Version 8.3.0

Bcmath:
- Fixed (removing trailing zeros from numbers) (jorgsowa)
CLI:
- Added pdeathsig to builtin server to terminate workers when the master process is killed.
- Fixed bug (STDIN/STDOUT/STDERR is not available for CLI without a script).
- Implement (support linting multiple files at once using php -l).
Core:
- Fix (Allow "final" modifier when importing a method from a trait).
- Fixed bug (segfault with unpacking and magic method closure).
- Fixed bug (Improve unset property and __get type incompatibility error message).
- SA_ONSTACK is now set for signal handlers to be friendlier to other in-process code such as Go's cgo.
- SA_ONSTACK is now set when signals are disabled.
- Fix : Signal handlers now do a no-op instead of crashing when executed on threads not managed by TSRM.
- Added shadow stack support for fibers.
- Fix bug (Fix accidental caching of default arguments with side effects).
- Implement (Use strlen() for determining the class_name length).
- Fix bug (Improve line numbers for errors in constant expressions).
- Fix bug (Allow comments between & and parameter).
- Zend Max Execution Timers is now enabled by default for ZTS builds on Linux.
- Fix bug (Disallow .. in open_basedir paths set at runtime).
- Fix bug , (Various segfaults with destructors and VM return values).
- Fix bug (Use of trait doesn't redeclare static property if class has inherited it from its parent).
- Fix bug (Negative indices on empty array don't affect next chosen index).
- Fix bug (Implement delayed early binding for classes without parents).
- Fix bug #79836 (Segfault in concat_function).
- Fix bug #81705 (type confusion/UAF on set_error_handler with concat operation).
- Fix (Closure created from magic method does not accept named arguments).
- Fix (Allow "final" modifier when importing a method from a trait).
- Fixed bug (segfault with unpacking and magic method closure).
- Fixed bug (String concatenation performance regression in 8.3).
- Fixed (Missing "Optional parameter before required" deprecation on union null type).
- Implement the #[\Override] attribute RFC.
- Fixed bug (Incorrect handling of unwind and graceful exit exceptions).
- Added zend_call_stack_get implementation for OpenBSD.
- Add stack limit check in zend_eval_const_expr().
- Expose time spent collecting cycles in gc_status().
- Remove WeakMap entries whose key is only reachable through the entry value.
- Resolve open_basedir paths on INI update.
- Fixed oss-fuzz #60741 (Leak in open_basedir).
- Fixed segfault during freeing of some incompletely initialized objects due to OOM error (PDO, SPL, XSL).
- Introduced Zend guard recursion protection to fix __debugInfo issue.
- Fixed oss-fuzz #61712 (assertion failure with error handler during binary op).
- Fixed (DTrace enabled build is broken).
- Fixed OSS Fuzz #61865 (Undef variable in ++/-- for declared property that is unset in error handler).
- Fixed warning emitted when checking if a user stream is castable.
- Fixed bug (Compile error on MacOS with C++ extension when using ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX).
- Fixed bug (#[Override] attribute in trait does not check for parent class implementations).
- Fixed OSS Fuzz #62294 (Unsetting variable after ++/-- on string variable warning).
- Fixed buffer underflow when compiling memoized expression.
- Fixed oss-fuzz #63802 (OP1 leak in error path of post inc/dec).
Curl:
- Added Curl options and constants up to (including) version 7.87.
Date:
- Implement More Appropriate Date/Time Exceptions RFC.
DOM:
- Fix bug (DOMAttr unescapes character reference).
- Fix bug (getElementsByTagName() is O(N^2)).
- Fix #79700 (wrong use of libxml oldNs leads to performance problem).
- Fix #77894 (DOMNode::C14N() very slow on generated DOMDocuments even after normalisation).
- Revert changes to DOMAttr::$value and DOMAttr::$nodeValue expansion.
- Fixed bug (Namespace reuse in createElementNS() generates wrong output).
- Implemented DOMDocument::adoptNode(). Previously this always threw a "not yet implemented" exception.
- Fixed bug (Implicitly removing nodes from \DOMDocument breaks existing references).
- Added DOMNode::contains() and DOMNameSpaceNode::contains().
- Added DOMElement::getAttributeNames().
- Added DOMNode::getRootNode().
- Added DOMElement::className and DOMElement::id.
- Added DOMParentNode::replaceChildren().
- Added DOMNode::isConnected and DOMNameSpaceNode::isConnected.
- Added DOMNode::parentElement and DOMNameSpaceNode::parentElement.
- Added DOMNode::isEqualNode().
- Added DOMElement::insertAdjacentElement() and DOMElement::insertAdjacentText().
- Added DOMElement::toggleAttribute().
- Fixed bug (LIBXML_NOXMLDECL is not implemented or broken).
- adoptNode now respects the strict error checking property.
- Align DOMChildNode parent checks with spec.
- (Removing documentElement after creating attribute node: possible use-after-free).
- Fix various namespace prefix conflict resolution bugs.
- Fix calling createAttributeNS() without prefix causing the default namespace of the element to change.
- Fixed (Confusing warning when blocking entity loading via libxml_set_external_entity_loader).
- Fix broken cache invalidation with deallocated and reallocated document node.
- Fix compile error when php_libxml.h header is included in C++.
- (No way of removing redundant xmlns: declarations).
Exif:
- Removed unneeded codepaths in exif_process_TIFF_in_JPEG().
FFI:
- Implement (Allow to pass CData into struct and/or union fields).
Fileinfo:
- Upgrade bundled libmagic to 5.43.
- Fix (Unable to build PHP 8.3.0 alpha 1 / fileinfo extension).
FPM:
- The status.listen shared pool now uses the same php_values (including expose_php) and php_admin_value as the pool it is shared with.
- Added warning to log when fpm socket was not registered on the expected path.
- (system() function call leaks php-fpm listening sockets).
- Fixed (PHP 8.3.0RC1 borked socket-close-on-exec.phpt).
GD:
- Removed imagerotate "ignore_transparent" argument since it has no effect.
Intl:
- Added pattern format error infos for numfmt_set_pattern.
- Added MIXED_NUMBERS and HIDDEN_OVERLAY constants for the Spoofchecker's class.
- Updated datefmt_set_timezone/IntlDateformatter::setTimezone returns type. (David Carlier).
- Updated IntlBreakInterator::setText return type.
- Updated IntlChar::enumCharNames return type.
- Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.
JSON:
- Added json_validate().
LDAP:
- Deprecate calling ldap_connect() with separate hostname and port.
LibXML:
- Fix compile error with -Werror=incompatible-function-pointer-types and old libxml2.
MBString:
- mb_detect_encoding is better able to identify the correct encoding for Turkish text.
- mb_detect_encoding's "non-strict" mode now behaves as described in the documentation. Previously, it would return false if the same byte (for example, the first byte) of the input string was invalid in all candidate encodings. More generally, it would eliminate candidate encodings from consideration when an invalid byte was seen, and if the same input byte eliminated all remaining encodings still under consideration, it would return false. On the other hand, if all candidate encodings but one were eliminated from consideration, it would return the last remaining one without regard for how many encoding errors might be encountered later in the string. This is different from the behavior described in the documentation, which says: "If strict is set to false, the closest matching encoding will be returned." (Alex Dowad)
- mb_strtolower, mb_strtotitle, and mb_convert_case implement conditional casing rules for the Greek letter sigma. For mb_convert_case, conditional casing only applies to MB_CASE_LOWER and MB_CASE_TITLE modes, not to MB_CASE_LOWER_SIMPLE and MB_CASE_TITLE_SIMPLE.
- mb_detect_encoding is better able to identify UTF-8 and UTF-16 strings with a byte-order mark.
- mb_decode_mimeheader interprets underscores in QPrint-encoded MIME encoded words as required by RFC 2047; they are converted to spaces. Underscores must be encoded as "=5F" in such MIME encoded words.
- mb_encode_mimeheader no longer drops NUL (zero) bytes when QPrint-encoding the input string. This previously caused strings in certain text encodings, especially UTF-16 and UTF-32, to be corrupted by mb_encode_mimeheader.
- Implement mb_str_pad() RFC.
- Fixed bug (PHP 8.3 build fails with --enable-mbstring enabled).
- Fix use-after-free of mb_list_encodings() return value.
- Fixed bug (utf_encodings.phpt fails on Windows 32-bit).
mysqli:
- mysqli_fetch_object raises a ValueError instead of an Exception.
Opcache:
- Added start, restart and force restart time to opcache's phpinfo section.
- Fix : Allow FFI in opcache.preload when opcache.preload_user=root.
- Made opcache.preload_user always optional in the cli and phpdbg SAPIs.
- Allows W/X bits on page creation on FreeBSD despite system settings.
- Added memfd api usage, on Linux, for zend_shared_alloc_create_lock() to create an abstract anonymous file for the opcache's lock.
- Avoid resetting JIT counter handlers from multiple processes/threads.
- Fixed COPY_TMP type inference for references.
OpenSSL:
- Added OPENSSL_CMS_OLDMIMETYPE and PKCS7_NOOLDMIMETYPE contants to switch between mime content types.
- Fixed : Reset OpenSSL errors when using a PEM public key.
- Added support for additional EC parameters in openssl_pkey_new.
PCNTL:
- SA_ONSTACK is now set for pcntl_signal.
- Added SIGINFO constant.
PCRE:
- Update bundled libpcre2 to 10.42.
PGSQL:
- pg_fetch_object raises a ValueError instead of an Exception.
- pg_cancel use thread safe PQcancel api instead.
- pg_trace new PGSQL_TRACE_SUPPRESS_TIMESTAMPS/PGSQL_TRACE_REGRESS_MODE contants support.
- pg_set_error_verbosity adding PGSQL_ERRORS_STATE constant.
- pg_convert/pg_insert E_WARNING on type errors had been converted to ValueError/TypeError exceptions.
- Added pg_set_error_context_visibility to set the context's visibility within the error messages.
Phar:
- Fix memory leak in phar_rename_archive().
POSIX:
- Added posix_sysconf.
- Added posix_pathconf.
- Added posix_fpathconf.
- Fixed zend_parse_arg_long's bool pointer argument assignment.
- Added posix_eaccess.
Random:
- Added Randomizer::getBytesFromString().
- Added Randomizer::nextFloat(), ::getFloat(), and IntervalBoundary.
- Enable getrandom() for NetBSD (from 10.x).
- Deprecate MT_RAND_PHP.
- Fix Randomizer::getFloat() returning incorrect results under certain circumstances.
Reflection:
- Fix (ReflectionMethod constructor should not find private parent method).
- Fix (ReflectionClass::getStaticProperties doesn't need null return type).
SAPI:
- Fixed (Could not open input file: should be sent to stderr).
Session:
- Fixed bug (Crash after dealing with an Apache request).
SimpleXML:
- Fixed bug (SimpleXML infinite loop when getName() is called within foreach).
- Fixed bug (SimpleXML infinite loop when a cast is used inside a foreach).
- (SimpleXML iteration produces infinite loop).
Sockets:
- Added SO_ATTACH_REUSEPORT_CBPF socket option, to give tighter control over socket binding for a cpu core.
- Added SKF_AD_QUEUE for cbpf filters.
- Added socket_atmark if send/recv needs using MSG_OOB.
- Added TCP_QUICKACK constant, to give tigher control over ACK delays.
- Added DONTFRAGMENT support for path MTU discovery purpose.
- Added AF_DIVERT for raw socket for divert ports.
- Added SOL_UPDLITE, UDPLITE_RECV_CSCOV and UDPLITE_SEND_CSCOV for updlite protocol support.
- Added SO_RERROR, SO_ZEROIZE and SO_SPLICE netbsd and openbsd constants.
- Added TCP_REPAIR for quietly close a connection.
- Added SO_REUSEPORT_LB freebsd constant.
- Added IP_BIND_ADDRESS_NO_PORT.
SPL:
- Fixed (RecursiveDirectoryIterator::hasChildren is slow).
Standard:
- E_NOTICEs emitted by unserialize() have been promoted to E_WARNING.
- unserialize() now emits a new E_WARNING if the input contains unconsumed bytes.
- Make array_pad's $length warning less confusing.
- E_WARNING emitted by strtok in the caase both arguments are not provided when starting tokenisation.
- password_hash() will now chain the original RandomException to the ValueError on salt generation failure.
- Fix (proc_close after proc_get_status always returns -1).
- Improve the warning message for unpack() in case not enough values were provided.
- Fix (parse_ini_string() now preserves formatting of unquoted strings starting with numbers when the INI_SCANNER_TYPED flag is specified).
- Fix (http_response_code emits no error when headers were already sent).
- Added support for rounding negative places in number_format().
- Prevent precision loss on formatting decimal integers in number_format().
- Added usage of posix_spawn for proc_open when supported by OS.
- Added $before_needle argument to strrchr().
- Fixed (str_getcsv returns null byte for unterminated enclosure).
- Fixed str_decrement() on "1".
Streams:
- : blocking fread() will block even if data is available.
- Added storing of the original path used to open xport stream.
- Implement (STREAM_NOTIFY_COMPLETED over HTTP never emitted).
- Fix bug (fgets on a redis socket connection fails on PHP 8.3).
- Implemented (_php_stream_copy_to_mem: Allow specifying a maximum length without allocating a buffer of that size).
- (fseek() on memory stream behavior different than file).
- (Can read "non-existant" files).
XSLTProcessor:
- (DomNode::getNodePath() returns invalid path).
ZIP:
- zip extension version 1.22.0 for libzip 1.10.0.
- add new error macros (ER_DATA_LENGTH and ER_NOT_ALLOWED).
- add new archive global flags (ER_AFL_*).
- add ZipArchive::setArchiveFlag and ZipArchive::getArchiveFlag methods.

Version 8.2.18

Core:
- Fixed bug (Corrupted memory in destructor with weak references).
- Fixed bug (AX_GCC_FUNC_ATTRIBUTE failure).
- Fixed bug (GC does not scale well with a lot of objects created in destructor).
DOM:
- Add some missing ZPP checks.
- Fix potential memory leak in XPath evaluation results.
- Fix phpdoc for DOMDocument load methods.
FPM:
- Fix incorrect check in fpm_shm_free().
GD:
- Fixed bug (add GDLIB_CFLAGS in feature tests).
Gettext:
- Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.
MySQLnd:
- Fix (Fixed handshake response [mysqlnd]).
- Fix incorrect charset length in check_mb_eucjpms().
Opcache:
- Fixed (JITed QM_ASSIGN may be optimized out when op1 is null).
- Fixed (Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded).
PDO:
- Fix various PDORow bugs.
Random:
- Fixed bug (Pre-PHP 8.2 compatibility for mt_srand with unknown modes).
- Fixed bug (Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used).
Session:
- Fixed bug (Segfault with session_decode and compilation error).
Sockets:
- Fixed bug (socket_getsockname returns random characters in the end of the socket name).
SPL:
- Fixed bug (Unable to resize SplfixedArray after being unserialized in PHP 8.2.15).
- Fixed bug (Unexpected null pointer in zend_string.h).
Standard:
- Fixed bug (Live filesystem modified by tests).
- Fixed (Added validation of `\n` in $additional_headers of mail()).
- Fixed bug (file_put_contents fail on strings over 4GB on Windows).
- Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
- Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
- Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)
XML:
- Fixed bug (Multiple test failures when building with --with-expat).

Version 8.2.17

Core:
- Fix ZTS persistent resource crashes on shutdown.
Curl:
- Fix failing tests due to string changes in libcurl 8.6.0.
DOM:
- Fix reference access in dimensions for DOMNodeList and DOMNodeMap.
Fileinfo:
- Fixed bug (finfo::buffer(): Failed identify data 0:(null), backport).
FPM:
- (getenv in php-fpm should not read $_ENV, $_SERVER).
GD:
- Fixed bug (detection of image formats in system gd library).
MySQLnd:
- Fixed bug ([mysqlnd] Fixed not to set CR_MALFORMED_PACKET to error if CR_SERVER_GONE_ERROR is already set).
PGSQL:
- Fixed bug (pg_execute/pg_send_query_params/pg_send_execute with null value passed by reference).
Standard:
- Fixed array key as hash to string (case insensitive) comparison typo for the second operand buffer size (albeit unused for now).

Version 8.2.16

Core:
- Fixed timer leak in zend-max-execution-timers builds.
- Fixed bug (linking failure on ARM with mold).
- Fixed bug (Anonymous class reference in trigger_error / thrown Exception).
- Fixed bug (GCC 14 build failure).
Curl:
- Fix missing error check in curl_multi_init().
FPM:
- Fixed bug (Incorrect SCRIPT_NAME with Apache ProxyPassMatch when plus in path).
GD:
- Fixed bug (imagettfbbox(): Could not find/open font UNC path).
- Fixed bug (imagerotate will turn the picture all black, when rotated 90).
MySQLnd:
- Fixed bug (When running a stored procedure (that returns a result set) twice, PHP crashes).
Opcache:
- Fixed bug (Segmentation fault will be reported when JIT is off but JIT_debug is still on).
OpenSSL:
- Fixed LibreSSL undefined reference when OPENSSL_NO_ENGINE not set. (David Carlier).
PDO_Firebird:
- Fix (Changed to convert float and double values into strings using `H` format).
Phar:
- (PHAR doesn't know about litespeed).
- Fixed bug (PharData incorrectly extracts zip file).
Random:
- Fixed bug (Randomizer::pickArrayKeys() does not detect broken engines).
Session:
- Fixed bug (Corrupted session written when there's a fatal error in autoloader).
Streams:
- Fixed bug (Copying large files using mmap-able source streams may exhaust available memory and fail).

