMNode::isEqualNode() is incorrect when attribute order is different).</li>
</ul></li>
<li>FFI:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 9698); ?> (stream_wrapper_register crashes with FFI\CData).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12905); ?> (FFI::new interacts badly with observers).</li>
</ul></li>
<li>Intl:
<ul>
<li>Fixed <?php githubissuel('php/php-src', 12943); ?> (IntlDateFormatter::__construct accepts 'C' as valid locale).</li>
</ul></li>
<li>Hash:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12936); ?> (hash() function hangs endlessly if using sha512 on strings >= 4GiB).</li>
</ul></li>
<li>ODBC:
<ul>
<li>Fix crash on Apache shutdown with persistent connections.</li>
</ul></li>
<li>Opcache:
<ul>
<li>Fixed oss-fuzz #64727 (JIT undefined array key warning may overwrite DIM with NULL when DIM is the same var as result).</li>
<li>Added workaround for SELinux mprotect execheap issue. See https://bugzilla.kernel.org/show_bug.cgi?id=218258.</li>
</ul></li>
<li>OpenSSL:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12987); ?> (openssl_csr_sign might leak new cert on error).</li>
</ul></li>
<li>PDO:
<ul>
<li>Fix <?php githubissuel('php/php-src', 12969); ?> (Fixed PDO::getAttribute() to get PDO::ATTR_STRINGIFY_FETCHES).</li>
</ul></li>
<li>PDO_ODBC:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12767); ?> (Unable to turn on autocommit mode with setAttribute()).</li>
</ul></li>
<li>PGSQL:
<ul>
<li>Fixed auto_reset_persistent handling and allow_persistent type.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12974); ?> (Apache crashes on shutdown when using pg_pconnect()).</li>
</ul></li>
<li>Phar:
<ul>
<li><?php bugfix(77432); ?> (Segmentation fault on including phar file).</li>
</ul></li>
<li>PHPDBG:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12962); ?> (Double free of init_file in phpdbg_prompt.c).</li>
</ul></li>
<li>SimpleXML:
<ul>
<li>Fix getting the address of an uninitialized property of a SimpleXMLElement resulting in a crash.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12929); ?> (SimpleXMLElement with stream_wrapper_register can segfault).</li>
</ul></li>
<li>Tidy:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12980); ?> (tidynode.props.attribute is missing "Boolean Attributes" and empty attributes).</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.1"><!-- {{{ 8.3.1 -->
<h3>Version 8.3.1</h3>
<b><?php release_date('21-Dec-2023'); ?></b>
<ul><li>Core:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12758); ?> / <?php githubissuel('php/php-src', 12768); ?> (Invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC).</li>
<li>Fix various missing NULL checks.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12835); ?> (Leak of call->extra_named_params on internal __call).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12826); ?> (Weird pointers issue in nested loops).</li>
</ul></li>
<li>FPM:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12705); ?> (Segmentation fault in fpm_status_export_to_zval).</li>
</ul></li>
<li>FTP:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 9348); ?> (FTP & SSL session reuse).</li>
</ul></li>
<li>LibXML:
<ul>
<li>Fixed test failures for libxml2 2.12.0.</li>
</ul></li>
<li>MySQLnd:
<ul>
<li>Avoid using uninitialised struct.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12791); ?> (Possible dereference of NULL in MySQLnd debug code).</li>
</ul></li>
<li>Opcache:
<ul>
<li>Fixed JIT bug (Function JIT emits "Uninitialized string offset" warning at the same time as invalid offset Error).</li>
<li>Fixed JIT bug (JIT emits "Attempt to assign property of non-object" warning at the same time as Error is being thrown).</li>
</ul></li>
<li>PDO PGSQL:
<ul>
<li>Fixed the default value of $fetchMode in PDO::pgsqlGetNotify() (kocsismate)</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug <?php githubissuel('php/php-src', 12838); ?> ([SOAP] Temporary WSDL cache files not being deleted).</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed <?php githubissuel('php/php-src', 12745); ?> (http_build_query() default null argument for $arg_separator is implicitly coerced to string).</li>
</ul></li>
</ul>
<!-- }}} --></section>
<section class="version" id="8.3.0"><!-- {{{ 8.3.0 -->
<h3>Version 8.3.0</h3>
<b><?php release_date('23-Nov-2023'); ?></b>
<ul><li>Bcmath:
<ul>
