Merge branch 'php:master' into my-master

Author: lwlwilliam

.github/actions/apt-x32/action.yml

@@ -35,7 +35,6 @@ runs:
           libssl-dev:i386 \
           libwebp-dev:i386 \
           libxml2-dev:i386 \
-          libxml2-dev:i386 \
           libxpm-dev:i386 \
           libxslt1-dev:i386 \
           firebird-dev:i386 \

.github/actions/freebsd/action.yml

@@ -9,7 +9,7 @@ runs:
     - name: FreeBSD
       uses: vmactions/freebsd-vm@v1
       with:
-        release: '13.3'
+        release: '13.5'
         usesh: true
         copyback: false
         # Temporarily disable sqlite, as FreeBSD ships it with disabled double quotes. We'll need to fix our tests.

.github/labeler.yml

@@ -469,7 +469,6 @@
       - 'ext/pdo/php_pdo.h'
       - 'ext/pdo/php_pdo_driver.h'
       - 'ext/pdo/php_pdo_error.h'
-      - 'ext/phar/php_phar.h'
       - 'ext/random/php_random.h'
       - 'ext/random/php_random_csprng.h'
       - 'ext/random/php_random_uint128.h'

.github/scripts/setup-slapd.sh

@@ -72,6 +72,9 @@ olcTLSCertificateKeyFile: /etc/ldap/ssl/server.key
 add: olcTLSVerifyClient
 olcTLSVerifyClient: never
 -
+add: olcTLSProtocolMin
+olcTLSProtocolMin: 3.3
+-
 add: olcAuthzRegexp
 olcAuthzRegexp: uid=usera,cn=digest-md5,cn=auth cn=usera,dc=my-domain,dc=com
 -

NEWS

@@ -1,9 +1,60 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 8.5.0alpha2
+?? ??? ????, PHP 8.5.0alpha3
+
+- Core:
+  . Add clone-with support to the clone() function. (timwolla, edorian)
+  . Fix support for non-userland stream notifiers. (timwolla)
+  . Added PHP_BUILD_PROVIDER constant. (timwolla)
+
+- Curl:
+  . Add support for CURLINFO_CONN_ID in curl_getinfo() (thecaliskan)
+  . Add support for CURLINFO_QUEUE_TIME_T in curl_getinfo() (thecaliskan)
+
+- Reflection:
+  . Fixed bug GH-19187 (ReflectionNamedType::getName() prints nullable type when
+    retrieved from ReflectionProperty::getSettableType()). (ilutov)
+
+- Session:
+  . Fixed GH-19197: build broken with ZEND_STRL usage with memcpy
+    when implemented as macro. (David Carlier)
+
+- Sockets:
+  . socket_set_option for multicast context throws a ValueError
+    when the socket family is not of AF_INET/AF_INET6 family. (David Carlier)
+
+- Standard:
+  . Add HEIF/HEIC support to getimagesize. (Benstone Zhang)
+  . Implement #71517 (Implement SVG support for getimagesize() and friends).
+    (nielsdos)
+  . Optimized PHP html_entity_decode function. (Artem Ukrainskiy)
+  . Minor optimization to array_chunk(). (nielsdos)
+
+- URI:
+  . Empty host handling is fixed. (Máté Kocsis)
+  . Error handling of Uri\WhatWg\Url::withHost() is fixed when the input
+    contains a port. Now, it triggers an exception; previously, the error
+    was silently swallowed. (Máté Kocsis)
+  . Support empty URIs with Uri\Rfc3986\Uri. (timwolla)
+
+17 Jul 2025, PHP 8.5.0alpha2
+
+- Core:
+  . Fix OSS-Fuzz #427814452 (pipe compilation fails with assert).
+    (nielsdos, ilutov)
+
+- DOM:
+  . Make cloning DOM node lists, maps, and collections fail. (nielsdos)
+  . Added Dom\Element::getElementsByClassName(). (nielsdos)
+
+- PDO_ODBC
+  . Fetch larger block sizes and better handle SQL_NO_TOTAL when calling
+    SQLGetData. (Calvin Buckley, Saki Takamachi)
 
 - Standard:
   . Optimized pack(). (nielsdos, divinity76)
+  . Fixed bug GH-19070 (setlocale($type, NULL) should not be deprecated).
+    (nielsdos)
 
 - URI:
   . Return the singleton UrlValidationErrorType instances from Uri\WhatWg\Url
@@ -70,6 +121,8 @@ PHP                                                                        NEWS
     (DanielEScherzer)
   . Do not use RTLD_DEEPBIND if dlmopen is available. (Daniil Gentili)
   . Make `clone()` a function. (timwolla, edorian)
+  . Fixed bug GH-19081 (Wrong lineno in property error with constructor property
+    promotion). (ilutov)
 