Version 8.2.15

Core:
- Fixed bug (false positive SSA integrity verification failed when loading composer classmaps with more than 11k elements).
- Fixed bug (missing cross-compiling 3rd argument so Autoconf doesn't emit warnings).
Cli:
- Fix incorrect timeout in built-in web server when using router script and max_input_time.
FFI:
- Fixed bug (stream_wrapper_register crashes with FFI\CData).
- Fixed bug (FFI::new interacts badly with observers).
Intl:
- Fixed (IntlDateFormatter::__construct accepts 'C' as valid locale).
Hash:
- Fixed bug (hash() function hangs endlessly if using sha512 on strings >= 4GiB).
ODBC:
- Fix crash on Apache shutdown with persistent connections.
Opcache:
- Fixed oss-fuzz #64727 (JIT undefined array key warning may overwrite DIM with NULL when DIM is the same var as result).
- Added workaround for SELinux mprotect execheap issue. See https://bugzilla.kernel.org/show_bug.cgi?id=218258.
OpenSSL:
- Fixed bug (openssl_csr_sign might leak new cert on error).
PDO:
- Fix (Fixed PDO::getAttribute() to get PDO::ATTR_STRINGIFY_FETCHES).
PDO_ODBC:
- Fixed bug (Unable to turn on autocommit mode with setAttribute()).
PGSQL:
- Fixed auto_reset_persistent handling and allow_persistent type.
- Fixed bug (Apache crashes on shutdown when using pg_pconnect()).
Phar:
- (Segmentation fault on including phar file).
PHPDBG:
- Fixed bug (Double free of init_file in phpdbg_prompt.c).
SimpleXML:
- Fix getting the address of an uninitialized property of a SimpleXMLElement resulting in a crash.
Tidy:
- Fixed bug (tidynode.props.attribute is missing "Boolean Attributes" and empty attributes).

Version 8.2.14

Core:
- Fixed oss-fuzz #54325 (Use-after-free of name in var-var with malicious error handler).
- Fixed oss-fuzz #64209 (In-place modification of filename in php_message_handler_for_zend).
- Fixed bug / (Invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC).
- Fix various missing NULL checks.
- Fixed bug (Leak of call->extra_named_params on internal __call).
Date:
- Fixed improbably integer overflow while parsing really large (or small) Unix timestamps.
DOM:
- Fixed bug (DOM: Removing XMLNS namespace node results in invalid default: prefix).
FPM:
- Fixed bug (Segmentation fault in fpm_status_export_to_zval).
FTP:
- Fixed bug (FTP & SSL session reuse).
Intl:
- Fixed bug (Test bug69398.phpt fails with ICU 74.1).
LibXML:
- Fixed bug (libxml2 2.12.0 issue building from src).
- Fixed test failures for libxml2 2.12.0.
MySQLnd:
- Avoid using uninitialised struct.
- Fixed bug (Possible dereference of NULL in MySQLnd debug code).
Opcache:
- Fixed JIT bug (Function JIT emits "Uninitialized string offset" warning at the same time as invalid offset Error).
- Fixed JIT bug (JIT emits "Attempt to assign property of non-object" warning at the same time as Error is being thrown).
OpenSSL:
- (openssl_pkcs7_verify() may ignore untrusted CAs).
PCRE:
- Fixed bug (The gh11374 test fails on Alpinelinux).
PDO PGSQL:
- Fixed the default value of $fetchMode in PDO::pgsqlGetNotify() (kocsismate)
PGSQL:
- Fixed bug wrong argument type for pg_untrace.
PHPDBG:
- Fixed bug (MEMORY_LEAK in phpdbg_prompt.c).
SOAP:
- Fixed bug ([SOAP] Temporary WSDL cache files not being deleted).
SPL:
- Fixed bug (SplFileInfo::getFilename() segfault in combination with GlobIterator and no directory separator).
SQLite3:
- Fixed bug (sqlite3_defensive.phpt fails with sqlite 3.44.0).
Standard:
- Fix memory leak in syslog device handling.
- Fixed bug (browscap segmentation fault when configured in the vhost).
- Fixed bug (proc_open() does not take into account references in the descriptor array).
Streams:
- (Stream wrappers in imagecreatefrompng causes segfault).
Zip:
- Fixed bug (Inconsistency in ZipArchive::addGlob remove_path Option Behavior).

Version 8.2.13

Core:
- Fixed double-free of non-interned enum case name.
- Fixed bug (Incorrect result of stripos with single character needle).
- Fixed bug (Double-free of doc_comment when overriding static property via trait).
- Fixed segfault caused by weak references to FFI objects.
- Fixed max_execution_time: don't delete an unitialized timer.
- Fixed bug (Arginfo soft-breaks with namespaced class return type if the class name starts with N).
DOM:
- Fix registerNodeClass with abstract class crashing.
- Add missing NULL pointer error check.
- Fix validation logic of php:function() callbacks.
Fiber:
- Fixed bug (ReflectionFiber segfault).
FPM:
- Fixed bug (Loading ext in FPM config does not register module handlers).
- Fixed bug (FPM: segfault dynamically loading extension without opcache).
- (FastCGI terminates conn after FCGI_GET_VALUES).
Intl:
- Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.
Opcache:
- Added warning when JIT cannot be enabled.
- Fixed bug (Crashes in zend_accel_inheritance_cache_find since upgrading to 8.1.3 due to corrupt on-disk file cache).
OpenSSL:
- Fixed bug (Missing sigbio creation checking in openssl_cms_verify).
PCRE:
- Fixed bug (Backport upstream fix, Different preg_match result with -d pcre.jit=0).
SOAP:
- Fixed bug (Segmentation fault on SoapClient::__getTypes).
- (SOAP WSDL cache race condition causes Segmentation Fault).
- (SOAP leaves incomplete cache file on ENOSPC).
- Fix incorrect uri check in SOAP caching.
- Fix segfault and assertion failure with refcounted props and arrays.
- Fix potential crash with an edge case of persistent encoders.
- (Memleak in SoapClient).
Streams:
- (getimagesize with "&$imageinfo" fails on StreamWrappers).
XMLReader:
- Add missing NULL pointer error check.
XMLWriter:
- Add missing NULL pointer error check.
XSL:
- Add missing module dependency.
- Fix validation logic of php:function() callbacks.

Version 8.2.12

Core:
- Fixed bug (memory leak when class using trait with doc block).
- Fixed bug (Module entry being overwritten causes type errors in ext/dom).
- Fixed bug (__builtin_cpu_init check).
- (ZTS + preload = segfault on shutdown).
CLI:
- Ensure a single Date header is present.
CType:
- Fixed bug (ctype_alnum 5 times slower in PHP 8.1 or greater).
DOM:
- Restore old namespace reconciliation behaviour.
- Fixed bug (DOMNode serialization on PHP ^8.1).
Fileinfo:
- Fixed bug (fileinfo returns text/xml for some svg files).
Filter:
- Fix explicit FILTER_REQUIRE_SCALAR with FILTER_CALLBACK (ilutov)
Hash:
- Fixed bug (segfault copying/cloning a finalized HashContext).
Intl:
- Fixed bug (segfault on IntlDateFormatter::construct).
- Fixed bug (IntlDateFormatter::construct should throw an exception on an invalid locale).
MySQLnd:
- Fixed bug (PHP Startup: Invalid library (maybe not a PHP library) 'mysqlnd.so' in Unknown on line).
Opcache:
- Fixed opcache_invalidate() on deleted file.
- Fixed bug (JIT+private array property access inside closure accesses private property in child class).
PCRE:
- Fixed bug (Backport upstream fix, PCRE regular expressions with JIT enabled gives different result).
SimpleXML:
- Fixed bug (Can't use xpath with comments in SimpleXML).
- Fixed bug (Entity reference produces infinite loop in var_dump/print_r).
- Fixed bug (Unable to get processing instruction contents in SimpleXML).
- Fixed bug (Unable to get comment contents in SimpleXML).
Streams:
- Fixed bug (binding ipv4 address with both address and port at 0).
XML:
- Fix return type of stub of xml_parse_into_struct().
- Fix memory leak when calling xml_parse_into_struct() twice.
XSL:
- Fix type error on XSLTProcessor::transformToDoc return value with SimpleXML.

Version 8.2.11

Core:
- Fixed bug (Constant ASTs containing objects).
- Fixed bug (On riscv64 require libatomic if actually needed).
- Fixed bug : ini_parse_quantity() accepts invalid quantities.
- Fixed bug (Segfault when freeing incompletely initialized closures).
- Fixed bug (Internal iterator rewind handler is called twice).
- Fixed bug (Incorrect compile error when using array access on TMP value in function call).
DOM:
- Fix memory leak when setting an invalid DOMDocument encoding.
Iconv:
- Fixed build for NetBSD which still uses the old iconv signature.
Intl:
- Fixed bug (intl_get_error_message() broken after MessageFormatter::formatMessage() fails).
MySQLnd:
- Fixed bug (Invalid error message when connection via SSL fails: "trying to connect via (null)").
ODBC:
- Fixed memory leak with failed SQLPrepare.
- Fixed persistent procedural ODBC connections not getting closed.
SimpleXML:
- (XPath processing-instruction() function is not supported).
SPL:
- Fixed bug (RecursiveCallbackFilterIterator regression in 8.1.18).
SQLite3:
- Fixed bug (SQLite3 callback functions cause a memory leak with a callable array).

Version 8.2.10

CLI:
- Fixed bug (cli server crashes on SIGINT when compiled with ZEND_RC_DEBUG=1).
- Fixed bug (Improve man page about the built-in server).
Date:
- Fixed bug (Crash with DatePeriod when uninitialised objects are passed in).
Core:
- Fixed strerror_r detection at configuration time.
- Fixed trait typed properties using a DNF type not being correctly bound.
- Fixed trait property types not being arena allocated if copied from an internal trait.
- Fixed deep copy of property DNF type during lazy class load.
- Fixed memory freeing of DNF types for non arena allocated types.
DOM:
- Fix DOMEntity field getter bugs.
- Fix incorrect attribute existence check in DOMElement::setAttributeNodeNS.
- Fix DOMCharacterData::replaceWith() with itself.
- Fix empty argument cases for DOMParentNode methods.
- Fixed bug (Wrong default value of DOMDocument::xmlStandalone).
- Fix json_encode result on DOMDocument.
- Fix manually calling __construct() on DOM classes.
- Fixed bug (ParentNode methods should perform their checks upfront).
- Fix viable next sibling search for replaceWith.
- Fix segfault when DOMParentNode::prepend() is called when the child disappears.
FFI:
- Fix leaking definitions when using FFI::cdef()->new(...).
Hash:
- Fix use-of-uninitialized-value in hash_pbkdf2(), fix missing $options parameter in signature.
MySQLnd:
- Fixed bug (authentication to a sha256_password account fails over SSL).
- Fixed bug (mysqlnd fails to authenticate with sha256_password accounts using passwords longer than 19 characters).
- Fixed bug (MySQL Statement has a empty query result when the response field has changed, also Segmentation fault).
- Fixed invalid error message "Malformed packet" when connection is dropped.
Opcache:
- Fixed bug (opcache.interned_strings_buffer either has no effect or opcache_get_status() / phpinfo() is wrong).
- Avoid adding an unnecessary read-lock when loading script from shm if restart is in progress.
PCNTL:
- Revert behaviour of receiving SIGCHLD signals back to the behaviour before 8.1.22.
SPL:
- (SplFixedArray::setSize() causes use-after-free).
Standard:
- Prevent int overflow on $decimals in number_format.
- Fixed bug (Fix off-by-one bug when truncating tempnam prefix) (athos-ribeiro)

Version 8.2.9

Build:
- Fixed bug (PHP version check fails with '-' separator).
CLI:
- Fix interrupted CLI output causing the process to exit.
Core:
- Fixed oss-fuzz #60011 (Mis-compilation of by-reference nullsafe operator).
- Fixed line number of JMP instruction over else block.
- Fixed use-of-uninitialized-value with ??= on assert.
- Fixed oss-fuzz #60411 (Fix double-compilation of arrow-functions).
- Fixed build for FreeBSD before the 11.0 releases.
Curl:
- Fix crash when an invalid callback function is passed to CURLMOPT_PUSHFUNCTION.
Date:
- Fixed bug (Date modify returns invalid datetime).
- Fixed bug (Can't parse time strings which include (narrow) non-breaking space characters).
- Fixed bug (DateTime:createFromFormat stopped parsing datetime with extra space).
DOM:
- Fixed bug (DOMElement::replaceWith() doesn't replace node with DOMDocumentFragment but just deletes node or causes wrapping <></> depending on libxml2 version).
Fileinfo:
- Fixed bug (finfo returns wrong mime type for xz files).
FTP:
- Fix context option check for "overwrite".
- Fixed bug (Memory leak and invalid state with consecutive ftp_nb_fget).
GD:
- Fix most of the external libgd test failures.
Intl:
- Fix memory leak in MessageFormatter::format() on failure.
Libxml:
- Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
MBString:
- Fix (license issue: restricted unicode license headers).
Opcache:
- Fixed bug (OPCache with Enum and Callback functions results in segmentation fault).
- Prevent potential deadlock if accelerated globals cannot be allocated.
PCNTL:
- Fixed bug (SIGCHLD is not always returned from proc_open).
PDO:
- Fix (After php8.1, when PDO::ATTR_EMULATE_PREPARES is true and PDO::ATTR_STRINGIFY_FETCHES is true, decimal zeros are no longer filled).
PDO SQLite:
- Fix (Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt).
Phar:
- Add missing check on EVP_VerifyUpdate() in phar util.
- Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)
PHPDBG:
- Fixed bug (phpdbg -h options doesn't list the -z option).
Session:
- Removed broken url support for transferring session ID.
Standard:
- Fix serialization of RC1 objects appearing in object graph twice.
Streams:
- Fixed bug (Use-after-free when unregistering user stream wrapper from itself).
SQLite3:
- Fix replaced error handling in SQLite3Stmt::__construct.
XMLReader:
- Fix (Argument corruption when calling XMLReader::open or XMLReader::XML non-statically with observer active).

Version 8.2.8

CLI:
- Fixed bug (cli/get_set_process_title fails on MacOS).
Core:
- Fixed build for the riscv64 architecture/GCC 12.
Curl:
- Fixed bug (Unable to set CURLOPT_ACCEPT_ENCODING to NULL).
Date:
- Fixed bug (Segmentation fault with custom object date properties).
DOM:
- Fixed bugs and and and (DOMExceptions and segfaults with replaceWith).
- Fixed bug (Setting DOMAttr::textContent results in an empty attribute value).
- Fix return value in stub file for DOMNodeList::item.
- Fix spec compliance error with '*' namespace for DOMDocument::getElementsByTagNameNS.
- Fix DOMElement::append() and DOMElement::prepend() hierarchy checks.
- Fixed bug (Memory leak when calling a static method inside an xpath query).
- (append_node of a DOMDocumentFragment does not reconcile namespaces).
- (DOMChildNode::replaceWith() bug when replacing a node with itself).
- (Removed elements are still returned by getElementById).
- (print_r() on DOMAttr causes Segfault in php_libxml_node_free_list()).
- (Crash in DOMNameSpace debug info handlers).
- Fix lifetime issue with getAttributeNodeNS().
- Fix "invalid state error" with cloned namespace declarations.
- and #47530 and #47847 (various namespace reconciliation issues).
- (Completely broken array access functionality with DOMNamedNodeMap).
Opcache:
- Fix allocation loop in zend_shared_alloc_startup().
- Access violation on smm_shared_globals with ALLOC_FALLBACK.
- Fixed bug (php still tries to unlock the shared memory ZendSem with opcache.file_cache_only=1 but it was never locked).
OpenSSL:
- Fixed bug Incomplete validation of IPv6 Address fields in subjectAltNames (James Lucas, Jakub Zelenka).
PCRE:
- Fix preg_replace_callback_array() pattern validation.
PGSQL:
- Fixed intermittent segfault with pg_trace.
Phar:
- Fix cross-compilation check in phar generation for FreeBSD.
SPL:
- Fixed bug (SplFileInfo empty getBasename with more than one slash).
Standard:
- Fix access on NULL pointer in array_merge_recursive().
- Fix exception handling in array_multisort().
SQLite3:
- Fixed bug (Invalid associative array containing duplicate keys).

Version 8.2.7

Core:
- Fixed bug (Unable to alias namespaces containing reserved class names).
- Fixed bug (Conditional jump or move depends on uninitialised value(s)).
- Fixed bug (Exceeding memory limit in zend_hash_do_resize leaves the array in an invalid state).
- Fixed bug (Compilation error on old GCC versions).
- Fixed bug (foreach by-ref may jump over keys during a rehash).
Date:
- Fixed bug (DateTimeZone::getName() does not include seconds in offset).
Exif:
- Fixed bug (exif_read_data() cannot read smaller stream wrapper chunk sizes).
FPM:
- Fixed bug (PHP-FPM segfault due to after free usage of child->ev_std(out|err)).
- (FPM status page: query_string not properly JSON encoded).
- Fixed memory leak for invalid primary script file handle.
Hash:
- Fixed bug (hash_file() appears to be restricted to 3 arguments).
LibXML:
- Fixed bug (Few tests failed building with new libxml 2.11.0).
MBString:
- Fix bug (Segfault in mb_strrpos / mb_strripos when using negative offset and ASCII encoding).
Opcache:
- Fixed bug (Incorrect match default branch optimization).
- Fixed too wide OR and AND range inference.
- Fixed missing class redeclaration error with OPcache enabled.
- Fixed bug (In some specific cases SWITCH with one default statement will cause segfault).
PCNTL:
- Fixed maximum argument count of pcntl_forkx().
PGSQL:
- Fixed parameter parsing of pg_lo_export().
Phar:
- Fixed bug (Generating phar.php during cross-compile can't be done).
Soap:
- Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)
- Fixed bug (make test fail while soap extension build).
SPL:
- Fixed bug (Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)).
Standard:
- Fixed bug (move_uploaded_file() emits open_basedir warning for source file).
- Fixed bug (POST/PATCH request switches to GET after a HTTP 308 redirect).
Streams:
- Fixed bug ([Stream] STREAM_NOTIFY_PROGRESS over HTTP emitted irregularly for last chunk of data).
- Fixed bug (Stream Socket Timeout).
- Fixed bug (ASAN UndefinedBehaviorSanitizer when timeout = -1 passed to stream_socket_accept/stream_socket_client).