<li>Fixed <?php githubissuel('php/php-src', 11761); ?> (removing trailing zeros from numbers) (jorgsowa)</li>
</ul></li>
<li>CLI:
<ul>
<li>Added pdeathsig to builtin server to terminate workers when the master process is killed.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11104); ?> (STDIN/STDOUT/STDERR is not available for CLI without a script).</li>
<li>Implement <?php githubissuel('php/php-src', 10024); ?> (support linting multiple files at once using php -l).</li>
</ul></li>
<li>Core:
<ul>
<li>Fix <?php githubissuel('php/php-src', 11388); ?> (Allow "final" modifier when importing a method from a trait).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11406); ?> (segfault with unpacking and magic method closure).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 9388); ?> (Improve unset property and __get type incompatibility error message).</li>
<li>SA_ONSTACK is now set for signal handlers to be friendlier to other in-process code such as Go's cgo.</li>
<li>SA_ONSTACK is now set when signals are disabled.</li>
<li>Fix <?php githubissuel('php/php-src', 9649); ?>: Signal handlers now do a no-op instead of crashing when executed on threads not managed by TSRM.</li>
<li>Added shadow stack support for fibers.</li>
<li>Fix bug <?php githubissuel('php/php-src', 9965); ?> (Fix accidental caching of default arguments with side effects).</li>
<li>Implement <?php githubissuel('php/php-src', 10217); ?> (Use strlen() for determining the class_name length).</li>
<li>Fix bug <?php githubissuel('php/php-src', 8821); ?> (Improve line numbers for errors in constant expressions).</li>
<li>Fix bug <?php githubissuel('php/php-src', 10083); ?> (Allow comments between & and parameter).</li>
<li>Zend Max Execution Timers is now enabled by default for ZTS builds on Linux.</li>
<li>Fix bug <?php githubissuel('php/php-src', 10469); ?> (Disallow .. in open_basedir paths set at runtime).</li>
<li>Fix bug <?php githubissuel('php/php-src', 10168); ?>, <?php githubissuel('php/php-src', 10582); ?> (Various segfaults with destructors and VM return values).</li>
<li>Fix bug <?php githubissuel('php/php-src', 10935); ?> (Use of trait doesn't redeclare static property if class has inherited it from its parent).</li>
<li>Fix bug <?php githubissuel('php/php-src', 11154); ?> (Negative indices on empty array don't affect next chosen index).</li>
<li>Fix bug <?php githubissuel('php/php-src', 8846); ?> (Implement delayed early binding for classes without parents).</li>
<li>Fix bug #79836 (Segfault in concat_function).</li>
<li>Fix bug #81705 (type confusion/UAF on set_error_handler with concat operation).</li>
<li>Fix <?php githubissuel('php/php-src', 11348); ?> (Closure created from magic method does not accept named arguments).</li>
<li>Fix <?php githubissuel('php/php-src', 11388); ?> (Allow "final" modifier when importing a method from a trait).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11406); ?> (segfault with unpacking and magic method closure).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11507); ?> (String concatenation performance regression in 8.3).</li>
<li>Fixed <?php githubissuel('php/php-src', 11488); ?> (Missing "Optional parameter before required" deprecation on union null type).</li>
<li>Implement the #[\Override] attribute RFC.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11601); ?> (Incorrect handling of unwind and graceful exit exceptions).</li>
<li>Added zend_call_stack_get implementation for OpenBSD.</li>
<li>Add stack limit check in zend_eval_const_expr().</li>
<li>Expose time spent collecting cycles in gc_status().</li>
<li>Remove WeakMap entries whose key is only reachable through the entry value.</li>
<li>Resolve open_basedir paths on INI update.</li>
<li>Fixed oss-fuzz #60741 (Leak in open_basedir).</li>
<li>Fixed segfault during freeing of some incompletely initialized objects due to OOM error (PDO, SPL, XSL).</li>
<li>Introduced Zend guard recursion protection to fix __debugInfo issue.</li>
<li>Fixed oss-fuzz #61712 (assertion failure with error handler during binary op).</li>
<li>Fixed <?php githubissuel('php/php-src', 11847); ?> (DTrace enabled build is broken).</li>
<li>Fixed OSS Fuzz #61865 (Undef variable in ++/-- for declared property that is unset in error handler).</li>
