Add ldap_count_references()

Closes GH-5784

Replace ISO_8859-* with ISO8859-* aliases for MBString

We also remove the mbregex ISO 8859 aliases with underscores.

Promote warning to exception in ldap_set_rebind_proc()

From now on, ldap_set_rebind_proc() will only accept callable or null
as argument 2.

Closes GH-5763

Add upgrading note for apache module name

[ci skip]

Make HashContexts serializable.

* Modify php_hash_ops to contain the algorithm name and
serialize and unserialize methods.

* Implement __serialize and __unserialize magic meth

Make HashContexts serializable.

* Modify php_hash_ops to contain the algorithm name and
serialize and unserialize methods.

* Implement __serialize and __unserialize magic methods on
HashContext.

Note that serialized HashContexts are not necessarily portable
between PHP versions or from architecture to architecture.
(Most are, though Keccak and slow SHA3s are not.)

An exception is thrown when an unsupported serialization is
attempted.

Because of security concerns, HASH_HMAC contexts are not
currently serializable; attempting to serialize one throws
an exception.

Serialization exposes the state of HashContext memory, so ensure
that memory is zeroed before use by allocating it with a new
php_hash_alloc_context function. Performance impact is
negligible.

Some hash internal states have logical pointers into a buffer,
or sponge, that absorbs input provided in bytes rather than
chunks. The unserialize functions for these hash functions
must validate that the logical pointers are all within bounds,
lest future hash operations cause out-of-bounds memory accesses.

* Adler32, CRC32, FNV, joaat: simple state, no buffer positions
* Gost, MD2, SHA3, Snefru, Tiger, Whirlpool: buffer positions
must be validated
* MD4, MD5, SHA1, SHA2, haval, ripemd: buffer positions encoded
bitwise, forced to within bounds on use; no need to validate

show more ...

Don't accept objects instead of arrays in curl

This properly addresses the issue from bug #79741. Silently
interpreting objects as mangled property tables is almost
always a bad idea

Don't accept objects instead of arrays in curl

This properly addresses the issue from bug #79741. Silently
interpreting objects as mangled property tables is almost
always a bad idea.

Closes GH-5773.

show more ...

Implement Attribute Amendments.

RFC: https://wiki.php.net/rfc/attribute_amendments

Support for attribute grouping is left out, because the short
attribute syntax RFC will likely

Implement Attribute Amendments.

RFC: https://wiki.php.net/rfc/attribute_amendments

Support for attribute grouping is left out, because the short
attribute syntax RFC will likely make it obsolete.

Closes GH-5751.

show more ...

[ci skip] Various typo fixes in stub comments and CHANGES file

Don't include trailing newline in comment token

Don't include a trailing newline in T_COMMENT tokens, instead leave
it for a following T_WHITESPACE token. The newline does not belong

Don't include trailing newline in comment token

Don't include a trailing newline in T_COMMENT tokens, instead leave
it for a following T_WHITESPACE token. The newline does not belong
to the comment logically, and this makes for an ugly special case,
as other tokens do not include trailing newlines.

Whitespace-sensitive tooling will want to either forward or backward
emulate this change.

Closes GH-5182.

show more ...

Make sorting stable

Make user-exposed sorts stable, by storing the position of elements
in the original array, and using those positions as a fallback
comparison criterion. The base

Make sorting stable

Make user-exposed sorts stable, by storing the position of elements
in the original array, and using those positions as a fallback
comparison criterion. The base sort is still hybrid q/insert.

The use of true/false comparison functions is deprecated (but still
supported) and should be replaced by -1/0/1 comparison functions,
driven by the <=> operator.

RFC: https://wiki.php.net/rfc/stable_sorting

Closes GH-5236.

show more ...

Introduce InternalIterator

Userland classes that implement Traversable must do so either
through Iterator or IteratorAggregate. The same requirement does
not exist for internal class

Introduce InternalIterator

Userland classes that implement Traversable must do so either
through Iterator or IteratorAggregate. The same requirement does
not exist for internal classes: They can implement the internal
get_iterator mechanism, without exposing either the Iterator or
IteratorAggregate APIs. This makes them usable in get_iterator(),
but incompatible with any Iterator based APIs.

A lot of internal classes do this, because exposing the userland
APIs is simply a lot of work. This patch alleviates this issue by
providing a generic InternalIterator class, which acts as an
adapater between get_iterator and Iterator, and can be easily
used by many internal classes. At the same time, we extend the
requirement that Traversable implies Iterator or IteratorAggregate
to internal classes as well.

Closes GH-5216.

show more ...

Make SimpleXMLElement a RecursiveIterator

Context: https://externals.io/message/108789

This essentially moves the functionality of SimpleXMLIterator into
SimpleXMLElement, and m

Make SimpleXMLElement a RecursiveIterator

Context: https://externals.io/message/108789

This essentially moves the functionality of SimpleXMLIterator into
SimpleXMLElement, and makes SimpleXMLIterator a no-op extension.

Ideally SimpleXMLElement would be an IteratorAggregate, whose
getIterator() method returns SimpleXMLIterator. However, because
SimpleXMLIterator extends SimpleXMLElement (and code depends on
this in non-trivial ways), this is not possible.

The only way to not keep SimpleXMLElement as a magic Traversable
(that implements neither Iterator nor IteratorAggregate) is to
move the SimpleXMLIterator functionality into it.

Closes GH-5234.

show more ...

Convert shmop resources to opaque objects

We make `shmop_close()` a NOP, and deprecate the function right away;
detaching from SHM now happens when the wrapper object is freed.

Remove deprecated DES fallback in crypt()

Deprecate the procedural API of ext/zip

Closes GH-5746

Remove the deprecated parameter of curl_version()

Convert resources to objects in ext/zlib

Closes GH-5680

Convert CURL resources to objects

Closes GH-5402

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>

Convert resource to object in Sysvshm extension

Closes GH-5499

Update NEWS and UPGRADING for the OpenSSL ext CMS addition

Add $filter parameter for ReflectionClass::(getConstants|getReflectionConstants)

This solves [#79628](https://bugs.php.net/79628).

Similar to `ReflectionClass::getMethods()` and `Re

Add $filter parameter for ReflectionClass::(getConstants|getReflectionConstants)

This solves [#79628](https://bugs.php.net/79628).

Similar to `ReflectionClass::getMethods()` and `ReflectionClass::getProperties()`,
this new `$filter` argument allows the filtering of constants defined in a class by
their visibility.

For that, we create three new constants for `ReflectionClassConstant`:

* `IS_PUBLIC`
* `IS_PROTECTED`
* `IS_PRIVATE`

Closes GH-5649.

show more ...

Implement "Constructor Promotion" RFC

RFC: https://wiki.php.net/rfc/constructor_promotion

Closes GH-5291.

Add upgrading note for Attributes RFC

[ci-skip]

Add UPGRADING note for pty support

[ci skip]

Add UPGRADING note for xmlrpc unbundling

And drop other UPGRADING references to xmlrpc. I don't think it
makes sense to have those for extensions that are no longer
shipped...

Add UPGRADING note for xmlrpc unbundling

And drop other UPGRADING references to xmlrpc. I don't think it
makes sense to have those for extensions that are no longer
shipped...

[ci skip]

show more ...