Version 8.2.6

Core:
- Fix inconsistent float negation in constant expressions.
- Fixed bug (php-cli core dump calling a badly formed function).
- Fixed bug (PHP 8.1.16 segfaults on line 597 of sapi/apache2handler/sapi_apache2.c).
- Fixed bug (Heap Buffer Overflow in zval_undefined_cv.).
- Fixed bug (Incorrect CG(memoize_mode) state after bailout in ??=).
Date:
- Fixed bug where the diff() method would not return the right result around DST changeover for date/times associated with a timezone identifier.
- Fixed out-of-range bug when converting to/from around the LONG_MIN unix timestamp.
DOM:
- (Segfault when using DOMChildNode::before()).
- Fixed incorrect error handling in dom_zvals_to_fragment().
Exif:
- Fixed bug (exif read : warnings and errors : Potentially invalid endianess, Illegal IFD size and Undefined index).
Intl:
- Fixed bug (TZData version not displayed anymore).
PCRE:
- Fixed bug (Segfault in preg_replace_callback_array()).
Reflection:
- Fixed bug (State-dependant segfault in ReflectionObject::getProperties).
SPL:
- Handle indirect zvals and use up-to-date properties in SplFixedArray::__serialize.
Standard:
- Fixed bug (mail() throws TypeError after iterating over $additional_headers array by reference).
- Fixed bug (Duplicates returned by array_unique when using enums).
Streams:
- Fixed bug (feof() behavior change for UNIX based socket resources).

Version 8.2.5

Core:
- Added optional support for max_execution_time in ZTS/Linux builds (Kévin Dunglas)
- Fixed use-after-free in recursive AST evaluation.
- Fixed bug (Memory leak PHP FPM 8.1).
- Re-add some CTE functions that were removed from being CTE by a mistake.
- Remove CTE flag from array_diff_ukey(), which was added by mistake.
- Fixed bug (Named arguments in CTE functions cause a segfault).
- Fixed bug (PHP 8.0.20 (ZTS) zend_signal_handler_defer crashes on apache).
- Fixed bug (zend_signal_handler_defer crashes on apache shutdown).
- Fixed bug (Fix NUL byte terminating Exception::__toString()).
- Fix potential memory corruption when mixing __callStatic() and FFI.
Date:
- Fixed bug (Private and protected properties in serialized Date* objects throw).
FPM:
- Fixed bug (fpm_env_init_main leaks environ).
- Destroy file_handle in fpm_main.
- (Incorrect SCRIPT_NAME with apache ProxyPassMatch when spaces are in path).
FTP:
- Propagate success status of ftp_close().
- Fixed bug (ftp_get/ftp_nb_get resumepos offset is maximum 10GB).
IMAP:
- Fix build failure with Clang 16.
MySQLnd:
- Fixed bug (Possible Memory Leak with SSL-enabled MySQL connections).
Opcache:
- Fixed build for macOS to cater with pkg-config settings.
- Fixed bug (opcache.consistency_checks > 0 causes segfaults in PHP >= 8.1.5 in fpm context).
OpenSSL:
- Add missing error checks on file writing functions.
PDO Firebird:
- Fixed bug (Bus error with PDO Firebird on RPI with 64 bit kernel and 32 bit userland).
Phar:
- Fixed bug (PharData archive created with Phar::Zip format does not keep files metadata (datetime)).
- Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit().
PDO ODBC:
- Fixed missing and inconsistent error checks on SQLAllocHandle.
PGSQL:
- Fixed typo in the array returned from pg_meta_data (extended mode).
SPL:
- Fixed bug (Array Data Address Reference Issue).
- Fixed bug (Unable to serialize processed SplFixedArrays in PHP 8.2.4).
- Fixed bug (ArrayIterator allows modification of readonly props).
Standard:
- Fixed bug (stream_socket_server context leaks).
- Fixed bug (Browscap crashes PHP 8.1.12 on request shutdown (apache2)).
- Fixed oss-fuzz #57392 (Buffer-overflow in php_fgetcsv() with \0 delimiter and enclosure).
- Fixed undefined behaviour in unpack().

Version 8.2.4

Core:
- Fixed incorrect check condition in ZEND_YIELD.
- Fixed incorrect check condition in type inference.
- Fix incorrect check in zend_internal_call_should_throw().
- Fixed overflow check in OnUpdateMemoryConsumption.
- Fixed bug (Entering shutdown sequence with a fiber suspended in a Generator emits an unavoidable fatal error or crashes).
- Fixed bug (Segfault/assertion when using fibers in shutdown function after bailout).
- Fixed SSA object type update for compound assignment opcodes.
- Fixed language scanner generation build.
- Fixed zend_update_static_property() calling zend_update_static_property_ex() misleadingly with the wrong return type.
- Fix bug (Fixed unknown string hash on property fetch with integer constant name).
- Fixed php_fopen_primary_script() call resulted on zend_destroy_file_handle() freeing dangling pointers on the handle as it was uninitialized.
Curl:
- Fixed deprecation warning at compile time.
- Fixed bug (Unable to return CURL_READFUNC_PAUSE in readfunc callback).
Date:
- Fix ('p' format specifier does not yield 'Z' for 00:00).
- Fix (Custom properties of Date's child classes are not serialised).
- Fixed bug (Private and protected properties in serialized Date* objects throw).
FFI:
- Fixed incorrect bitshifting and masking in ffi bitfield.
Fiber:
- Fixed assembly on alpine x86.
- Fixed bug (segfault when garbage collector is invoked inside of fiber).
FPM:
- Fixed bug (FPM unknown child alert not valid).
- Fixed bug (FPM successful config test early exit).
GMP:
- Properly implement GMP::__construct().
Intl:
- Fixed bug (Spoolchecker isSuspicious/areConfusable methods error code's argument always returning NULL0.
JSON:
- Fixed JSON scanner and parser generation build.
MBString:
- ext/mbstring: fix new_value length check.
- Fix bug (mb_convert_encoding crashes PHP on Windows).
Opcache:
- Fix incorrect page_size check.
OpenSSL:
- Fixed php_openssl_set_server_dh_param() DH params errors handling.
PDO OCI:
- (Reading a multibyte CLOB caps at 8192 chars).
PHPDBG:
- Fixed bug (heap buffer overflow on --run option misuse).
PGSQL:
- Fix (pg_lo_open segfaults in the strict_types mode).
Phar:
- Fix incorrect check in phar tar parsing.
Random:
- Fix (Do not trust arc4random_buf() on glibc).
- Fix (Made the default value of the first param of srand() and mt_srand() unknown).
Reflection:
- Fixed bug (Reflection::getClosureUsedVariables opcode fix with variadic arguments).
- Fix Segfault when using ReflectionFiber suspended by an internal function.
Session:
- Fixed ps_files_cleanup_dir() on failure code paths with -1 instead of 0 as the latter was considered success by callers. (nielsdos).
Standard:
- Fixed bug (Introduce mail.mixed_lf_and_crlf INI).
- Fixed bug (Made the default value of the first param of srand() and mt_srand() unknown).
- Fix incorrect check in cs_8559_5 in map_from_unicode().
- Fix bug for reset/end/next/prev() attempting to move pointer of properties table for certain internal classes such as FFI classes
- Fix incorrect error check in browsecap for pcre2_match().
Streams:
- Fixed bug (File corruption in _php_stream_copy_to_stream_ex when using copy_file_range).
- Fixed bug (copy() fails on cifs mounts because of incorrect copy_file_range() len).
Tidy:
- Fix memory leaks when attempting to open a non-existing file or a file over 4GB.
- Add missing error check on tidyLoadConfig.
Zlib:
- Fixed output_handler directive value's length which counted the string terminator.

Version 8.2.3

Core:
- (Password_verify() always return true with some hash). (CVE-2023-0567)
- (1-byte array overrun in common path resolve code). (CVE-2023-0568)
SAPI:
- Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)

Version 8.2.2

Core:
- Fixed bug (zif_get_object_vars: Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed).
- Fix (Assertion `(flag & (1<<3)) == 0' failed).
- Fix (Assertion failure when adding more than 2**30 elements to an unpacked array).
- Fix (Fiber stack variables do not participate in cycle collector).
- Fix (Broken run_time_cache init for internal enum methods).
FPM:
- (Missing separator in FPM FastCGI errors).
- Fixed bug (FPM does not reset fastcgi.error_header).
- (Configuration test does not perform UID lookups).
- Fixed memory leak when running FPM config test.
- (Wrong owner:group for listening unix socket).
Hash:
- Handle exceptions from __toString in XXH3's initialization (nielsdos)
LDAP:
- Fixed bug (LDAP\Connection::__construct() refers to ldap_create()).
Opcache:
- Fix inverted bailout value in zend_runtime_jit() (Max Kellermann).
- Fix access to uninitialized variable in accel_preload().
- Fix zend_jit_find_trace() crashes.
- Added missing lock for EXIT_INVALIDATE in zend_jit_trace_exit.
Phar:
- Fix wrong flags check for compression method in phar_object.c (nielsdos)
PHPDBG:
- Fix undefined behaviour in phpdbg_load_module_or_extension().
- Fix NULL pointer dereference in phpdbg_create_conditional_breal().
- Fix : phpdbg memory leaks by option "-h" (nielsdos)
- Fix phpdbg segmentation fault in case of malformed input (nielsdos)
Posix:
- Fix memory leak in posix_ttyname() (girgias)
Random:
- Fixed bug (Theoretical file descriptor leak for /dev/urandom).
Standard:
- Fix (Segfault in stripslashes() with arm64).
- Fixed bug (Incomplete validation of object syntax during unserialize()).
- Fix substr_replace with slots in repl_ht being UNDEF.
XMLWriter:
- Fix missing check for xmlTextWriterEndElement (nielsdos)

Version 8.2.1

Core:
- Fixed bug (constant() behaves inconsistent when class is undefined).
- Fixed bug (License information for xxHash is not included in README.REDIST.BINS file).
- Fixed bug (OpenSSL legacy providers not available on Windows).
- Fixed bug (Can't initialize heap: [0x000001e7]).
- Fixed potentially undefined behavior in Windows ftok(3) emulation.
- Fixed (Misleading error message for unpacking of objects).
Apache:
- Fixed bug (Partial content on incomplete POST request).
FPM:
- Fixed bug (Solaris port event mechanism is still broken after bug #66694).
- (Setting fastcgi.error_header can result in a WARNING).
- (FPM numeric user fails to set groups).
- Fixed bug (Random crash of FPM master process in fpm_stdio_child_said).
Imap:
- Fixed bug (IMAP: there's no way to check if a IMAP\Connection is still open).
MBString:
- Fixed bug (The behavior of mb_strcut in mbstring has been changed in PHP8.1).
Opcache:
- Fixed bug (Segmentation Fault during OPCache Preload).
OpenSSL:
- Fixed bug (OpenSSL engine clean up segfault).
- Fixed bug (PHP fails to build if openssl was built with --no-ec).
- Fixed bug (OpenSSL test failures when OpenSSL compiled with no-dsa).
Pcntl:
- Fixed bug (Signal handler called after rshutdown leads to crash).
PDO_Firebird:
- Fixed bug (Incorrect NUMERIC value returned from PDO_Firebird).
PDO/SQLite:
- (PDO::quote() may return unquoted string). (CVE-2022-31631)
Session:
- Fixed (session name silently fails with . and [).
SPL:
- Fixed (SplFileObject::__toString() reads next line).
- Fixed (Trampoline autoloader will get reregistered and cannot be unregistered).
SQLite3:
- (open_basedir bypass in SQLite3 by using file URI).
TSRM:
- Fixed Windows shmget() wrt. IPC_PRIVATE.