<li>Fixed warning emitted when checking if a user stream is castable.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12123); ?> (Compile error on MacOS with C++ extension when using ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX).</li>
<li>Fixed bug <?php githubissuel('php/php-src', 12189); ?> (#[Override] attribute in trait does not check for parent class implementations).</li>
<li>Fixed OSS Fuzz #62294 (Unsetting variable after ++/-- on string variable warning).</li>
<li>Fixed buffer underflow when compiling memoized expression.</li>
<li>Fixed oss-fuzz #63802 (OP1 leak in error path of post inc/dec).</li>
</ul></li>
<li>Curl:
<ul>
<li>Added Curl options and constants up to (including) version 7.87.</li>
</ul></li>
<li>Date:
<ul>
<li>Implement More Appropriate Date/Time Exceptions RFC.</li>
</ul></li>
<li>DOM:
<ul>
<li>Fix bug <?php githubissuel('php/php-src', 8388); ?> (DOMAttr unescapes character reference).</li>
<li>Fix bug <?php githubissuel('php/php-src', 11308); ?> (getElementsByTagName() is O(N^2)).</li>
<li>Fix #79700 (wrong use of libxml oldNs leads to performance problem).</li>
<li>Fix #77894 (DOMNode::C14N() very slow on generated DOMDocuments even after normalisation).</li>
<li>Revert changes to DOMAttr::$value and DOMAttr::$nodeValue expansion.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11500); ?> (Namespace reuse in createElementNS() generates wrong output).</li>
<li>Implemented DOMDocument::adoptNode(). Previously this always threw a "not yet implemented" exception.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 9628); ?> (Implicitly removing nodes from \DOMDocument breaks existing references).</li>
<li>Added DOMNode::contains() and DOMNameSpaceNode::contains().</li>
<li>Added DOMElement::getAttributeNames().</li>
<li>Added DOMNode::getRootNode().</li>
<li>Added DOMElement::className and DOMElement::id.</li>
<li>Added DOMParentNode::replaceChildren().</li>
<li>Added DOMNode::isConnected and DOMNameSpaceNode::isConnected.</li>
<li>Added DOMNode::parentElement and DOMNameSpaceNode::parentElement.</li>
<li>Added DOMNode::isEqualNode().</li>
<li>Added DOMElement::insertAdjacentElement() and DOMElement::insertAdjacentText().</li>
<li>Added DOMElement::toggleAttribute().</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11792); ?> (LIBXML_NOXMLDECL is not implemented or broken).</li>
<li>adoptNode now respects the strict error checking property.</li>
<li>Align DOMChildNode parent checks with spec.</li>
<li><?php bugfix(80927); ?> (Removing documentElement after creating attribute node: possible use-after-free).</li>
<li>Fix various namespace prefix conflict resolution bugs.</li>
<li>Fix calling createAttributeNS() without prefix causing the default namespace of the element to change.</li>
<li>Fixed <?php githubissuel('php/php-src', 11952); ?> (Confusing warning when blocking entity loading via libxml_set_external_entity_loader).</li>
<li>Fix broken cache invalidation with deallocated and reallocated document node.</li>
<li>Fix compile error when php_libxml.h header is included in C++.</li>
<li><?php bugfix(47531); ?> (No way of removing redundant xmlns: declarations).</li>
</ul></li>
<li>Exif:
<ul>
<li>Removed unneeded codepaths in exif_process_TIFF_in_JPEG().</li>
</ul></li>
<li>FFI:
<ul>
<li>Implement <?php githubissuel('php/php-src', 11934); ?> (Allow to pass CData into struct and/or union fields).</li>
</ul></li>
<li>Fileinfo:
<ul>
<li>Upgrade bundled libmagic to 5.43.</li>
<li>Fix <?php githubissuel('php/php-src', 11408); ?> (Unable to build PHP 8.3.0 alpha 1 / fileinfo extension).</li>
</ul></li>
<li>FPM:
<ul>
<li>The status.listen shared pool now uses the same php_values (including expose_php) and php_admin_value as the pool it is shared with.</li>
<li>Added warning to log when fpm socket was not registered on the expected path.</li>
<li><?php bugfix(76067); ?> (system() function call leaks php-fpm listening sockets).</li>
<li>Fixed <?php githubissuel('php/php-src', 12077); ?> (PHP 8.3.0RC1 borked socket-close-on-exec.phpt).</li>
</ul></li>
<li>GD:
<ul>
<li>Removed imagerotate "ignore_transparent" argument since it has no effect.</li>
</ul></li>
<li>Intl:
<ul>
<li>Added pattern format error infos for numfmt_set_pattern.</li>
<li>Added MIXED_NUMBERS and HIDDEN_OVERLAY constants for the Spoofchecker's class.</li>
<li>Updated datefmt_set_timezone/IntlDateformatter::setTimezone returns type. (David Carlier).</li>
<li>Updated IntlBreakInterator::setText return type.</li>