 - Curl:
   . Added curl_multi_get_handles(). (timwolla)
@@ -142,6 +195,11 @@ PHP                                                                        NEWS
   . Log a warning when opcache lock file permissions could not be changed.
     (Taavi Eomäe)
 
+- OpenSSL:
+  . Added openssl.libctx INI that allows to select the OpenSSL library context
+    type and convert verious parts of the extension to use the custom  libctx.
+    (Jakub Zelenka)
+
 - Output:
   . Fixed calculation of aligned buffer size. (cmb)
 
@@ -197,6 +255,7 @@ PHP                                                                        NEWS
     zval for uninitialized typed properties). (nielsdos)
   . Fixed bug GH-15766 (ReflectionClass::toString() should have better output
     for enums). (DanielEScherzer)
+  . Added ReflectionProperty::getMangledName() method. (alexandre-daubois)
 
 - Session:
   . session_start() throws a ValueError on option argument if not a hashmap

UPGRADING

@@ -45,6 +45,12 @@ PHP 8.5 UPGRADE NOTES
     change, but should more closely match user expectations, demonstrated by
     GH-15753 and GH-16198.
 
+- DOM:
+  . Cloning a DOMNamedNodeMap, DOMNodeList, Dom\NamedNodeMap, Dom\NodeList,
+    Dom\HTMLCollection, and Dom\DtdNamedNodeMap now fails.
+    This never actually resulted in a working object,
+    so the impact should actually be zero.
+
 - FileInfo:
   . finfo_file() and finfo::file() now throws a ValueError instead of a
     TypeError when $filename contains nul bytes.
@@ -182,6 +188,16 @@ PHP 8.5 UPGRADE NOTES
     first redirect thus if there is any follow up redirect, it won't go
     any further. CURLFOLLOW_ALL is equivalent to setting CURLOPT_FOLLOWLOCATION
     to true.
+  . Added support for CURLINFO_CONN_ID (libcurl >= 8.2.0) to the curl_getinfo()
+    function. This constant allows retrieving the unique ID of the connection
+    used by a cURL transfer. It is primarily useful when connection reuse or
+    connection pooling logic is needed in PHP-level applications. When
+    curl_getinfo() returns an array, this value is available as the "conn_id" key.
+  . Added support for CURLINFO_QUEUE_TIME_T (libcurl >= 8.6.0) to the curl_getinfo()
+    function. This constant allows retrieving the time (in microseconds) that the
+    request spent in libcurl’s connection queue before it was sent.
+    This value can also be retrieved by passing CURLINFO_QUEUE_TIME_T to the
+    curl_getinfo() $option parameter.
 
 - DOM:
   . Added Dom\Element::$outerHTML.
@@ -228,6 +244,16 @@ PHP 8.5 UPGRADE NOTES
     process was terminated unexpectedly. In such cases, a warning is emitted
     and the function returns false. Previously, these errors were silently
     ignored. This change affects only the sendmail transport.
+  . getimagesize() now supports HEIF/HEIC images.
+
+- Standard:
+  . getimagesize() now supports SVG images when ext-libxml is also loaded.
+    Similarly, image_type_to_extension() and image_type_to_extension()
+    now also handle IMAGETYPE_SVG.
+  . The array returned by getimagesize() now has two additional entries:
+    "width_unit" and "height_unit" to indicate in which units the dimensions
+    are expressed. These units are px by default. They are not necessarily
+    the same (just to give one example: one may be cm and the other may be px).
 
 - XSL:
   . The $namespace argument of XSLTProcessor::getParameter(),
@@ -265,6 +291,12 @@ PHP 8.5 UPGRADE NOTES
     it is visible; if there are nested output handlers the next one will still
     be used.
     RFC: https://wiki.php.net/rfc/deprecations_php_8_4
+  . Trying to produce output (e.g. with `echo`) within a user output handler
+    is deprecated. The deprecation warning will bypass the handler producing the
+    output to ensure it is visible; if there are nested output handlers the next
+    one will still be used. If a user output handler returns a non-string and
+    produces output, the warning about producing an output is emitted first.
+    RFC: https://wiki.php.net/rfc/deprecations_php_8_4
 
 - Hash:
   . The MHASH_* constants have been deprecated.  These have been overlooked
@@ -349,7 +381,7 @@ PHP 8.5 UPGRADE NOTES
 - Sockets:
   . socket_create_listen, socket_bind and socket_sendto throw a
     ValueError if the port is lower than 0 or greater than 65535,
-    also if any of the hints array entry is indexes numerically.
+    and also if any of the hints array entries are indexed numerically.
   . socket_addrinfo_lookup throws a TypeError if any of the hints
     values cannot be cast to int and can throw a ValueError if
     any of these values overflow.
@@ -359,6 +391,8 @@ PHP 8.5 UPGRADE NOTES
   . socket_create/socket_bind can create AF_PACKET family sockets.
   . socket_getsockname gets the interface index and its string
     representation with AF_PACKET socket.
+  . socket_set_option with multicast context throws a ValueError
+    when the created socket is not of AF_INET/AF_INET6 family.
 