Version 8.2.0

CLI:
- (Server logs incorrect request method).
- Updated the mime-type table for the builtin-server.
- Fixed potential overflow for the builtin server via the PHP_CLI_SERVER_WORKERS environment variable.
- Fixed by changing STDOUT, STDERR and STDIN to not close on resource destruction.
- Implement built-in web server responding without body to HEAD request on a static resource.
- Implement built-in web server responding with HTTP status 405 to DELETE/PUT/PATCH request on a static resource.
- Fixed bug (Null pointer dereference with -w/-s options).
COM:
- Fixed bug (Can not create VT_ERROR variant type).
Core:
- (Observer may not be initialized properly).
- Fixed bug (Fix filename/lineno of constant expressions).
- Fixed bug (Improve class type in error messages).
- Support huge pages on MacOS.
- Fixed bug (Casting an object to array does not unwrap refcount=1 references).
- Fixed bug (Nullsafe in coalesce triggers undefined variable warning).
- Fixed bug and (Allow arbitrary const expressions in backed enums).
- Fixed bug (Incorrect lineno in backtrace of multi-line function calls).
- Optimised code path for newly created file with the stream plain wrapper.
- Uses safe_perealloc instead of perealloc for the ZEND_PTR_STACK_RESIZE_IF_NEEDED to avoid possible overflows.
- Reduced the memory footprint of strings returned by var_export(), json_encode(), serialize(), iconv_*(), mb_ereg*(), session_create_id(), http_build_query(), strstr(), Reflection*::__toString().
- Fixed bug (WeakMap object reference offset causing TypeError).
- Added error_log_mode ini setting.
- Updated request startup messages.
- Fixed bug (Arrow function with never return type compile-time errors).
- Fixed incorrect double to long casting in latest clang.
- Added support for defining constants in traits.
- Stop incorrectly emitting false positive deprecation notice alongside unsupported syntax fatal error for `"{$g{'h'}}"`.
- Fix unexpected deprecated dynamic property warning, which occurred when exit() in finally block after an exception was thrown without catching.
- Fixed bug (Crash in ZEND_RETURN/GC/zend_call_function) (Tim Starling)
- Fixed bug (Trailing dots and spaces in filenames are ignored).
- Fixed bug (Traits cannot be used in readonly classes).
- Fixed bug (@strict-properties can be bypassed using unserialization).
- Fixed bug (Using dnf type with parentheses after readonly keyword results in a parse error).
- Fixed bug ((A&B)|D as a param should allow AB or D. Not just A).
- Fixed observer class notify with Opcache file_cache_only=1.
- Fixes segfault with Fiber on FreeBSD i386 architecture.
- Fixed bug (Pure intersection types cannot be implicitly nullable) (Girgias)
- Fixed bug (dl() segfaults when module is already loaded).
- Fixed bug (Generator crashes when interrupted during argument evaluation with extra named params).
- Fixed bug (Generator crashes when memory limit is exceeded during initialization).
- Fixed a bug with preloaded enums possibly segfaulting.
- Fixed bug (Don’t reset func in zend_closure_internal_handler).
- Fixed potential NULL pointer dereference Windows shm*() functions.
- Fix target validation for internal attributes with constructor property promotion.
- Fixed bug (Generator memory leak when interrupted during argument evaluation.
- Move observer_declared_function_notify until after pass_two().
- Do not report MINIT stage internal class aliases in extensions.
Curl:
- Added support for CURLOPT_XFERINFOFUNCTION.
- Added support for CURLOPT_MAXFILESIZE_LARGE.
- Added new constants from cURL 7.62 to 7.80.
- New function curl_upkeep().
Date:
- Fixed (DateInterval::createFromDateString does not throw if non-relative items are present).
- (Allow including end date in DatePeriod iterations) (Daniel Egeberg, Derick)
- idate() now accepts format specifiers "N" (ISO Day-of-Week) and "o" (ISO Year).
- Fixed bug (DateTime::diff miscalculation is same time zone of different type).
- Fixed bug (DateTime object comparison after applying delta less than 1 second).
- Fixed bug (DateInterval 1.5s added to DateTimeInterface is rounded down since PHP 8.1.0).
- (Datetime fails to unserialize "extreme" dates).
- (DateTime Object with 5-digit year can't unserialized).
- (Wrong result from DateTimeImmutable::diff).
- Fixed bug (DateTime::getLastErrors() not returning false when no errors/warnings).
- Fixed bug with parsing large negative numbers with the @ notation.
DBA:
- Fixed LMDB driver hanging when attempting to delete a non-existing key (Girgias)
- Fixed LMDB driver memory leak on DB creation failure (Girgias)
- Fixed (dba: lmdb: allow to override the MDB_NOSUBDIR flag).
FFI:
- Fixed bug (Support assigning function pointers in FFI).
Fileinfo:
- Fixed bug (finfo returns wrong mime type for woff/woff2 files).
Filter:
- Added FILTER_FLAG_GLOBAL_RANGE to filter Global IPs.
FPM:
- Emit error for invalid port setting.
- Added extra check for FPM proc dumpable on SELinux based systems.
- Added support for listening queue on macOS.
- Changed default for listen.backlog on Linux to -1.
- Added listen.setfib pool option to set route FIB on FreeBSD.
- Added access.suppress_path pool option to filter access log entries.
- Fixed on fpm scoreboard occasional warning on acquisition failure.
- Fixed bug (SaltStack (using Python subprocess) hangs when running php-fpm 8.1.11).
FTP:
- Fix datetime format string to follow POSIX spec in ftp_mdtm().
GD:
- : OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
GMP:
- Fixed bug (GMP throws the wrong error when a GMP object is passed to gmp_init()).
Hash:
- : buffer overflow in hash_update() on long parameter. (CVE-2022-37454)
Intl:
- Update all grandfathered language tags with preferred values
- Fixed (Cannot unserialize IntlTimeZone objects).
- Fixed build for ICU 69.x and onwards.
- Declared Transliterator::$id as readonly to unlock subclassing it.
- Fixed bug (Incorrect argument number for ValueError in NumberFormatter).
MBString:
- Fixed bug (Segmentation fault in mb_strimwidth()).
mysqli:
- Fixed bug (mysqli_query throws warning despite using silenced error mode).
MySQLnd:
- Fixed potential heap corruption due to alignment mismatch.
OCI8:
- Added oci8.prefetch_lob_size directive to tune LOB query performance
- Support for building against Oracle Client libraries 10.1 and 10.2 has been dropped. Oracle Client libraries 11.2 or newer are now required.
ODBC:
- Fixed bug (User input not escaped when building connection string).
- Fixed bug (Current ODBC liveness checks may be inadequate).
Opcache:
- Allocate JIT buffer close to PHP .text segemnt to allow using direct IP-relative calls and jumps.
- Added initial support for JIT performance profiling generation for macOs Instrument.
- Fixed bug (Segfault with JIT and large match/switch statements).
- Added JIT support improvement for macOs for segments and executable permission bit handling.
- Added JIT buffer allocation near the .text section on FreeNSD.
- Fixed bug (Crash with JIT on mac arm64) (jdp1024/David Carlier)
- Fixed bug (opcache.interned_strings_buffer setting integer overflow).
- Added indirect call reduction for jit on x86 architectures.
- Fixed bug (Segfault in zend_accel_class_hash_copy).
- Fix opcache preload with observers enabled.
OpenSSL:
- Discard poll calls on socket when no timeout/non blocking/MSG_DONTWAIT.
- Fixed bug (SSL local_cert and local_pk do not respect open_basedir).
- Implement FR #76935 ("chacha20-poly1305" is an AEAD but does not work like AEAD).
- Added openssl_cipher_key_length function.
- Fixed bug (Compilation error openssl extension related to PR ).
- Fixed missing clean up of OpenSSL engine list - attempt to fix .
- Fixed bug (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does not build).
PCNTL:
- Fixed pcntl_(get|set)priority error handling for MacOS.
PCRE:
- (Allow null character in regex patterns).
- Updated bundled libpcre to 10.40.
PDO:
- Fixed bug (Initialize run time cache in PDO methods).
PDO_Firebird:
- Fixed bug (Bad interpretation of length when char is UTF-8).
PDO_ODBC:
- (crash with persistent connections in PDO_ODBC).
- Fixed bug (User input not escaped when building connection string).
- Fixed bug (Current ODBC liveness checks may be inadequate).
- Fixed bug (HY010 when binding overlong parameter).
PDO_PGSQL:
- Fixed bug (PgSQL large object resource is incorrectly closed).
Random:
- Added new random extension.
- Fixed bug (random extension is not thread safe).
- Fixed bug (segmentation fault if user engine throws).
- Fixed bug (signed integer overflow).
- Fixed bug (undefined behavior during shifting).
- Fixed bug , (incorrect expansion of bytes when generating uniform integers within a given range).
- Fixed bug (Fix memory leak on Randomizer::__construct() call twice).
- Fixed bug (PcgOneseq128XslRr64::jump() should not allow negative $advance).
- Changed Mt19937 to throw a ValueError instead of InvalidArgumentException for invalid $mode.
- Splitted Random\Randomizer::getInt() (without arguments) to Random\Randomizer::nextInt().
- Fixed bug (non-existant $sequence parameter in stub for PcgOneseq128XslRr64::__construct()).
- Fixed bug , (undefined behavior for MT_RAND_PHP when handling large ranges).
- Fixed bug (Xoshiro256StarStar does not reject the invalid all-zero state).
- Removed redundant RuntimeExceptions from Randomizer methods. The exceptions thrown by the engines will be exposed directly.
- Added extension specific Exceptions/Errors (RandomException, RandomError, BrokenRandomEngineError).
- Fixed bug (Randomizer::getInt(0, 2**32 - 1) with Mt19937 always returns 1).
- Fixed Randomizer::getInt() consistency for 32-bit engines.
- Fixed bug (build on older macOs releases).
- Fixed bug (Pre-PHP 8.2 output compatibility for non-mt_rand() functions for MT_RAND_PHP).
Reflection:
- Added ReflectionFunction::isAnonymous().
- Added ReflectionMethod::hasPrototype().
- Narrow ReflectionEnum::getBackingType() return type to ReflectionNamedType.
- Fixed bug (ReflectionFunction provides no way to get the called class of a Closure).
Session:
- Fixed bug (Improve session write failure message for user error handlers).
- Fixed (setcookie has an obsolete expires date format).
- Fixed (Avoid memory corruption when not unregistering custom session handler).
- Fixed bug (session_create_id() fails with user defined save handler that doesn't have a validateId() method).
SOAP:
- Fixed bug (Null pointer dereference while serializing the response).
Sockets:
- Added TCP_NOTSENT_LOWAT socket option.
- Added SO_MEMINFO socket option.
- Added SO_RTABLE socket option (OpenBSD), equivalent of SO_MARK (Linux).
- Added TCP_KEEPALIVE, TCP_KEEPIDLE, TCP_KEEPINTVL, TCP_KEEPCNT socket options.
- Added ancillary data support for FreeBSD.
- Added ancillary data support for NetBSD.
- Added SO_BPF_EXTENSIONS socket option.
- Added SO_SETFIB socket option.
- Added TCP_CONGESTION socket option.
- Added SO_ZEROCOPY/MSG_ZEROCOPY options.
- Added SOL_FILTER socket option for Solaris.
- Fixed socket constants regression as of PHP 8.2.0beta3.
Sodium:
- Added sodium_crypto_stream_xchacha20_xor_ic().
SPL:
- Uses safe_erealloc instead of erealloc to handle heap growth for the SplHeap::insert method to avoid possible overflows.
- Widen iterator_to_array() and iterator_count()'s $iterator parameter to iterable.
- (READ_CSV|DROP_NEW_LINE drops newlines within fields).
- (GlobIterator incorrect handling of open_basedir check).
SQLite3:
- Changed sqlite3.defensive from PHP_INI_SYSTEM to PHP_INI_USER.
Standard:
- net_get_interfaces() also reports wireless network interfaces on Windows.
- Finished AVIF support in getimagesize().
- Fixed bug (stripos with large haystack has bad performance).
- New function memory_reset_peak_usage().
- Fixed parse_url(): can not recognize port without scheme.
- Deprecated utf8_encode() and utf8_decode().
- Fixed the crypt_sha256/512 api build with clang > 12.
- Uses safe_erealloc instead of erealloc to handle options in getopt to avoid possible overflows.
- Implemented FR (str_split should return empty array for empty string).
- Added ini_parse_quantity function to convert ini quantities shorthand notation to int.
- Enable arc4random_buf for Linux glibc 2.36 and onwards for the random_bytes.
- Uses CCRandomGenerateBytes instead of arc4random_buf on macOs. (David Carlier).
- (glob() basedir check is inconsistent).
- Fixed (setcookie has an obsolete expires date format).
- Fixed (Segfault with array_multisort + array_shift).
- Fixed bug (`ksort` behaves incorrectly on arrays with mixed keys).
- Marked crypt()'s $string parameter as #[\SensitiveParameter].
- Fixed bug (build on older macOs releases).
- Fixed bug (Disabling IPv6 support disables unrelated constants).
- Revert "Fixed parse_url(): can not recognize port without scheme." (andypost)
- Fix crash reading module_entry after DL_UNLOAD() when module already loaded.
Streams:
- Set IP_BIND_ADDRESS_NO_PORT if available when connecting to remote host.
- Fixed bug (stream_wrapper_unregister() leaks memory).
- Discard poll calls on socket when no timeout/non blocking/MSG_DONTWAIT.
- Fixed bug ($http_response_header is wrong for long status line).
- Fixed bug (stream_select does not abort upon exception or empty valid fd set).
- Fixed bug (file copy between different filesystems).
- Fixed bug (stream_copy_to_stream fails if dest in append mode).
Windows:
- Added preliminary support for (cross-)building for ARM64.
XML:
- Added libxml_get_external_entity_loader() function.
Zip:
- add ZipArchive::clearError() method
- add ZipArchive::getStreamName() method
- add ZipArchive::getStreamIndex() method
- On Windows, the Zip extension is now built as shared library (DLL) by default.
- Implement fseek for zip stream when possible with libzip 1.9.1.

Version 8.1.28

Standard:
- Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
- Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
- Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)

Version 8.1.27

Core:
- Fixed oss-fuzz #54325 (Use-after-free of name in var-var with malicious error handler).
- Fixed oss-fuzz #64209 (In-place modification of filename in php_message_handler_for_zend).
- Fixed bug / (Invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC).
DOM:
- Fixed bug (DOM: Removing XMLNS namespace node results in invalid default: prefix).
FPM:
- Fixed bug (Segmentation fault in fpm_status_export_to_zval).
Intl:
- Fixed bug (Test bug69398.phpt fails with ICU 74.1).
LibXML:
- Fixed bug (libxml2 2.12.0 issue building from src).
MySQLnd:
- Avoid using uninitialised struct.
OpenSSL:
- (openssl_pkcs7_verify() may ignore untrusted CAs).
PCRE:
- Fixed bug (The gh11374 test fails on Alpinelinux).
PGSQL:
- Fixed bug wrong argument type for pg_untrace.
PHPDBG:
- Fixed bug (MEMORY_LEAK in phpdbg_prompt.c).
SQLite3:
- Fixed bug (sqlite3_defensive.phpt fails with sqlite 3.44.0).
Standard:
- Fix memory leak in syslog device handling.
- Fixed bug (browscap segmentation fault when configured in the vhost).
- Fixed bug (proc_open() does not take into account references in the descriptor array).
Streams:
- (Stream wrappers in imagecreatefrompng causes segfault).
Zip:
- Fixed bug (Inconsistency in ZipArchive::addGlob remove_path Option Behavior).

Version 8.1.26

Core:
- Fixed bug (Double-free of doc_comment when overriding static property via trait).
- Fixed segfault caused by weak references to FFI objects.
- Fixed max_execution_time: don't delete an unitialized timer.
DOM:
- Fix registerNodeClass with abstract class crashing.
- Add missing NULL pointer error check.
- Fix validation logic of php:function() callbacks.
Fiber:
- Fixed bug (ReflectionFiber segfault).
FPM:
- Fixed bug (Loading ext in FPM config does not register module handlers).
- Fixed bug (FPM: segfault dynamically loading extension without opcache).
Intl:
- Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.
Opcache:
- Added warning when JIT cannot be enabled.
- Fixed bug (Crashes in zend_accel_inheritance_cache_find since upgrading to 8.1.3 due to corrupt on-disk file cache).
OpenSSL:
- Fixed bug (Missing sigbio creation checking in openssl_cms_verify).
PCRE:
- Fixed bug (Backport upstream fix, Different preg_match result with -d pcre.jit=0).
SOAP:
- Fixed bug (Segmentation fault on SoapClient::__getTypes).
- (SOAP WSDL cache race condition causes Segmentation Fault).
- (SOAP leaves incomplete cache file on ENOSPC).
- Fix incorrect uri check in SOAP caching.
- Fix segfault and assertion failure with refcounted props and arrays.
- Fix potential crash with an edge case of persistent encoders.
- (Memleak in SoapClient).
Streams:
- (getimagesize with "&$imageinfo" fails on StreamWrappers).
XMLReader:
- Add missing NULL pointer error check.
XMLWriter:
- Add missing NULL pointer error check.
XSL:
- Add missing module dependency.
- Fix validation logic of php:function() callbacks.

Version 8.1.25

Core:
- Fixed bug (memory leak when class using trait with doc block).
- Fixed bug (Module entry being overwritten causes type errors in ext/dom).
- Fixed bug (__builtin_cpu_init check).
- (ZTS + preload = segfault on shutdown).
CLI:
- Ensure a single Date header is present.
CType:
- Fixed bug (ctype_alnum 5 times slower in PHP 8.1 or greater).
DOM:
- Restore old namespace reconciliation behaviour.
- Fixed bug (DOMNode serialization on PHP ^8.1).
Fileinfo:
- Fixed bug (fileinfo returns text/xml for some svg files).
Filter:
- Fix explicit FILTER_REQUIRE_SCALAR with FILTER_CALLBACK (ilutov)
Hash:
- Fixed bug (segfault copying/cloning a finalized HashContext).
Intl:
- Fixed bug (segfault on IntlDateFormatter::construct).
- Fixed bug (IntlDateFormatter::construct should throw an exception on an invalid locale).
MySQLnd:
- Fixed bug (PHP Startup: Invalid library (maybe not a PHP library) 'mysqlnd.so' in Unknown on line).
Opcache:
- Fixed opcache_invalidate() on deleted file.
- Fixed bug (JIT+private array property access inside closure accesses private property in child class).
PCRE:
- Fixed bug (Backport upstream fix, PCRE regular expressions with JIT enabled gives different result).
SimpleXML:
- Fixed bug (Can't use xpath with comments in SimpleXML).
- Fixed bug (Entity reference produces infinite loop in var_dump/print_r).
- Fixed bug (Unable to get processing instruction contents in SimpleXML).
- Fixed bug (Unable to get comment contents in SimpleXML).
Streams:
- Fixed bug (binding ipv4 address with both address and port at 0).
XML:
- Fix return type of stub of xml_parse_into_struct().
- Fix memory leak when calling xml_parse_into_struct() twice.
XSL:
- Fix type error on XSLTProcessor::transformToDoc return value with SimpleXML.
Sockets:
- Fix socket_export_stream() with wrong protocol (twosee)

Version 8.1.24

Core:
- Fixed bug (Constant ASTs containing objects).
- Fixed bug (On riscv64 require libatomic if actually needed).
- Fixed bug (Segfault when freeing incompletely initialized closures).
- Fixed bug (Internal iterator rewind handler is called twice).
- Fixed bug (Incorrect compile error when using array access on TMP value in function call).
DOM:
- Fix memory leak when setting an invalid DOMDocument encoding.
Iconv:
- Fixed build for NetBSD which still uses the old iconv signature.
Intl:
- Fixed bug (intl_get_error_message() broken after MessageFormatter::formatMessage() fails).
MySQLnd:
- Fixed bug (Invalid error message when connection via SSL fails: "trying to connect via (null)").
ODBC:
- Fixed memory leak with failed SQLPrepare.
- Fixed persistent procedural ODBC connections not getting closed.
SimpleXML:
- (XPath processing-instruction() function is not supported).
SPL:
- Fixed bug (RecursiveCallbackFilterIterator regression in 8.1.18).
SQLite3:
- Fixed bug (SQLite3 callback functions cause a memory leak with a callable array).

Version 8.1.23

CLI:
- Fixed bug (cli server crashes on SIGINT when compiled with ZEND_RC_DEBUG=1).
- Fixed bug (Improve man page about the built-in server).
Core:
- Fixed strerror_r detection at configuration time.
Date:
- Fixed bug : Crash with DatePeriod when uninitialised objects are passed in.
DOM:
- Fix DOMEntity field getter bugs.
- Fix incorrect attribute existence check in DOMElement::setAttributeNodeNS.
- Fix DOMCharacterData::replaceWith() with itself.
- Fix empty argument cases for DOMParentNode methods.
- Fixed bug (Wrong default value of DOMDocument::xmlStandalone).
- Fix json_encode result on DOMDocument.
- Fix manually calling __construct() on DOM classes.
- Fixed bug (ParentNode methods should perform their checks upfront).
- Fix segfault when DOMParentNode::prepend() is called when the child disappears.
FFI:
- Fix leaking definitions when using FFI::cdef()->new(...).
MySQLnd:
- Fixed bug (authentication to a sha256_password account fails over SSL).
- Fixed bug (mysqlnd fails to authenticate with sha256_password accounts using passwords longer than 19 characters).
- Fixed bug (MySQL Statement has a empty query result when the response field has changed, also Segmentation fault).
- Fixed invalid error message "Malformed packet" when connection is dropped.
Opcache:
- Fixed bug (opcache.interned_strings_buffer either has no effect or opcache_get_status() / phpinfo() is wrong).
- Avoid adding an unnecessary read-lock when loading script from shm if restart is in progress.
PCNTL:
- Revert behaviour of receiving SIGCHLD signals back to the behaviour before 8.1.22.
SPL:
- (SplFixedArray::setSize() causes use-after-free).
Standard:
- Prevent int overflow on $decimals in number_format.
- Fixed bug (Fix off-by-one bug when truncating tempnam prefix) (athos-ribeiro)

Version 8.1.22

Build:
- Fixed bug (PHP version check fails with '-' separator).
CLI:
- Fix interrupted CLI output causing the process to exit.
Core:
- Fixed oss-fuzz #60011 (Mis-compilation of by-reference nullsafe operator).
- Fixed use-of-uninitialized-value with ??= on assert.
- Fixed build for FreeBSD before the 11.0 releases.
Curl:
- Fix crash when an invalid callback function is passed to CURLMOPT_PUSHFUNCTION.
Date:
- Fixed bug (Date modify returns invalid datetime).
DOM:
- Fixed bug (DOMElement::replaceWith() doesn't replace node with DOMDocumentFragment but just deletes node or causes wrapping <></> depending on libxml2 version).
Fileinfo:
- Fixed bug (finfo returns wrong mime type for xz files).
FTP:
- Fix context option check for "overwrite".
- Fixed bug (Memory leak and invalid state with consecutive ftp_nb_fget).
GD:
- Fix most of the external libgd test failures.
Hash:
- Fix use-of-uninitialized-value in hash_pbkdf2(), fix missing $options parameter in signature.
Intl:
- Fix memory leak in MessageFormatter::format() on failure.
Libxml:
- Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
MBString:
- Fix (license issue: restricted unicode license headers).
Opcache:
- Fixed bug (OPCache with Enum and Callback functions results in segmentation fault).
- Prevent potential deadlock if accelerated globals cannot be allocated.
PCNTL:
- Fixed bug (SIGCHLD is not always returned from proc_open).
PCRE:
- Mangle PCRE regex cache key with JIT option.
PDO:
- Fix (After php8.1, when PDO::ATTR_EMULATE_PREPARES is true and PDO::ATTR_STRINGIFY_FETCHES is true, decimal zeros are no longer filled).
PDO SQLite:
- Fix (Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt).
Phar:
- Add missing check on EVP_VerifyUpdate() in phar util.
- Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)
PHPDBG:
- Fixed bug (phpdbg -h options doesn't list the -z option).
Session:
- Removed broken url support for transferring session ID.
Standard:
- Fix serialization of RC1 objects appearing in object graph twice.
SQLite3:
- Fix replaced error handling in SQLite3Stmt::__construct.