<li>Updated IntlChar::enumCharNames return type.</li>
<li>Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.</li>
</ul></li>
<li>JSON:
<ul>
<li>Added json_validate().</li>
</ul></li>
<li>LDAP:
<ul>
<li>Deprecate calling ldap_connect() with separate hostname and port.</li>
</ul></li>
<li>LibXML:
<ul>
<li>Fix compile error with -Werror=incompatible-function-pointer-types and old libxml2.</li>
</ul></li>
<li>MBString:
<ul>
<li>mb_detect_encoding is better able to identify the correct encoding for Turkish text.</li>
<li>mb_detect_encoding's "non-strict" mode now behaves as described in the documentation. Previously, it would return false if the same byte (for example, the first byte) of the input string was invalid in all candidate encodings. More generally, it would eliminate candidate encodings from consideration when an invalid byte was seen, and if the same input byte eliminated all remaining encodings still under consideration, it would return false. On the other hand, if all candidate encodings but one were eliminated from consideration, it would return the last remaining one without regard for how many encoding errors might be encountered later in the string. This is different from the behavior described in the documentation, which says: "If strict is set to false, the closest matching encoding will be returned." (Alex Dowad)</li>
<li>mb_strtolower, mb_strtotitle, and mb_convert_case implement conditional casing rules for the Greek letter sigma. For mb_convert_case, conditional casing only applies to MB_CASE_LOWER and MB_CASE_TITLE modes, not to MB_CASE_LOWER_SIMPLE and MB_CASE_TITLE_SIMPLE.</li>
<li>mb_detect_encoding is better able to identify UTF-8 and UTF-16 strings with a byte-order mark.</li>
<li>mb_decode_mimeheader interprets underscores in QPrint-encoded MIME encoded words as required by RFC 2047; they are converted to spaces. Underscores must be encoded as "=5F" in such MIME encoded words.</li>
<li>mb_encode_mimeheader no longer drops NUL (zero) bytes when QPrint-encoding the input string. This previously caused strings in certain text encodings, especially UTF-16 and UTF-32, to be corrupted by mb_encode_mimeheader.</li>
<li>Implement mb_str_pad() RFC.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11514); ?> (PHP 8.3 build fails with --enable-mbstring enabled).</li>
<li>Fix use-after-free of mb_list_encodings() return value.</li>
<li>Fixed bug <?php githubissuel('php/php-src', 11992); ?> (utf_encodings.phpt fails on Windows 32-bit).</li>
</ul></li>
<li>mysqli:
<ul>
<li>mysqli_fetch_object raises a ValueError instead of an Exception.</li>
</ul></li>
<li>Opcache:
<ul>
<li>Added start, restart and force restart time to opcache's phpinfo section.</li>
<li>Fix <?php githubissuel('php/php-src', 9139); ?>: Allow FFI in opcache.preload when opcache.preload_user=root.</li>
<li>Made opcache.preload_user always optional in the cli and phpdbg SAPIs.</li>
<li>Allows W/X bits on page creation on FreeBSD despite system settings.</li>
<li>Added memfd api usage, on Linux, for zend_shared_alloc_create_lock() to create an abstract anonymous file for the opcache's lock.</li>
<li>Avoid resetting JIT counter handlers from multiple processes/threads.</li>
<li>Fixed COPY_TMP type inference for references.</li>
</ul></li>
<li>OpenSSL:
<ul>
<li>Added OPENSSL_CMS_OLDMIMETYPE and PKCS7_NOOLDMIMETYPE contants to switch between mime content types.</li>
<li>Fixed <?php githubissuel('php/php-src', 11054); ?>: Reset OpenSSL errors when using a PEM public key.</li>
<li>Added support for additional EC parameters in openssl_pkey_new.</li>
</ul></li>
<li>PCNTL:
<ul>
<li>SA_ONSTACK is now set for pcntl_signal.</li>
<li>Added SIGINFO constant.</li>
</ul></li>
<li>PCRE:
<ul>
<li>Update bundled libpcre2 to 10.42.</li>
</ul></li>
<li>PGSQL:
<ul>
<li>pg_fetch_object raises a ValueError instead of an Exception.</li>
<li>pg_cancel use thread safe PQcancel api instead.</li>
<li>pg_trace new PGSQL_TRACE_SUPPRESS_TIMESTAMPS/PGSQL_TRACE_REGRESS_MODE contants support.</li>
<li>pg_set_error_verbosity adding PGSQL_ERRORS_STATE constant.</li>
<li>pg_convert/pg_insert E_WARNING on type errors had been converted to ValueError/TypeError exceptions.</li>
<li>Added pg_set_error_context_visibility to set the context's visibility within the error messages.</li>
</ul></li>
<li>Phar:
<ul>
<li>Fix memory leak in phar_rename_archive().</li>
</ul></li>