Add support for mbstring.regex_retry_limit

This is very similar to the existing mbstring.regex_stack_limit,
but for backtracking. The default value matches pcre.backtrack_limit.
Only

Add support for mbstring.regex_retry_limit

This is very similar to the existing mbstring.regex_stack_limit,
but for backtracking. The default value matches pcre.backtrack_limit.
Only used on libonig >= 2.8.0.

show more ...

Replace "unexpected character" warning with ParseError

Closes GH-4767.

Fix #72374: remove_path strips first char of filename

Convert some notices to warnings

Part of https://wiki.php.net/rfc/engine_warnings.

Allow SA_RESTART for SIGALRM

If no explicit restart_syscalls is passed, default to
restart_syscalls=0 for SIGALRM only, to reduce BC impact.

Update regarding changed OpenSSL default config path

Convert GD Resources to objects

Fix #78413: php-fpm request_terminate_timeout does not take effect after fastcgi_finish_request

To retain legacy behavior I decided to add an option to control request
termination logic.

Fix #78413: php-fpm request_terminate_timeout does not take effect after fastcgi_finish_request

To retain legacy behavior I decided to add an option to control request
termination logic. If request_terminate_timeout_track_finished is set,
then request will be tracked for time limits even after
fastcgi_finish_request was called.

This patch depends on the fix provided in BUG 78469 (otherwise php-fpm
workers listening on named pipes on Windows will be erroneously terminated)
(PR #4636)

show more ...

Add max_depth option to unserialize()

Add a max_depth option to unserialize and an unserialize_max_depth
ini setting, which can be used to control the depth limit. The
default value

Add max_depth option to unserialize()

Add a max_depth option to unserialize and an unserialize_max_depth
ini setting, which can be used to control the depth limit. The
default value is 4096.

This option is intended to prevent stack overflows during the
unserialization of deeply nested structures.

This fixes bug #78549 and addresses oss-fuzz #17581, #17589, #17664,
and #17788.

show more ...

Convert "Only arrays and Traversables can be unpacked" into Error

Promote write "use scalar as array" warning to Error

Convert "Illegal offset type" warnings to exceptions

Convert "cannot add element" warning to exception

Throw Error when writing property of non-object

This removes object auto-vivification support.

This also means that we can remove the corresponding special
handling for typed pr

Throw Error when writing property of non-object

This removes object auto-vivification support.

This also means that we can remove the corresponding special
handling for typed properites: We no longer need to check that a
property is convertible to stdClass if such a conversion might
take place indirectly due to a nested property write.

Additionally OBJ_W style operations now no longer modify the
object operand, and as such we no longer need to treat op1 as a
def in SSA form.

The next step would be to actually compile the whole LHS of OBJ_W
operations in R rather than W mode, but that causes issues with
SimpleXML, whose object handlers depend on the current compilation
structure.

Part of https://wiki.php.net/rfc/engine_warnings.

show more ...

Remove unused parameter

The `$use_include_path` parameter doesn't make sense for
`tidy_repair_string()`, and actually unused, so we remove it.

Remove unused parameter

Cf. <https://bugs.php.net/78579>.

Don't make argument nullable based on AST null initializer

Closes GH-4720.

Change XMLWriter resources to objects

While we generally prefer objects over resources for quite a while, the
procedural XMLWriter API still uses resources, although there is
already

Change XMLWriter resources to objects

While we generally prefer objects over resources for quite a while, the
procedural XMLWriter API still uses resources, although there is
already an object-oriented API which uses objects. This dichotomy
makes no sense, slightly complicates the implementation, and doesn't
allow a stepwise migration to the object-oriented API, which might be
desired. Thus we completely drop the XMLWriter resources in favor of
XMLWriter objects.

We consider the minor BC break acceptable for a major version, since
only explicit type checks (`is_resource()`, `gettype()` etc.) need to
be adapted.

show more ...

Upgrading notes for removed ext/dom classes.

upgrading notes for ValueError/zend_value_error()

Remove support for umich_ldap

Doesn't seem to exist anymore, and their website now redirects to
openldap.

Remove nsldap support

The newest version we're checking (libssldap50) seems to be about
15 years out of date. We could add support for libssldap60 (also
unmainted, but more recent),

Remove nsldap support

The newest version we're checking (libssldap50) seems to be about
15 years out of date. We could add support for libssldap60 (also
unmainted, but more recent), but given how nobody has expressed any
interest in this, I'm going ahead and dropping this code.

show more ...

Enable display_startup_errors by default

Document opcache.preload_user directive

Make error_reporting=E_ALL the default