Version 8.1.21

CLI:
- Fixed bug (cli/get_set_process_title fails on MacOS).
Core:
- Fixed build for the riscv64 architecture/GCC 12.
Curl:
- Fixed bug (Unable to set CURLOPT_ACCEPT_ENCODING to NULL).
DOM:
- Fixed bugs and and and (DOMExceptions and segfaults with replaceWith).
- Fixed bug (Setting DOMAttr::textContent results in an empty attribute value).
- Fix return value in stub file for DOMNodeList::item.
- Fix spec compliance error with '*' namespace for DOMDocument::getElementsByTagNameNS.
- Fix DOMElement::append() and DOMElement::prepend() hierarchy checks.
- Fixed bug (Memory leak when calling a static method inside an xpath query).
- (append_node of a DOMDocumentFragment does not reconcile namespaces).
- (DOMChildNode::replaceWith() bug when replacing a node with itself).
- (Removed elements are still returned by getElementById).
- (print_r() on DOMAttr causes Segfault in php_libxml_node_free_list()).
- (Crash in DOMNameSpace debug info handlers).
- Fix lifetime issue with getAttributeNodeNS().
- Fix "invalid state error" with cloned namespace declarations.
- and #47530 and #47847 (various namespace reconciliation issues).
- (Completely broken array access functionality with DOMNamedNodeMap).
Opcache:
- Fix allocation loop in zend_shared_alloc_startup().
- Access violation on smm_shared_globals with ALLOC_FALLBACK.
- Fixed bug (php still tries to unlock the shared memory ZendSem with opcache.file_cache_only=1 but it was never locked).
OpenSSL:
- Fixed bug Incomplete validation of IPv6 Address fields in subjectAltNames (James Lucas, Jakub Zelenka).
PGSQL:
- Fixed intermittent segfault with pg_trace.
Phar:
- Fix cross-compilation check in phar generation for FreeBSD.
SPL:
- Fixed bug (SplFileInfo empty getBasename with more than one slash).
Standard:
- Fix access on NULL pointer in array_merge_recursive().
- Fix exception handling in array_multisort().

Version 8.1.20

Core:
- Fixed bug (Conditional jump or move depends on uninitialised value(s)).
- Fixed bug (Exceeding memory limit in zend_hash_do_resize leaves the array in an invalid state).
- Fixed bug (foreach by-ref may jump over keys during a rehash).
Date:
- Fixed bug (DateTimeZone::getName() does not include seconds in offset).
Exif:
- Fixed bug (exif_read_data() cannot read smaller stream wrapper chunk sizes).
FPM:
- Fixed bug (PHP-FPM segfault due to after free usage of child->ev_std(out|err)).
- (FPM status page: query_string not properly JSON encoded).
- Fixed memory leak for invalid primary script file handle.
Hash:
- Fixed bug (hash_file() appears to be restricted to 3 arguments).
LibXML:
- Fixed bug (Few tests failed building with new libxml 2.11.0).
Opcache:
- Fixed bug (Incorrect match default branch optimization).
- Fixed too wide OR and AND range inference.
- Fixed bug (In some specific cases SWITCH with one default statement will cause segfault).
PGSQL:
- Fixed parameter parsing of pg_lo_export().
Phar:
- Fixed bug (Generating phar.php during cross-compile can't be done).
Soap:
- Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)
- Fixed bug (make test fail while soap extension build).
SPL:
- Fixed bug (Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)).
Standard:
- Fixed bug (move_uploaded_file() emits open_basedir warning for source file).
- Fixed bug (POST/PATCH request switches to GET after a HTTP 308 redirect).
Streams:
- Fixed bug ([Stream] STREAM_NOTIFY_PROGRESS over HTTP emitted irregularly for last chunk of data).
- Fixed bug (Stream Socket Timeout).
- Fixed bug (ASAN UndefinedBehaviorSanitizer when timeout = -1 passed to stream_socket_accept/stream_socket_client).

Version 8.1.19

Core:
- Fix inconsistent float negation in constant expressions.
- Fixed bug (php-cli core dump calling a badly formed function).
- Fixed bug (PHP 8.1.16 segfaults on line 597 of sapi/apache2handler/sapi_apache2.c).
- Fixed bug (Heap Buffer Overflow in zval_undefined_cv.).
- Fixed bug (Incorrect CG(memoize_mode) state after bailout in ??=).
DOM:
- (Segfault when using DOMChildNode::before()).
- Fixed incorrect error handling in dom_zvals_to_fragment().
Exif:
- Fixed bug (exif read : warnings and errors : Potentially invalid endianess, Illegal IFD size and Undefined index).
Intl:
- Fixed bug (TZData version not displayed anymore).
PCRE:
- Fixed bug (Segfault in preg_replace_callback_array()).
Standard:
- Fixed bug (mail() throws TypeError after iterating over $additional_headers array by reference).
- Fixed bug (Duplicates returned by array_unique when using enums).

Version 8.1.18

Core:
- Added optional support for max_execution_time in ZTS/Linux builds.
- Fixed use-after-free in recursive AST evaluation.
- Fixed bug (Memory leak PHP FPM 8.1).
- Fixed bug (Named arguments in CTE functions cause a segfault).
- Fixed bug (PHP 8.0.20 (ZTS) zend_signal_handler_defer crashes on apache).
- Fixed bug (zend_signal_handler_defer crashes on apache shutdown).
- Fixed bug (Fix NUL byte terminating Exception::__toString()).
- Fix potential memory corruption when mixing __callStatic() and FFI.
Date:
- Fixed bug (DateTime modify with tz pattern should not update linked timezone).
FPM:
- Fixed bug (fpm_env_init_main leaks environ).
- Destroy file_handle in fpm_main.
- (Incorrect SCRIPT_NAME with apache ProxyPassMatch when spaces are in path).
FTP:
- Propagate success status of ftp_close().
- Fixed bug (ftp_get/ftp_nb_get resumepos offset is maximum 10GB).
IMAP:
- Fix build failure with Clang 16.
MySQLnd:
- Fixed bug (Possible Memory Leak with SSL-enabled MySQL connections).
Opcache:
- Fixed build for macOS to cater with pkg-config settings.
- Fixed bug (opcache.consistency_checks > 0 causes segfaults in PHP >= 8.1.5 in fpm context).
OpenSSL:
- Add missing error checks on file writing functions.
PDO Firebird:
- Fixed bug (Bus error with PDO Firebird on RPI with 64 bit kernel and 32 bit userland).
PDO ODBC:
- Fixed missing and inconsistent error checks on SQLAllocHandle.
Phar:
- Fixed bug (PharData archive created with Phar::Zip format does not keep files metadata (datetime)).
- Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit().
PGSQL:
- Fixed typo in the array returned from pg_meta_data (extended mode).
SPL:
- Fixed bug (Array Data Address Reference Issue).
- Fixed bug (ArrayIterator allows modification of readonly props).
Standard:
- Fixed bug (stream_socket_server context leaks).
- Fixed bug (Browscap crashes PHP 8.1.12 on request shutdown (apache2)).
- Fixed oss-fuzz #57392 (Buffer-overflow in php_fgetcsv() with \0 delimiter and enclosure).
- Fixed undefined behaviour in unpack().

Version 8.1.17

Core:
- Fixed incorrect check condition in ZEND_YIELD.
- Fixed incorrect check condition in type inference.
- Fixed overflow check in OnUpdateMemoryConsumption.
- Fixed bug (Entering shutdown sequence with a fiber suspended in a Generator emits an unavoidable fatal error or crashes).
- Fixed bug (Segfault/assertion when using fibers in shutdown function after bailout).
- Fixed SSA object type update for compound assignment opcodes.
- Fixed language scanner generation build.
- Fixed zend_update_static_property() calling zend_update_static_property_ex() misleadingly with the wrong return type.
- Fix bug (Fixed unknown string hash on property fetch with integer constant name).
- Fixed php_fopen_primary_script() call resulted on zend_destroy_file_handle() freeing dangling pointers on the handle as it was uninitialized.
Curl:
- Fixed deprecation warning at compile time.
- Fixed bug (Unable to return CURL_READFUNC_PAUSE in readfunc callback).
Date:
- Fix ('p' format specifier does not yield 'Z' for 00:00).
FFI:
- Fixed incorrect bitshifting and masking in ffi bitfield.
Fiber:
- Fixed assembly on alpine x86.
- Fixed bug (segfault when garbage collector is invoked inside of fiber).
FPM:
- Fixed bug (FPM unknown child alert not valid).
- Fixed bug (FPM successful config test early exit).
Intl:
- Fixed bug (Spoolchecker isSuspicious/areConfusable methods error code's argument always returning NULL0.
JSON:
- Fixed JSON scanner and parser generation build.
MBString:
- ext/mbstring: fix new_value length check.
- Fix bug (mb_convert_encoding crashes PHP on Windows).
Opcache:
- Fix incorrect page_size check.
OpenSSL:
- Fixed php_openssl_set_server_dh_param() DH params errors handling.
PDO OCI:
- (Reading a multibyte CLOB caps at 8192 chars).
PHPDBG:
- Fixed bug (heap buffer overflow on --run option misuse).
PGSQL:
- Fix (pg_lo_open segfaults in the strict_types mode).
Phar:
- Fix incorrect check in phar tar parsing.
Reflection:
- Fixed bug (Reflection::getClosureUsedVariables opcode fix with variadic arguments).
- Fix Segfault when using ReflectionFiber suspended by an internal function.
Session:
- Fixed ps_files_cleanup_dir() on failure code paths with -1 instead of 0 as the latter was considered success by callers. (nielsdos).
Standard:
- Fixed bug (Made the default value of the first param of srand() and mt_srand() unknown).
- Fix incorrect check in cs_8559_5 in map_from_unicode().
- Fix bug for reset/end/next/prev() attempting to move pointer of properties table for certain internal classes such as FFI classes
- Fix incorrect error check in browsecap for pcre2_match().
Tidy:
- Fix memory leaks when attempting to open a non-existing file or a file over 4GB.
- Add missing error check on tidyLoadConfig.
Zlib:
- Fixed output_handler directive value's length which counted the string terminator.

Version 8.1.16

Core:
- (Password_verify() always return true with some hash).
- (1-byte array overrun in common path resolve code).
SAPI:
- Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)

Version 8.1.15

Apache:
- Fixed bug (Partial content on incomplete POST request).
Core:
- Fixed bug (PHP crashes when execute_ex is overridden and a __call trampoline is used from internal code).
- Fix (Assertion `(flag & (1<<3)) == 0' failed).
- Fix wrong comparison in block optimisation pass after opcode update.
Date:
- Fixed bug (DateTime modify with unixtimestamp (@) must work like setTimestamp).
- Fixed bug (DateTimeZone fails to parse time zones that contain the "+" character).
Fiber:
- Fix assertion on stack allocation size.
FPM:
- Fixed bug (FPM does not reset fastcgi.error_header).
- (Wrong owner:group for listening unix socket).
Hash:
- Handle exceptions from __toString in XXH3's initialization (nielsdos)
LDAP:
- Fixed bug (LDAP\Connection::__construct() refers to ldap_create()).
MBString:
- Fixed: mb_strlen (and a couple of other mbstring functions) would wrongly treat 0x80, 0xFD, 0xFE, 0xFF, and certain other byte values as the first byte of a 2-byte SJIS character.
Opcache:
- Fix inverted bailout value in zend_runtime_jit() (Max Kellermann).
- Fix access to uninitialized variable in accel_preload().
- Fix zend_jit_find_trace() crashes.
- Added missing lock for EXIT_INVALIDATE in zend_jit_trace_exit.
Phar:
- Fix wrong flags check for compression method in phar_object.c (nielsdos)
PHPDBG:
- Fix undefined behaviour in phpdbg_load_module_or_extension().
- Fix NULL pointer dereference in phpdbg_create_conditional_breal().
- Fix : phpdbg memory leaks by option "-h" (nielsdos)
- Fix phpdbg segmentation fault in case of malformed input (nielsdos)
Posix:
- Fix memory leak in posix_ttyname() (girgias)
Standard:
- Fix (Segfault in stripslashes() with arm64).
- Fix substr_replace with slots in repl_ht being UNDEF.
TSRM:
- Fixed Windows shmget() wrt. IPC_PRIVATE.
XMLWriter:
- Fix missing check for xmlTextWriterEndElement (nielsdos)

Version 8.1.14

Core:
- Fixed bug (constant() behaves inconsistent when class is undefined).
- Fixed bug (License information for xxHash is not included in README.REDIST.BINS file).
- Fixed bug (Can't initialize heap: [0x000001e7]).
- Fixed potentially undefined behavior in Windows ftok(3) emulation.
Date:
- Fixed bug (DateTimeImmutable::diff differences in 8.1.10 onwards - timezone related).
- Fixed bug (DateTime::createFromFormat: Parsing TZID string is too greedy).
- Fixed bug (Time zone bug with \DateTimeInterface::diff()).
- Fixed bug (DateTime diff returns wrong sign on day count when using a timezone).
FPM:
- Fixed bug (Solaris port event mechanism is still broken after bug #66694).
- (Setting fastcgi.error_header can result in a WARNING).
- Fixed bug (Random crash of FPM master process in fpm_stdio_child_said).
MBString:
- Fixed bug (The behavior of mb_strcut in mbstring has been changed in PHP8.1).
Opcache:
- Fixed bug (Segmentation Fault during OPCache Preload).
OpenSSL:
- Fixed bug (PHP fails to build if openssl was built with --no-ec).
- Fixed bug (OpenSSL test failures when OpenSSL compiled with no-dsa).
Pcntl:
- Fixed bug (Signal handler called after rshutdown leads to crash).
PDO_Firebird:
- Fixed bug (Incorrect NUMERIC value returned from PDO_Firebird).
PDO/SQLite:
- (PDO::quote() may return unquoted string). (CVE-2022-31631)
Session:
- Fixed (session name silently fails with . and [).
SPL:
- Fixed (SplFileObject::__toString() reads next line).
- Fixed (Trampoline autoloader will get reregistered and cannot be unregistered).
SQLite3:
- (open_basedir bypass in SQLite3 by using file URI).

Version 8.1.13

CLI:
- Fixed bug (Null pointer dereference with -w/-s options).
Core:
- Fixed bug (Generator crashes when interrupted during argument evaluation with extra named params).
- Fixed bug (Generator crashes when memory limit is exceeded during initialization).
- Fixed potential NULL pointer dereference Windows shm*() functions.
- Fixed bug (Generator memory leak when interrupted during argument evaluation.
Date:
- Fixed bug (DateTimeZone ctr mishandles input and adds null byte if the argument is an offset larger than 100*60 minutes).
FPM:
- Fixed bug (SaltStack (using Python subprocess) hangs when running php-fpm 8.1.11).
mysqli:
- Fixed bug (mysqli_query throws warning despite using silenced error mode).
MySQLnd:
- Fixed potential heap corruption due to alignment mismatch.
OpenSSL:
- Fixed bug (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does not build).
SOAP:
- Fixed (Null pointer dereference while serializing the response).

Version 8.1.12

Core:
- Fixes segfault with Fiber on FreeBSD i386 architecture.
Fileinfo:
- Fixed bug (finfo returns wrong mime type for woff/woff2 files).
GD:
- : OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
Hash:
- : buffer overflow in hash_update() on long parameter. (CVE-2022-37454)
MBString:
- Fixed bug (Problem when ISO-2022-JP-MS is specified in mb_ encode_mimeheader).
Opcache:
- Added indirect call reduction for jit on x86 architectures.
Session:
- Fixed bug (session_create_id() fails with user defined save handler that doesn't have a validateId() method).
Streams:
- Fixed bug (stream_select does not abort upon exception or empty valid fd set).

Version 8.1.11

Core:
- : phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
- : Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
- Fixed bug (Crash in ZEND_RETURN/GC/zend_call_function) (Tim Starling)
- Fixed bug (Segmentation fault on script exit #9379).
- Fixed bug (Invalid class FQN emitted by AST dump for new and class constants in constant expressions).
DOM:
- (DOMDocument->replaceChild on doctype causes double free).
FPM:
- Fixed bug (FPM access.log with stderr begins to write logs to error_log after daemon reload).
- ("Headers already sent..." when previous connection was aborted).
GMP:
- Fixed bug (GMP throws the wrong error when a GMP object is passed to gmp_init()).
Intl:
- Fixed bug (Incorrect argument number for ValueError in NumberFormatter).
PCRE:
- Fixed pcre.jit on Apple Silicon.
PDO_PGSQL:
- Fixed bug (PgSQL large object resource is incorrectly closed).
Reflection:
- Fixed bug (ReflectionFunction provides no way to get the called class of a Closure).
Streams:
- Fixed bug ($http_response_header is wrong for long status line).