 - Tidy:
   . tidy::__construct/parseFile/parseString now throws a ValueError
@@ -384,8 +418,10 @@ PHP 8.5 UPGRADE NOTES
   . get_exception_handler() allows retrieving the current user-defined exception
     handler function.
     RFC: https://wiki.php.net/rfc/get-error-exception-handler
-  . The clone language construct is now a function.
+  . The clone language construct is now a function and supports reassigning
+    (readonly) properties during cloning via the new $withProperties parameter.
     RFC: https://wiki.php.net/rfc/clone_with_v2
+  . Added Closure::getCurrent() to receive currently executing closure.
 
 - Curl:
   . curl_multi_get_handles() allows retrieving all CurlHandles current
@@ -396,6 +432,7 @@ PHP 8.5 UPGRADE NOTES
     RFC: https://wiki.php.net/rfc/curl_share_persistence_improvement
 
 - DOM:
+  . Added Dom\Element::getElementsByClassName().
   . Added Dom\Element::insertAdjacentHTML().
 
 - Enchant:
@@ -410,6 +447,9 @@ PHP 8.5 UPGRADE NOTES
   . Added grapheme_levenshtein() function.
     RFC: https://wiki.php.net/rfc/grapheme_levenshtein
 
+- Opcache:
+  . Added opcache_is_script_cached_in_file_cache().
+
 - Pdo\Sqlite:
   . Added support for Pdo\Sqlite::setAuthorizer(), which is the equivalent of
     SQLite3::setAuthorizer(). The only interface difference is that the
@@ -427,6 +467,7 @@ PHP 8.5 UPGRADE NOTES
     ReflectionConstant::getExtensionName() were introduced.
   . ReflectionConstant::getAttributes() was introduced.
     RFC: https://wiki.php.net/rfc/attributes-on-constants
+  . ReflectionProperty::getMangledName() was introduced.
 
 - Sqlite:
   . Sqlite3Stmt::busy to check if a statement had been fetched
@@ -445,6 +486,13 @@ PHP 8.5 UPGRADE NOTES
     across multiple PHP requests.
     RFC: https://wiki.php.net/rfc/curl_share_persistence_improvement
 
+- URI:
+  . Uri\UriException, Uri\InvalidUriException, Uri\UriComparisonMode,
+    Uri\Rfc3986\Uri, Uri\WhatWg\InvalidUrlException,
+    Uri\WhatWg\UrlValidationErrorType, Uri\WhatWg\UrlValidationError,
+    and Uri\WhatWg\Url are added.
+    RFC: https://wiki.php.net/rfc/url_parsing_api
+
 ========================================
 8. Removed Extensions and SAPIs
 ========================================
@@ -459,7 +507,7 @@ PHP 8.5 UPGRADE NOTES
     CURLFOLLOW_FIRSTONLY.
 
 - Fileinfo:
-  . Upgraded to file 5.46.
+  . Upgraded file from 5.45 to 5.46.
   . The return type of finfo_close() has been changed to true, rather
     than bool.
 
@@ -468,8 +516,13 @@ PHP 8.5 UPGRADE NOTES
     library that was separated from ext/dom for being reused among other
     extensions. The new extension is not directly exposed to userland.
 
+- URI:
+  . An always enabled uri extension is added that can be used for handling
+    URIs and URLs according to RFC 3986 and WHATWG URL.
+    RFC: https://wiki.php.net/rfc/url_parsing_api
+
 - PCRE:
-  . Upgraded to pcre2lib from 10.44 to 10.45.
+  . Upgraded pcre2lib from 10.44 to 10.45.
 
 - PDO_Sqlite:
   . Increased minimum release version support from 3.7.7 to 3.7.17.
@@ -485,11 +538,14 @@ PHP 8.5 UPGRADE NOTES
 
 - Core:
   . PHP_BUILD_DATE.
+  . PHP_BUILD_PROVIDER.
 
 - Curl:
   . CURLINFO_USED_PROXY.
   . CURLINFO_HTTPAUTH_USED.
   . CURLINFO_PROXYAUTH_USED.
+  . CURLINFO_CONN_ID.
+  . CURLINFO_QUEUE_TIME_T.
   . CURLOPT_INFILESIZE_LARGE.
   . CURLFOLLOW_ALL.
   . CURLFOLLOW_OBEYCODE.
@@ -522,6 +578,9 @@ PHP 8.5 UPGRADE NOTES
   . T_VOID_CAST.
   . T_PIPE.
 