Version 8.1.10

Core:
- Fixed --CGI-- support of run-tests.php.
- Fixed incorrect double to long casting in latest clang.
- Fixed bug (GC root buffer keeps growing when dtors are present).
Date:
- Fixed bug (DateTime::diff miscalculation is same time zone of different type).
- Fixed bug (DateTime object comparison after applying delta less than 1 second).
- Fixed bug : (DateInterval 1.5s added to DateTimeInterface is rounded down since PHP 8.1.0).
- (Wrong result from DateTimeImmutable::diff).
DBA:
- Fixed LMDB driver memory leak on DB creation failure.
- Fixed bug (dba_open("non-existing", "c-", "flatfile") segfaults).
IMAP:
- Fixed bug (Segfault when connection is used after imap_close()).
Intl:
- Fixed IntlDateFormatter::formatObject() parameter type.
MBString:
- Fixed bug (mb_detect_encoding(): wrong results with null $encodings).
OPcache:
- Fixed bug (Loading blacklist file can fail due to negative length).
- Fixed bug (Segfault in zend_accel_class_hash_copy).
PDO_SQLite:
- Fixed bug (SQLite3 authorizer crashes on NULL values).
SQLite3:
- Fixed bug (SQLite3 authorizer crashes on NULL values).
Streams:
- Fixed bug (The resource returned by stream_socket_accept may have incorrect metadata).
- Fixed bug (SSL handshake timeout leaves persistent connections hanging).

Version 8.1.9

CLI:
- Fixed potential overflow for the builtin server via the PHP_CLI_SERVER_WORKERS environment variable.
- Fixed (Intentionally closing std handles no longer possible).
Core:
- Fixed bug (error_log on Windows can hold the file write lock).
- Fixed bug (WeakMap object reference offset causing TypeError).
Date:
- (DatePeriod doesn't warn with custom DateTimeImmutable).
FPM:
- Fixed zlog message prepend, free on incorrect address.
- Fixed possible double free on configuration loading failure. (Heiko Weber).
GD:
- Fixed bug (imagecopyresized() error refers to the wrong argument).
Intl:
- Fixed build for ICU 69.x and onwards.
OPcache:
- Fixed bug (PHP hanging infinitly at 100% cpu when check php syntax of a valid file).
- Fixed bug (Segfault with JIT and large match/switch statements).
Reflection:
- Fixed bug (Fixed Reflection::getModifierNames() with readonly modifier).
Standard:
- Fixed the crypt_sha256/512 api build with clang > 12.
- Uses CCRandomGenerateBytes instead of arc4random_buf on macOs. (David Carlier).
- Fixed bug (php_stream_sock_open_from_socket could return NULL).

Version 8.1.8

Core:
- Fixed bug (Intel CET is disabled unintentionally).
- Fixed leak in Enum::from/tryFrom for internal enums when using JIT
- Fixed calling internal methods with a static return type from extension code.
- Fixed bug (Casting an object to array does not unwrap refcount=1 references).
- Fixed potential use after free in php_binary_init().
CLI:
- Fixed (Intentionally closing std handles no longer possible).
COM:
- Fixed bug (Integer arithmethic with large number variants fails).
Curl:
- Fixed CURLOPT_TLSAUTH_TYPE is not treated as a string option.
Date:
- (Null-byte injection in CreateFromFormat and related functions).
- (DST timezone abbreviation has incorrect offset).
- (Weekdays are calculated incorrectly for negative years).
- (timezone_open accepts invalid timezone string argument).
Fileinfo:
- (Heap buffer overflow in finfo_buffer). (CVE-2022-31627)
FPM:
- (fpm: syslog.ident don't work).
GD:
- Fixed imagecreatefromavif() memory leak.
MBString:
- mb_detect_encoding recognizes all letters in Czech alphabet
- mb_detect_encoding recognizes all letters in Hungarian alphabet
- Fixed bug (pcre not ready at mbstring startup).
- Backwards-compatible mappings for 0x5C/0x7E in Shift-JIS are restored, after they had been changed in 8.1.0.
ODBC:
- Fixed handling of single-key connection strings.
OPcache:
- Fixed bug (tracing JIT crash after private instance method change).
OpenSSL:
- (Several openssl functions ignore the VCWD).
- (NULL byte injection in several OpenSSL functions working with certificates).
PDO_ODBC:
- Fixed handling of single-key connection strings.
Zip:
- Fixed bug (ZipArchive::close deletes zip file without updating stat cache).

Version 8.1.7

CLI:
- Fixed bug (CLI closes standard streams too early).
Date:
- (strtotime plurals / incorrect time).
- (Datetime fails to parse an ISO 8601 ordinal date (extended format)).
- (DateTime object does not support short ISO 8601 time format - YYYY-MM-DDTHH)
- (Timezones and offsets are not properly used when working with dates)
- (date parsing fails when provided with timezones including seconds).
- Fixed bug (Problems with negative timestamps and fractions).
FPM:
- Fixed ACL build check on MacOS.
- : php-fpm writes empty fcgi record causing nginx 502.
mysqlnd:
- : mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
OPcache:
- Fixed bug (tracing JIT crash after function/method change).
OpenSSL:
- (error:14095126:SSL routines:ssl3_read_n:unexpected eof while reading).
Pcntl:
- Fixed Haiku build.
pgsql:
- : Uninitialized array in pg_query_params(). (CVE-2022-31625)
Soap:
- Fixed bug (Error on wrong parameter on SoapHeader constructor).
- Fixed bug (SoapClient may strip parts of nmtokens).
SPL:
- Fixed bug (iterator_count() may run indefinitely).
Standard:
- Fixed bug (Crash during unloading of extension after dl() in ZTS).
Zip:
- Fixed type for index in ZipArchive::replaceFile.

Version 8.1.6

Core:
- Fixed bug (Registry settings are no longer recognized).
- Fixed potential race condition during resource ID allocation.
- Fixed bug (Preloading of constants containing arrays with enums segfaults).
- Fixed Haiku ZTS builds.
Date:
- Fixed bug (DateTimeZone::getTransitions() returns insufficient data).
- Fixed bug (Timezone doesn't work as intended).
- (DateTimeZone::getTransitions() returns invalid data).
- Fixed bug (Exceptions thrown within a yielded from iterator are not rethrown into the generator).
FFI:
- Fixed bug (Assigning function pointers to structs in FFI leaks).
FPM:
- (FPM /status reports wrong number of active processe).
- (FPM cannot shutdown processes).
- Fixed comment in kqueue remove callback log message.
Hash:
- (segfault when serializing finalized HashContext).
Iconv:
- Fixed bug (ob_end_clean does not reset Content-Encoding header).
Intl:
- Fixed bug (msgfmt_format $values may not support references).
MBString:
- Number of error markers emitted for invalid UTF-8 text matches WHATWG specification. This is a return to the behavior of PHP 8.0 and earlier.
MySQLi:
- Fixed bug (MySQLi uses unsupported format specifier on Windows).
SPL:
- Fixed bug (ArrayIterator may leak when calling __construct()).
- Fixed bug (SplFileObject: key() returns wrong value).
Streams:
- Fixed php://temp does not preserve file-position when switched to temporary file.
zlib:
- Fixed bug (ob_end_clean does not reset Content-Encoding header).

Version 8.1.5

Core:
- Fixed bug (Enum values in property initializers leak).
- Fixed freeing of internal attribute arguments.
- Fixed bug (memory leak of internal function attribute hash).
- Fixed bug (ZTS support on Alpine is broken).
Filter:
- Fixed signedness confusion in php_filter_validate_domain().
Intl:
- Fixed bug (Can't catch arg type deprecation when instantiating Intl classes).
- Fixed bug (Compilation error on cygwin).
- Fixed bug (Fix IntlPartsIterator key off-by-one error and first key).
MBString:
- Fixed bug (mb_encode_mimeheader: $indent functionality broken).
MySQLi:
- Fixed bug (mysqli_fetch_object creates inaccessible properties).
Pcntl:
- Fixed bug (Compilation error on cygwin).
PgSQL:
- Fixed result_type related stack corruption on LLP64 architectures.
- Fixed bug (pg_insert() fails for references).
Sockets:
- Fixed Solaris builds.
SPL:
- Fixed bug (SplFileObject - seek and key with csv file inconsistent).
- Fixed bug (Cannot override DirectoryIterator::current() without return typehint in 8.1).
Standard:
- Fixed bug (Force macOS to use statfs).

Version 8.1.4

Core:
- Fixed Haiku ZTS build.
- Fixed bug arginfo not regenerated for extension.
- Fixed bug Segfault when dumping uncalled fake closure with static variables.
- Fixed bug (Nested CallbackFilterIterator is leaking memory).
- Fixed bug (Wrong type inference of range() result).
- Fixed bug (Wrong first class callable by name optimization).
- Fixed bug (op_arrays with temporary run_time_cache leak memory when observed).
GD:
- Fixed libpng warning when loading interlaced images.
FPM:
- (Unsafe access to fpm scoreboard).
Iconv:
- Fixed bug (ob_clean() only does not set Content-Encoding).
- Fixed bug (Unexpected result for iconv_mime_decode).
MBString:
- Fixed bug (mb_check_encoding wrong result for 7bit).
MySQLnd:
- Fixed bug (NULL pointer dereference in mysqlnd package).
Reflection:
- Fixed bug (ReflectionClass::getConstants() depends on def. order).
Zlib:
- Fixed bug (ob_clean() only does not set Content-Encoding).

Version 8.1.3

Core:
- (Attribute instantiation leaves dangling pointer).
- Fixed bug (Environment vars may be mangled on Windows).
- Fixed bug (Segfault when INI file is not readable).
FFI:
- Fixed bug (FFI::cast() from pointer to array is broken).
Filter:
- Fix #81708: UAF due to php_filter_float() failing for ints. (CVE-2021-21708)
FPM:
- Fixed memory leak on invalid port.
- Fixed bug (Invalid OpenMetrics response format returned by FPM status page.
MBString:
- Fixed bug (mb_send_mail may delimit headers with LF only).
MySQLnd:
- Fixed bug (MariaDB version prefix 5.5.5- is not stripped).
pcntl:
- Fixed pcntl_rfork build for DragonFlyBSD.
Sockets:
- Fixed bug (sockets extension compilation errors).
Standard:
- Fixed bug (Regression in unpack for negative int value).
- Fixed bug (mails are sent even if failure to log throws exception).

Version 8.1.2

Core:
- (Nullsafe operator leaks dynamic property name).
- (Using null coalesce assignment with $GLOBALS["x"] produces opcode error).
- (GCC-11 silently ignores -R).
- (Misleading "access type ... must be public" error message on final or abstract interface methods).
- (cached_chunks are not counted to real_size on shutdown).
- Fixed bug (Multi-inherited final constant causes fatal error).
- Fixed zend_fibers.c build with ZEND_FIBER_UCONTEXT.
- Added riscv64 support for fibers.
Filter:
- Fixed FILTER_FLAG_NO_RES_RANGE flag.
Hash:
- Fixed bug (Incorrect return types for hash() and hash_hmac()).
- Fixed bug (Inconsistent argument name in hash_hmac_file and hash_file).
MBString:
- (mb_check_encoding(7bit) segfaults).
MySQLi:
- (MYSQL_OPT_LOAD_DATA_LOCAL_DIR not available in MariaDB).
- Introduced MYSQLI_IS_MARIADB.
- Fixed bug (mysqli_sql_exception->getSqlState()).
MySQLnd:
- Fixed bug where large bigints may be truncated.
OCI8:
- Fixed bug (php_oci_cleanup_global_handles segfaults at second call).
OPcache:
- (Tracing JIT crashes on reattaching).
Readline:
- (Cannot input unicode characters in PHP 8 interactive shell).
Reflection:
- (ReflectionEnum throwing exceptions).
PDO_PGSQL:
- Fixed error message allocation of PDO PgSQL.
Sockets:
- Avoid void* arithmetic in sockets/multicast.c on NetBSD.
- Fixed ext/sockets build on Haiku.
Spl:
- (SplFileObject::seek broken with CSV flags).
- Fixed bug (Cloning a faked SplFileInfo object may segfault).
Standard:
- Fixed bug (gethostbyaddr outputs binary string).
- Fixed bug (php_uname doesn't recognise latest Windows versions).

Version 8.1.1

IMAP:
- (imap_(un)delete accept sequences, not single numbers).
PCRE:
- Update bundled PCRE2 to 10.39.
- (Out of bounds in php_pcre_replace_impl).
Standard:
- (stream_get_contents() may unnecessarily overallocate).

Version 8.1.0

Core:
- Fixed inclusion order for phpize builds on Windows.
- Added missing hashtable insertion APIs for arr/obj/ref.
- (Relative file path is removed from uploaded file).
- (CE_CACHE allocation with concurrent access).
- (Fiber does not compile on AIX).
- (SEGFAULT in zend_do_perform_implementation_check).
- (Header injection via default_mimetype / default_charset).
- (Fix compile failure on Solaris with clang).
- (Observer may not be initialized properly).
- (Using Enum as key in WeakMap triggers GC + SegFault).
- (TEST_PHP_CGI_EXECUTABLE badly set in run-tests.php).
- (unset() of $GLOBALS sub-key yields warning).
- (New ampersand token parsing depends on new line after it).
- (Unicode characters in cli.prompt causes segfault).
- ("Declaration should be compatible with" gives incorrect line number with traits).
- (CLI server: insufficient cleanup if request startup fails).
- (match error message improvements).
- (Fiber support missing for Solaris Sparc).
- (Comparison of fake closures doesn't work).
- (powerpc64 build fails on fibers).
- (Cyclic unserialize in TMPVAR operand may leak).
- (__sleep allowed to return non-array).
- (function scope static variables are not bound to a unique function).
- (__callStatic fired in base class through a parent call if the method is private).
- (incorrect debug info on Closures with implicit binds).
CLI:
- (Server logs incorrect request method).
COM:
- Dispatch using LANG_NEUTRAL instead of LOCALE_SYSTEM_DEFAULT.
Curl:
- (Support CURLOPT_SSLCERT_BLOB for cert strings).
Date:
- (Regression Incorrect difference after timezone change).
- (Interval serialization regression since 7.3.14 / 7.4.2).
- (Incorrect timezone transition details for POSIX data).
- (Missing second with inverted interval).
- Speed up finding timezone offset information.
- (date_create_from_format misses leap year).
- (DateTimeZone::getTransitions() truncated).
- (Wrong diff between 2 dates in different timezones).
- (Missing second with inverted interval).
- (DateTimeZone silently falls back to UTC when providing an offset with seconds).
- (Regression in 8.1: add() now truncate ->f).
- (Date interval calculation not correct).
- (Incorrect difference using DateInterval).
- (date_diff() function returns false result).
- (dst not handled past 2038).
- (Wrong date diff).
- (DateTime. diff returns negative values).
- (date_diff on two dates with timezone set localised returns wrong results).
- (Incorrect date from timestamp).
- (Extra day on diff between begin and end of march 2016).
- (DateTime::diff confuse on timezone 'Asia/Tokyo').
- (Datetime add not realising it already applied DST change).
- (DateTimeImmutable::getTimestamp() triggers DST switch in incorrect time).
- (Handling DST transitions correctly).
- (Date diff is bad calculated, in same time zone).
- (DateTime::add does only care about backward DST transition, not forward).
- (DateTime->diff having issues with leap days for timezones ahead of UTC).
- (Date difference varies according day time).
- (DateTime's diff DateInterval incorrect in timezones from UTC+01:00 to UTC+12:00).
- (diff makes wrong in hour for Asia/Tehran).
- (DateTime::diff() generates months differently between time zones).
- (timelib mishandles future timestamps (triggered by 'zic -b slim')).
- (Invalid date time created (with day "00")).
- (DateTime calculate wrong with DateInterval).
- (DateTime objects behave incorrectly around DST transition).
- (DateTime(Immutable)::sub around DST yield incorrect time).
DBA:
- (TokyoCabinet driver leaks memory).
DOM:
- (DOMElement::setIdAttribute() called twice may remove ID).
FFI:
- ("TYPE *" shows unhelpful message when type is not defined).
Filter:
- (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
FPM:
- (Future possibility for heap overflow in FPM zlog).
- (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).
- Added openmetrics status format.
- Enable process renaming on macOS.
- Added pm.max_spawn_rate option to configure max spawn child processes rate.
- (Events port mechanism).
FTP:
- Convert resource<ftp> to object \FTP\Connection.
GD:
- (libpng warning from imagecreatefromstring).
- Convert resource<gd font> to object \GdFont.
- Added support for Avif images
hash:
- (Add MurmurHash V3).
- (Add xxHash support).
JSON:
- (Change of $depth behaviour in json_encode() on PHP 8.1).
LDAP:
- Convert resource<ldap link> to object \LDAP\Connection.
- Convert resource<ldap result> to object \LDAP\Result.
- Convert resource<ldap result entry> to object \LDAP\ResultEntry.
MBString:
- (mbstring may use pointer from some previous request).
- (mb_detect_encoding() regression).
- (mb_detect_encoding misdetcts ASCII in some cases).
- (mb_detect_encoding() segfaults when 7bit encoding is specified).
MySQLi:
- (Emulate mysqli_fetch_all() for libmysqlclient).
- (Replace language in APIs and source code/docs).
- (Add option to specify LOAD DATA LOCAL white list folder (including libmysql)).
MySQLnd:
- (Crash (Bus Error) in mysqlnd due to wrong alignment).
- (PDO uses too much memory).
Opcache:
- (Incorrect JIT code for ADD with a reference to array).
- (Memory leak in PHPUnit with functional JIT).
- (infinite loop in building cfg during JIT compilation).
- (Wrong result with pow operator with JIT enabled).
- (Intermittent property assignment failure with JIT enabled).
- (Assertion `zv != ((void *)0)' failed for "preload" with JIT).
- (building opcache with phpize fails).
- (opcache header not installed).
- Added inheritance cache.
OpenSSL:
- ($tag argument of openssl_decrypt() should accept null/empty string).
- Bump minimal OpenSSL version to 1.0.2.
PCRE:
- (PCRE2 10.35 JIT performance regression).
- Bundled PCRE2 is 10.37.
PDO:
- (PDO_MYSQL: PDO::PARAM_LOB does not bind to a stream for fetching a BLOB).
PDO MySQL:
- (PDO::lastInsertId() return wrong).
- (PDO discards error message text from prepared statement).
PDO OCI:
- (Support 'success with info' at connection).
PDO ODBC:
- Implement PDO_ATTR_SERVER_VERSION and PDO_ATTR_SERVER_INFO for PDO::getAttribute().
PDO PgSQL:
- (pdo_pgsql: Inconsitent boolean conversion after calling closeCursor()).
PDO SQLite:
- (Proper data-type support for PDO_SQLITE).
PgSQL:
- (pg_end_copy still expects a resource).
- Convert resource<pgsql link> to object \PgSql\Connection.
- Convert resource<pgsql result> to object \PgSql\Result.
- Convert resource<pgsql large object> to object \PgSql\Lob.
Phar:
- Use SHA256 by default for signature.
- Add support for OpenSSL_SHA256 and OpenSSL_SHA512 signature.
phpdbg:
- (unknown help topic causes assertion failure).
PSpell:
- Convert resource<pspell> to object \PSpell\Dictionary.
- Convert resource<pspell config> to object \PSpell\Config.
readline:
- (invalid read in readline completion).
Reflection:
- (ArgumentCountError when getting default value from ReflectionParameter with new).
- (PHP 8.1: ReflectionClass->getTraitAliases() crashes with Internal error).
- (Enum: ReflectionMethod->getDeclaringClass() return a ReflectionClass).
- (Make ReflectionEnum and related class non-final).
- (ReflectionProperty::getDefaultValue() returns current value for statics).
- (ReflectionProperty::__toString() renders current value, not default value).
- (ReflectionAttribute is not a Reflector).
- (no way to determine if Closure is static).
- Implement ReflectionFunctionAbstract::getClosureUsedVariables.
Shmop:
- (shmop_open won't attach and causes php to crash).
SimpleXML:
- (Segfault in zif_simplexml_import_dom).
SNMP:
- Implement SHA256 and SHA512 for security protocol.
Sodium:
- Added the XChaCha20 stream cipher functions.
- Added the Ristretto255 functions, which are available in libsodium 1.0.18.
SPL:
- (SplFileObject::fgetcsv incorrectly returns a row on premature EOF).
- (Recursive SplFixedArray::setSize() may cause double-free).
- (LimitIterator + SplFileObject regression in 8.0.1).
- (Special json_encode behavior for SplFixedArray).
- ("Notice: Undefined index" on unset() ArrayObject non-existing key).
- (FilesystemIterator::FOLLOW_SYMLINKS remove KEY_AS_FILE from bitmask).
Standard:
- (gethostbyaddr('::1') returns ip instead of name after calling some other method).
- (Incorrectly using libsodium for argon2 hashing).
- (PHP 7.3+ memory leak when unserialize() is used on an associative array).
- (Serialization is unexpectedly allowed on anonymous classes with __serialize()).
- (hrtime breaks build on OSX before Sierra).
- (method_exists on Closure::__invoke inconsistency).
Streams:
- (stream_isatty emits warning with attached stream wrapper).
XML:
- (special character is breaking the path in xml function) (CVE-2021-21707).
- (XML_OPTION_SKIP_WHITE strips embedded whitespace).
Zip:
- (ZipArchive::extractTo() may leak memory).
- (Dirname ending in colon unzips to wrong dir).
- (ZipArchive::extractTo extracts outside of destination) (CVE-2021-21706).
- (ZipArchive::getStream doesn't use setPassword).

Version 8.0.30

Libxml:
- Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
Phar:
- Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)

Version 8.0.29

Soap:
- Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)

Version 8.0.28

Core:
- (Password_verify() always return true with some hash).
- (1-byte array overrun in common path resolve code).
SAPI:
- Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)

Version 8.0.27

PDO/SQLite:
- (PDO::quote() may return unquoted string). (CVE-2022-31631)

Version 8.0.26

CLI:
- Fixed bug (Null pointer dereference with -w/-s options).
Core:
- Fixed bug (Generator crashes when interrupted during argument evaluation with extra named params).
- Fixed bug (Generator crashes when memory limit is exceeded during initialization).
- Fixed potential NULL pointer dereference in Windows shm*() functions.
- Fixed bug (Generator memory leak when interrupted during argument evaluation.
Date:
- Fixed bug (DateTimeZone ctr mishandles input and adds null byte if the argument is an offset larger than 100*60 minutes).
FPM:
- Fixed bug (SaltStack (using Python subprocess) hangs when running php-fpm 8.1.11).
mysqli:
- Fixed bug (mysqli_query throws warning despite using silenced error mode).
OpenSSL:
- Fixed bug (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does not build).
SOAP:
- Fixed (Null pointer dereference while serializing the response).

Version 8.0.25

GD:
- : OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
Hash:
- : buffer overflow in hash_update() on long parameter. (CVE-2022-37454)
Session:
- Fixed bug (session_create_id() fails with user defined save handler that doesn't have a validateId() method).
Streams:
- Fixed bug (stream_select does not abort upon exception or empty valid fd set).

Version 8.0.24

Core:
- Fixed bug (Crash in ZEND_RETURN/GC/zend_call_function) (Tim Starling)
- Fixed bug (Segmentation fault on script exit #9379).
- Fixed bug (LSP error in eval'd code refers to wrong class for static type).
- : Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
DOM:
- (DOMDocument->replaceChild on doctype causes double free).
FPM:
- Fixed bug (FPM access.log with stderr begins to write logs to error_log after daemon reload).
- ("Headers already sent..." when previous connection was aborted).
GMP:
- Fixed bug (GMP throws the wrong error when a GMP object is passed to gmp_init()).
Intl:
- Fixed bug (Incorrect argument number for ValueError in NumberFormatter).
Phar:
- : phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
PDO_PGSQL:
- Fixed bug (PgSQL large object resource is incorrectly closed).
Reflection:
- Fixed bug (ReflectionFunction provides no way to get the called class of a Closure).
- Fixed bug (Private method is incorrectly dumped as "overwrites").
Streams:
- Fixed bug ($http_response_header is wrong for long status line).

Version 8.0.23

Core:
- Fixed incorrect double to long casting in latest clang.
DBA:
- Fixed LMDB driver memory leak on DB creation failure.
- Fixed bug (dba_open("non-existing", "c-", "flatfile") segfaults).
Intl:
- Fixed IntlDateFormatter::formatObject() parameter type.
OPcache:
- Fixed bug (Loading blacklist file can fail due to negative length).
PDO_SQLite:
- Fixed bug (SQLite3 authorizer crashes on NULL values).
SQLite3:
- Fixed bug (SQLite3 authorizer crashes on NULL values).
Standard:
- Fixed bug (php_stream_sock_open_from_socket could return NULL).
Streams:
- Fixed bug (The resource returned by stream_socket_accept may have incorrect metadata).
- Fixed bug (SSL handshake timeout leaves persistent connections hanging).

Version 8.0.22

CLI:
- Fixed potential overflow for the builtin server via the PHP_CLI_SERVER_WORKERS environment variable.
Core:
- Fixed bug (error_log on Windows can hold the file write lock).
- Fixed bug (WeakMap object reference offset causing TypeError).
Date:
- (DatePeriod doesn't warn with custom DateTimeImmutable).
DBA:
- Fixed LMDB driver hanging when attempting to delete a non-existing key.
FPM:
- Fixed zlog message prepend, free on incorrect address.
- Fixed possible double free on configuration loading failure.
GD:
- Fixed bug (imagecopyresized() error refers to the wrong argument).
Intl:
- Fixed build for ICU 69.x and onwards.
OPcache:
- Fixed bug (PHP hanging infinitly at 100% cpu when check php syntaxe of a valid file).
Standard:
- Fixed the crypt_sha256/512 api build with clang > 12.
- Uses CCRandomGenerateBytes instead of arc4random_buf on macOs.

Version 8.0.21

Core:
- Fixed potential use after free in php_binary_init().
CLI:
- Fixed (Intentionally closing std handles no longer possible).
COM:
- Fixed bug (Integer arithmethic with large number variants fails).
Curl:
- Fixed CURLOPT_TLSAUTH_TYPE is not treated as a string option.
Date:
- (DST timezone abbreviation has incorrect offset).
- (Weekdays are calculated incorrectly for negative years).
- (timezone_open accepts invalid timezone string argument).
FPM:
- (fpm: syslog.ident don't work).
MBString:
- Fixed bug (pcre not ready at mbstring startup).
ODBC:
- Fixed handling of single-key connection strings.
OpenSSL:
- (Several openssl functions ignore the VCWD).
- (NULL byte injection in several OpenSSL functions working with certificates).
PDO_ODBC:
- Fixed errorInfo() result on successful PDOStatement->execute().
- Fixed handling of single-key connection strings.
Zip:
- Fixed bug (ZipArchive::close deletes zip file without updating stat cache).

Version 8.0.20

CLI:
- Fixed bug (CLI closes standard streams too early).
Core:
- Fixed Haiku ZTS builds.
Date:
- Fixed bug (Segmentation fault when converting immutable and mutable DateTime instances created using reflection).
FPM:
- Fixed ACL build check on MacOS.
- : php-fpm writes empty fcgi record causing nginx 502.
Mysqlnd:
- : mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
OPcache:
- Fixed bug (ini_get() is optimized out when the option does not exist).
Pcntl:
- Fixed Haiku build.
Pgsql:
- : Uninitialized array in pg_query_params(). (CVE-2022-31625)
Soap:
- Fixed bug (Error on wrong parameter on SoapHeader constructor).
- Fixed bug (SoapClient may strip parts of nmtokens).
SPL:
- Fixed bug (iterator_count() may run indefinitely).
Zip:
- Fixed type for index in ZipArchive::replaceFile.

Version 8.0.19

Core:
- Fixed bug (Exceptions thrown within a yielded from iterator are not rethrown into the generator).
Date:
- Fixed bug (DatePeriod iterator advances when checking if valid).
FFI:
- Fixed bug (Assigning function pointers to structs in FFI leaks).
FPM:
- (FPM /status reports wrong number of active processe).
- (FPM cannot shutdown processes).
- Fixed comment in kqueue remove callback log message.
Iconv:
- Fixed bug (ob_end_clean does not reset Content-Encoding header).
Intl:
- Fixed bug (msgfmt_format $values may not support references).
MySQLi:
- Fixed bug (MySQLi uses unsupported format specifier on Windows).
SPL:
- Fixed bug (ArrayIterator may leak when calling __construct()).
- Fixed bug (SplFileObject: key() returns wrong value).
Streams:
- Fixed php://temp does not preserve file-position when switched to temporary file.
zlib:
- Fixed bug (ob_end_clean does not reset Content-Encoding header).

Version 8.0.18

Core:
- Fixed freeing of internal attribute arguments.
- Fixed bug (memory leak of internal function attribute hash).
- Fixed bug (ZTS support on Alpine is broken).
Filter:
- Fixed signedness confusion in php_filter_validate_domain().
Intl:
- Fixed bug (Compilation error on cygwin).
MBString:
- Fixed bug (mb_encode_mimeheader: $indent functionality broken).
MySQLi:
- Fixed bug (mysqli_fetch_object creates inaccessible properties).
Pcntl:
- Fixed bug (Compilation error on cygwin).
PgSQL:
- Fixed result_type related stack corruption on LLP64 architectures.
- Fixed bug (pg_insert() fails for references).
Sockets:
- Fixed Solaris builds.
SPL:
- Fixed bug (SplFileObject - seek and key with csv file inconsistent).
Standard:
- Fixed bug (Force macOS to use statfs).

Version 8.0.17

Core:
- Fixed Haiku ZTS build.
GD:
- Fixed libpng warning when loading interlaced images.
FPM:
- (Unsafe access to fpm scoreboard).
Iconv:
- Fixed bug (ob_clean() only does not set Content-Encoding).
- Fixed bug (Unexpected result for iconv_mime_decode).
MySQLnd:
- Fixed bug (NULL pointer dereference in mysqlnd package).
OPcache:
- Fixed bug (Wrong type inference of range() result).
Reflection:
- Fixed bug (ReflectionClass::getConstants() depends on def. order).
Zlib:
- Fixed bug (ob_clean() only does not set Content-Encoding).

Version 8.0.16

Core:
- (Attribute instantiation leaves dangling pointer).
- Fixed bug (Environment vars may be mangled on Windows).
FFI:
- Fixed bug (FFI::cast() from pointer to array is broken).
Filter:
- Fix #81708: UAF due to php_filter_float() failing for ints.
FPM:
- Fixed memory leak on invalid port.
MBString:
- Fixed bug (mb_send_mail may delimit headers with LF only).
MySQLnd:
- Fixed bug (MariaDB version prefix 5.5.5- is not stripped).
Sockets:
- Fixed ext/sockets build on Haiku.
- Fixed bug (sockets extension compilation errors).
Standard:
- Fixed bug (mails are sent even if failure to log throws exception).

Version 8.0.15

Core:
- (GCC-11 silently ignores -R).
- (cached_chunks are not counted to real_size on shutdown).
Filter:
- Fixed FILTER_FLAG_NO_RES_RANGE flag.
Hash:
- Fixed bug (Incorrect return types for hash() and hash_hmac()).
- Fixed bug (Inconsistent argument name in hash_hmac_file and hash_file).
MySQLnd:
- Fixed bug where large bigints may be truncated.
OCI8:
- Fixed bug (php_oci_cleanup_global_handles segfaults at second call).
OPcache:
- (Tracing JIT crashes on reattaching).
PDO_PGSQL:
- Fixed error message allocation of PDO PgSQL.
Sockets:
- Avoid void* arithmetic in sockets/multicast.c on NetBSD.
Spl:
- (SplFileObject::seek broken with CSV flags).

Version 8.0.14

Core:
- (Stringable not implicitly declared if __toString() came from a trait).
- (Fatal Error not properly logged in particular cases).
- (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
- (::class with dynamic class name may yield wrong line number).
FPM:
- (Future possibility for heap overflow in FPM zlog).
GD:
- (libpng warning from imagecreatefromstring).
IMAP:
- (imap_(un)delete accept sequences, not single numbers).
OpenSSL:
- (./configure: detecting RAND_egd).
PCRE:
- (Out of bounds in php_pcre_replace_impl).
SPL:
- (MultipleIterator Segmentation fault w/ SimpleXMLElement attached).
Standard:
- (dns_get_record fails on FreeBSD for missing type).
- (stream_get_contents() may unnecessarily overallocate).

Version 8.0.13

Core:
- (Header injection via default_mimetype / default_charset).
Date:
- (Interval serialization regression since 7.3.14 / 7.4.2).
DBA:
- (TokyoCabinet driver leaks memory).
MBString:
- (mbstring may use pointer from some previous request).
Opcache:
- (Unexpected behavior with arrays and JIT).
PCRE:
- (PCRE2 10.35 JIT performance regression).
XML:
- (special character is breaking the path in xml function). (CVE-2021-21707)
XMLReader:
- (XMLReader::getParserProperty may throw with a valid property).

Version 8.0.12

CLI:
- (Server logs incorrect request method).
Core:
- (Observer current_observed_frame may point to an old (overwritten) frame).
- (Observer may not be initialized properly).
DOM:
- (DOMElement::setIdAttribute() called twice may remove ID).
FFI:
- ("TYPE *" shows unhelpful message when type is not defined).
FPM:
- (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).
Fileinfo:
- (High memory usage during encoding detection).
Filter:
- (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
Opcache:
- (Cannot support large linux major/minor device number when read /proc/self/maps).
Reflection:
- ReflectionAttribute is no longer final.
SPL:
- (Recursive SplFixedArray::setSize() may cause double-free).
- (LimitIterator + SplFileObject regression in 8.0.1).
Standard:
- (Change Error message of sprintf/printf for missing/typo position specifier).
Streams:
- (stream_isatty emits warning with attached stream wrapper).
XML:
- (XML_OPTION_SKIP_WHITE strips embedded whitespace).
Zip:
- (ZipArchive::extractTo() may leak memory).
- (Dirname ending in colon unzips to wrong dir).

Version 8.0.11

Core:
- (Stream position after stream filter removed).
- (Non-seekable streams don't update position after write).
- (Integer Overflow when concatenating strings).
GD:
- (During resize gdImageCopyResampled cause colors change).
Opcache:
- (segfault with preloading and statically bound closure).
Shmop:
- (shmop_open won't attach and causes php to crash).
Standard:
- (disk_total_space does not work with relative paths).
- (Unterminated string in dns_get_record() results).
SysVMsg:
- (Heap Overflow in msg_send).
XML:
- (xml_parse may fail, but has no error code).
Zip:
- (ZipArchive::getStream doesn't use setPassword).
- (ZipArchive::extractTo extracts outside of destination).

Version 8.0.10

Core:
- (php_output_handler_append illegal write access).
- (Weird behaviour when using get_called_class() with call_user_func()).
- (Built-in Webserver Drops Requests With "Upgrade" Header).
BCMath:
- (BCMath returns "-0").
CGI:
- (HTTP Status header truncation).
Date:
- (Error parsing when AM/PM not at the end).
- (DateTimeZone accepting invalid UTC timezones).
- (date_create_from_format misses leap year).
- (DateTime::modify() loses time with 'weekday' parameter).
GD:
- (imagefilledellipse does not work for large circles).
MySQLi:
- (Integer overflow in mysqli_real_escape_string()).
Opcache:
- (Wrong result with pow operator with JIT enabled).
- (Intermittent property assignment failure with JIT enabled).
- (Multiple PHP processes crash with JIT enabled).
- (Segfault in var[] after array_slice with JIT).
- (Memory leak in PHPUnit with functional JIT).
- (Infinite loop in building cfg during JIT compilation) (Nikita, Dmitry)
- (Integer overflow behavior is different with JIT enabled).
OpenSSL:
- (Error build openssl extension on php 7.4.22).
PDO_ODBC:
- (PDO_ODBC doesn't account for SQL_NO_TOTAL).
Phar:
- : Symlinks are followed when creating PHAR archive
Shmop:
- (shmop can't read beyond 2147483647 bytes).
SimpleXML:
- (Segfault in zif_simplexml_import_dom).
Standard:
- (Integer overflow on substr_replace).
- (getimagesize returns 0 for 256px ICO images).
- (Heap buffer overflow via str_repeat).
Streams:
- (Segfault when removing a filter).