+- Standard:
+  . IMAGETYPE_SVG when libxml is loaded.
+
 ========================================
 11. Changes to INI File Handling
 ========================================
@@ -545,6 +604,11 @@ PHP 8.5 UPGRADE NOTES
     from being a multiple of loop iteration counts.
     It is recommended that this parameter is set to a prime number.
 
+- OpenSSL:
+  Added openssl.libctx to select the OpenSSL library context type. Either
+  custom libctx for each thread can be used or a single global (default)
+  libctx is used.
+
 ========================================
 12. Windows Support
 ========================================
@@ -593,6 +657,13 @@ PHP 8.5 UPGRADE NOTES
   . The `-z` or `--zend-extension` option has been removed as it was
     non-functional. Use `-d zend_extension=<path>` instead.
 
+- PDO_ODBC
+  . The fetch behaviour for larger columns has been changed. Rather than
+    fetching 256 byte blocks, PDO_ODBC will try to fetch a larger block size;
+    currently, this is the page size minus string overhead. Drivers that
+    return SQL_NO_TOTAL in SQLGetData are also better handled as well.
+    This should improve compatibility and performance. See GH-10809, GH-10733.
+
 ========================================
 14. Performance Improvements
 ========================================
@@ -627,6 +698,7 @@ PHP 8.5 UPGRADE NOTES
   . Improved unpack() performance with nameless repetitions by avoiding
     creating temporary strings and reparsing them.
   . Improved pack() performance.
+  . Minor improvements in array_chunk() performance.
 
 - XMLReader:
   . Improved property access performance.

UPGRADING.INTERNALS

@@ -23,6 +23,11 @@ PHP 8.5 INTERNALS UPGRADE NOTES
     the user side when requiring libphp.so, by using dlmopen with LM_ID_NEWLM
     instead of dlopen.
     RTLD_DEEPBIND is still enabled when the Apache SAPI is in use.
+  . The ptr field of the php_stream_notifier struct is now a void* instead
+    of a zval. If the zval was used to store IS_PTR values only, the
+    extra layer of indirection can be removed. In other cases a zval can
+    be heap-allocated and stored in the pointer as a minimal change to keep
+    compatibility.
 
 - Zend
   . Added zend_safe_assign_to_variable_noref() function to safely assign
@@ -76,7 +81,7 @@ PHP 8.5 INTERNALS UPGRADE NOTES
   . Preprocessor macro SIZEOF_INTMAX_T has been removed.
 
 - Windows build system changes
-  . SAPI() and ADD_SOURCES() now suport the optional `duplicate_sources`
+  . SAPI() and ADD_SOURCES() now support the optional `duplicate_sources`
     parameter.  If truthy, no rules to build the object files are generated.
     This allows to build additional variants of SAPIs (e.g. a DLL and EXE)
     without duplicate build rules.  It is up to the SAPI maintainers to ensure
@@ -129,6 +134,10 @@ PHP 8.5 INTERNALS UPGRADE NOTES
   . The php_std_date() function has been removed. Use php_format_date() with
     the "D, d M Y H:i:s \\G\\M\\T" format instead.
   . Added php_url_encode_to_smart_str() to encode a URL to a smart_str buffer.
+  . The functionality of getimagesize(), image_type_to_mime_type(),
+    and image_type_to_extension() is now extensible using the internal APIs
+    php_image_register_handler() and php_image_unregister_handler() in
+    php_image.h.
 
 ========================
 4. OpCode changes

Zend/Optimizer/zend_func_infos.h

@@ -131,9 +131,7 @@ static const func_info_t func_infos[] = {
 	F1("imagecreatefromgd", MAY_BE_OBJECT|MAY_BE_FALSE),
 	F1("imagecreatefromgd2", MAY_BE_OBJECT|MAY_BE_FALSE),
 	F1("imagecreatefromgd2part", MAY_BE_OBJECT|MAY_BE_FALSE),
-#if defined(HAVE_GD_BMP)
 	F1("imagecreatefrombmp", MAY_BE_OBJECT|MAY_BE_FALSE),
-#endif
 	F1("imagecolorsforindex", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_LONG),
 	F1("imagegetclip", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_OF_LONG),
 #if defined(HAVE_GD_FREETYPE)

Zend/Zend.m4

@@ -149,6 +149,7 @@ AC_CHECK_FUNCS(m4_normalize([
   pthread_get_stackaddr_np
   pthread_getattr_np
   pthread_stackseg_np
+  strnlen
 ]))
 
 AC_CHECK_DECL([clock_gettime_nsec_np],