Version 8.0.9

Core:
- (copy() and stream_copy_to_stream() fail for +4GB files).
- (incorrect handling of indirect vars in __sleep).
- (Object to int warning when using an object as a string offset).
- (PHP built-in web server resets timeout when it can kill the process).
- (Built-in Webserver - overwrite $_SERVER['request_uri']).
- (Using return value of zend_assign_to_variable() is not safe).
- (--r[fcez] always return zero exit code).
Intl:
- (Locale::lookup() wrong result with canonicalize option).
- (IntlDateFormatter fails for "GMT+00:00" timezone).
- (grapheme_strrpos() broken for negative offsets).
OpenSSL:
- (openssl_csr_sign truncates $serial).
PCRE:
- (PCRE2 10.37 shows unexpected result).
- (Too much memory is allocated for preg_replace()).
Reflection:
- (Segmentation fault while create newInstance from attribute).
Standard:
- (flock() only locks first byte of file).

Version 8.0.8

Core:
- (incorrect debug info on Closures with implicit binds).
- (Double free in realpath_cache_clean()).
- (open_basedir bypass through adding "..").
- (Typed property performance degradation with .= operator).
- (Integer underflow in memory limit comparison).
- (SSRF bypass in FILTER_VALIDATE_URL). (CVE-2021-21705)
Bzip2:
- (fflush before stream_filter_remove corrupts stream).
Fileinfo:
- (implicit declaration of function 'magic_stream' is invalid).
GMP:
- (GMP operators throw errors with wrong parameter names).
OCI8:
- (error in regression test for oci_fetch_object() and oci_fetch_array()).
Opcache:
- (Broken property type handling after incrementing reference).
- (JIT segfault with return from required file).
OpenSSL:
- (native Windows cert verification uses CN as server name).
MySQLnd:
- (PDO uses too much memory).
PDO_Firebird:
- (Stack buffer overflow in firebird_info_cb). (CVE-2021-21704)
- (SIGSEGV in firebird_handle_doer). (CVE-2021-21704)
- (SIGSEGV in firebird_stmt_execute). (CVE-2021-21704)
- (Crash while parsing blob data in firebird_fetch_blob). (CVE-2021-21704)
readline:
- (invalid read in readline completion).
Standard:
- (phpinfo(INFO_VARIABLES) "Array to string conversion").
- (method_exists on Closure::__invoke inconsistency).
Windows:
- (PGO data for main PHP DLL are not used).

Version 8.0.7

Core:
- (opendir() warning wrong info when failed on Windows).
- (HTTP Authorization schemes are treated as case-sensitive).
- (Memory exhaustion on invalid string offset).
FPM:
- (Events port mechanism).
FTP:
- (Info leak in ftp extension).
- (Wrong FTP error messages).
GD:
- (GD install is affected by external libgd installation).
Intl:
- (Unable to clone NumberFormatter after failed parse()).
MBString:
- (mb_convert_encoding removes references from arrays).
ODBC:
- (ODBC doesn't account for SQL_NO_TOTAL indicator).
Opcache:
- (JIT "not supported" on 32-bit x86 -- build problem?).
- (Opcache optimization assumes wrong part of ternary operator in if-condition).
- (Literal compaction merges non-equal related literals).
PDO_MySQL:
- (PDO discards error message text from prepared statement).
PDO_ODBC:
- (bound parameters ignore explicit type definitions).
pgsql:
- Fixed php_pgsql_fd_cast() wrt. php_stream_can_cast().
SPL:
- (SplFileObject::DROP_NEW_LINE is broken for NUL and CR).
XMLReader:
- (XMLReader: encoding length not checked).
Zip:
- (ZipArchive::extractTo() ignores references).

Version 8.0.6

PDO_pgsql:
- Revert " (PDO::PARAM_INT is treated the same as PDO::PARAM_STR)"

Version 8.0.5

Core:
- (Flushing streams with compression filter is broken).
- (Function exec without $output but with $restult_code parameter crashes).
- (threaded mod_php won't load on FreeBSD: No space available for static Thread Local Storage).
- Changed PowerPC CPU registers used by Zend VM to work around GCC bug. Old registers (r28/r29) might be clobbered by _restgpr routine used for return from C function compiled with -Os.
Dba:
- (dba_popen() may cause segfault during RSHUTDOWN).
DOM:
- (UAF when appending DOMDocument to element).
FFI:
- (CData structs with fields of type struct can't be passed as C function argument).
FPM:
- (Duplication of info about inherited socket after pool removing).
FTP:
- (SSL_read on shutdown, ftp/proc_open).
IMAP:
- (imap_open() fails when the flags parameter includes CL_EXPUNGE).
- (imap_mail_compose() header injection).
Intl:
- (msgfmt_format() does not accept DateTime references).
LibXML:
- (Invalid memory access in php_libxml_xmlCheckUTF8).
- (simplexml_load_file() doesn't use HTTP headers).
MySQLnd:
- (Calling stmt_store_result after fetch doesn't throw an error).
Opcache:
- (PHP problem with JIT).
- (erronous array key overflow in 2D array with JIT).
- (PHP crash using JIT).
- (DASM_S_RANGE_VREG on PHP_INT_MIN-1).
Pcntl:
- (Potential integer overflow in pcntl_exec()).
PCRE:
- (preg_split ignores limit flag when pattern with \K has 0-width fullstring match).
PDO_ODBC:
- (PDO ODBC truncates BLOB records at every 256th byte).
PDO_pgsql:
- (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
Session:
- (Cannot set save handler when save_handler is invalid).
- (session_name() problem with backslash).
SOAP:
- (SOAP special XML characters in namespace URIs not encoded).
Standard:
- (Taking a reference to $_SERVER hides its values from phpinfo()).
- ('getdir' accidentally defined as an alias of 'dir').
- (phpinfo(INFO_CREDITS) displays nothing in CLI).
- (http wrapper silently ignores long Location headers).
- (HTTP wrapper waits for HTTP 1 response after HTTP 101).
Zip:
- (ZipArchive::isCompressionMethodSupported does not exist).

Version 8.0.3

Core:
- (mail(): Headers after Bcc headers may be ignored).
DOM:
- (DOMChildNode::remove() doesn't work on CharacterData nodes).
Gettext:
- (bindtextdomain with null dir doesn't return old value).
MySQLnd:
- (mysqlnd's mysql_clear_password does not transmit null-terminated password).
- (SegFault when disabling ATTR_EMULATE_PREPARES and MySQL 8.0).
MySQLi:
- (x() and y() truncating floats to integers).
Opcache:
- (write_property handler of internal classes is skipped on preloaded JITted code).
- (opcache doesn't honour pcre.jit option).
- (Opcache JIT makes some boolean logic unexpectedly be true).
- (JIT produces Assert failure and UNKNOWN:0 var_dumps in code involving bitshifts).
OpenSSL:
- (Providing RSA key size < 512 generates key that crash PHP).
Phar:
- (Unclear error message wrt. __halt_compiler() w/o semicolon)
- (Phar does not mark UTF-8 filenames in ZIP archives).
- (Phar cannot compress large archives).
Socket:
- (Different sockets compare as equal (regression in 8.0)).
SPL:
- (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
Standard:
- (file_get_contents() maxlen fails above (2**31)-1 bytes).
- (ext/standard/dl.c fallback code path with syntax error).

Version 8.0.2

Core:
- (bogus parse error on >4GB source code).
- (filter buffers entire read until file closed).
- (Invalid union type TypeError in anonymous classes).
- (GCC throws warning about type narrowing in ZEND_TYPE_INIT_CODE).
BCMath:
- (bcadd('a', 'a') doesn't throw an exception).
Curl:
- (Resetting POSTFIELDS to empty array breaks request).
Date:
- (last day of the month causes runway cpu usage).
DOM:
- (Wrong parameter type in DOMElement::removeAttributeNode stub).
Filter:
- (0x and 0X are considered valid hex numbers by filter_var()).
GMP:
- (Strings containing only a base prefix return 0 object).
Intl:
- (Missing resource causes subsequent get() calls to fail).
MySQLi:
- (mysqlnd with MYSQLI_OPT_INT_AND_FLOAT_NATIVE fails to interpret bit columns).
- (Fetching resultsets from stored procedure with cursor fails).
- (segfault using prepared statements on stored procedures that use a cursor).
- (Crash in mysqlnd_fetch_stmt_row_cursor when calling an SP with a cursor).
ODBC:
- (all floats are the same in ODBC parameters).
Opcache:
- (php_opcache.dll crashes when using Apache 2.4 with JIT).
PDO_Firebird:
- (Parameters with underscores no longer recognized).
Phar:
- (zip-based phar does not respect phar.require_hash).
- (Incorrect locator detection in ZIP-based phars).
- (Compressed ZIP Phar extractTo() creates garbage files).
Phpdbg:
- Reverted fix for bug (Access violation near NULL on source operand).
SOAP:
- (Null Dereference in SoapClient). (CVE-2021-21702)

Version 8.0.1

Core:
- (PHPIZE configuration has outdated PHP_RELEASE_VERSION).
- (White space not unfolded for CC/Bcc headers).
- (Iterable not covariant to mixed).
- (Build of PHP extension fails due to configuration gap with libtool).
- (stream filter loses final block of data).
Fileinfo:
- (finfo_open crafted magic parsing SIGABRT).
FPM:
- (FPM returns 200 status on request without SCRIPT_FILENAME env).
IMAP:
- (imap_msgno() incorrectly warns and return false on valid UIDs in PHP 8).
- Fix a regression with valid UIDs in imap_savebody().
- Make warnings for invalid message numbers/UIDs between functions consistent.
Intl:
- (MessageFormatAdapter::getArgTypeList redefined).
Opcache:
- (Incorrect range inference result when division results in float).
- (Opcache misses executor_globals).
- (Unable to disable the use of the AVX command when using JIT).
- (Strange out of memory error when running with JIT).
- (Segmentation fault with JIT enabled).
- (Immediate SIGSEGV upon ini_set("opcache.jit_debug", 1)).
OpenSSL:
- (OpenSSL extension fails to build against LibreSSL due to lack of OCB support).
PDO MySQL:
- (PDOStatement::fetchAll() throws for upsert queries).
- (nextRowset() ignores MySQL errors with native prepared statements).
- (PDO::exec() - Bad error handling with multiple commands).
- (Multiple rowsets not returned unless PDO statement object is unset()).
- (Unexpected "Cannot execute queries while other unbuffered queries").
- (Multiple statements in init command triggers unbuffered query error).
- (PDOStatement cannot be GCed/closeCursor-ed when a PROCEDURE resultset SIGNAL).
- (Can't execute query with pending result sets).
- (PDO does not throw an exception when parameter values are missing).
- (PdoStatement->execute() fails but does not throw an exception).
- (LOAD DATA INFILE broken).
- (Executing PDOStatement::fetch() more than once prevents releasing resultset).
- (PDO re-uses parameter values from earlier calls to execute()).
Phar:
- (Phar Zip parse crash - mmap fail).
- (`PharData` says invalid checksum for valid tar).
- (PharData::addEmptyDir('/') Possible integer overflow).
Phpdbg:
- (Access violation near NULL on source operand).
SPL:
- (SplFileObject: fgets after seek returns wrong line).
Standard:
- (Return Value of zend_fstat() not Checked).
- (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). (CVE-2020-7071)
Tidy:
- (ob_tidyhandler is never reset).
Tokenizer:
- (Nullsafe operator tokenize with TOKEN_PARSE flag fails).
XML:
- XmlParser opaque object renamed to XMLParser for consistency with other XML objects.
Zlib:
- (Support for flushing in zlib stream).

Version 8.0.0

BZ2:
- (fread() does not report bzip2.decompress errors).
CLI:
- Allow debug server binding to an ephemeral port via `-S localhost:0`.
COM:
- (DOTNET .NET 4.0 GAC new location).
- (com_event_sink crashes on certain arguments).
Calendar:
- (Potential type confusion in unixtojd() parameter parsing).
Core:
- (scandir duplicates file name at every 65535th file).
- (Fatal error "Function must be a string" message should be renamed).
- (register_shutdown_function() does not correctly handle exit code).
- (Allow implementing Traversable on abstract classes).
- (Enhance undefined class constant error with class name).
- (Calling exit() in a shutdown function does not change the exit value in CLI).
- (Unclear error message when not implementing a renamed abstract trait function).
- (Converting optional argument to variadic forbidden by LSP checks).
- (Can't rebind closure returned by Closure::fromCallable()).
- (Shebang line not stripped for non-primary script).
- (Wrong reflection on MultipleIterator::__construct).
- (Cannot alias a method named "namespace").
- (convert error on receiving variables when duplicate [).
- (Incorrect callability check inside internal methods).
- (Referencing argument in a function makes it a reference in the stack trace).
- ("Unexpected end of file" is not an acceptable error message).
- (method_exists and property_exists incoherent behavior).
- (data:// wrappers are writable).
- (Check __set_state structure).
- ("Illegal offset type" exception during AST evaluation not handled properly).
- (Assertion failure when unsetting variable during binary op).
- (Segfault when trying to access non-existing variable).
- (Syntax error in configure / unescaped "[]" in php.m4).
- (count(DOMNodeList) doesn't match count(IteratorIterator(DOMNodeList))).
- (Promoted untyped properties should get null default value).
- (Promoted constructor params with attribs cause crash).
- (Generator doesn't throw exception after multiple yield from iterable).
- (Build fails due to undeclared UINT32_C).
- (Exit in auto-prepended file does not abort PHP execution).
- (memleak after two set_exception_handler calls with __call).
- (Segmentation fault with named arguments in nested call).
- (Cannot skip arguments when extended debug is enabled).
- (broken namespace usage in eval code).
- (Windows Deduplication Enabled, randon permission errors).
- (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
- (assert() vs named parameters - confusing error).
- (Abstract trait methods returning "self" cannot be fulfilled by traits).
- Fixed faulty generator cleanup with yield from.
- Implement #[Attr] Attribute syntax as per final vote in RFC https://wiki.php.net/rfc/shorter_attribute_syntax_change
- (phpinfo() reports "On" as 1 for the some extensions).
- (require() throws fatal error instead of exception).
- Removed the pdo_odbc.db2_instance_name php.ini directive.
- Use SSE2 instructions do locale independent strtolower.
Curl:
- Bumped required libcurl version to 7.29.0.
- (Null pointer deref if CurlHandle directly instantiated).
DOM:
- Add property DOMXPath::$registerNodeNamespaces and constructor argument that allow global flag to configure query() or evaluate() calls.
- (DOMChildNode API crash on unattached nodes).
- (loadHTML() truncates at NUL bytes).
Date:
- (DateTime::createFromFormat should new static(), not new self()).
- (Default value for sunrise/sunset zenith still wrong).
- (discrepancy between time and microtime).
- (DateTimeImmutable::createFromFormat() does not populate time).
- (datetime: new format "p", same as "P" but returning "Z" for UTC).
Enchant:
- Add LIBENCHANT_VERSION macro.
- Add enchant_dict_add and enchant_dict_is_added functions.
- Deprecate enchant_broker_set_dict_path, enchant_broker_get_dict_path, enchant_dict_add_to_personal and enchant_dict_is_in_session.
- Use libenchant-2 when available.
FFI:
- Added FFI\CType::getName() method.
- (FFI doesn't handle well PHP exceptions within callback).
- (Converting FFI instances to bool fails).
FPM:
- Add pm.status_listen option.
Fileinfo:
- Upgrade to libmagic 5.39.
GD:
- Added imagegetinterpolation().
- (imagepolygon num_points requirement).
- Made the $num_points parameter of php_imagepolygon optional.
- Removed deprecated image2wbmp().
- Removed deprecated png2wbmp() and jpeg2wbmp().
- Replaced gd resources with objects.
IMAP:
- (imap_sort() does not return FALSE on failure).
- (segfault on imap_reopen).
- (imap_mail_compose() segfaults on certain $bodies).
- (imap_mail_compose() may modify by-val parameters).
- (imap_mail_compose() does not validate types/encodings).
- (imap_mail_compose() may leak memory).
- (imap_mail_compose() leaks envelope on malformed bodies).
- (imap_sort() leaks sortpgm memory).
- (imap_rfc822_write_address() leaks memory).
- (imap_mail_compose() segfaults for multipart with rfc822).
- Fixed minor regression caused by fixing bug .
Iconv:
- Dropped support for iconv without proper errno setting.
Intl:
- Removed deprecated INTL_IDNA_VARIANT_2003.
JIT:
- (Wrong result if executed with JIT).
- (PHP cannot be compiled with enable JIT).
- (Crash seen when opcache.jit=1235 and opcache.jit_debug=2).
- (Fatal error when assigning to array property with JIT enabled).
- (JIT segfault in Symfony OptionsResolver).
- (Incorrect execution with JIT enabled).
JSON:
- The JSON extension is now an integral part of PHP and cannot be disabled as per RFC: https://wiki.php.net/rfc/always_enable_json (tandre)
LDAP:
- Fixed memory leaks.
- Removed deprecated ldap_sort.
MBString:
- (mb_regex_set_options() return current options).
- Removed the unused $is_hex parameter from mb_decode_numericentity().
MySQLi:
- (SSL settings aren't respected when persistent connections are used).
Mysqlnd:
- (mysqlnd exposes 160 lines of stats in phpinfo).
OCI8:
- Deprecated old OCI8 function aliases.
- Modernized oci_register_taf_callback() callable argument parsing implementation.
- Removed obsolete no-op function oci_internal_debug().
ODBC:
- (odbc_connect() may reuse persistent connection).
- (Fetching may rely on uninitialized data).
Opcache:
- (Opcache does not replay compile-time warnings).
- (Incorrectly computed opcache checksum on files with non-ascii characters).
- (ini_get() and opcache_get_configuration() inconsistency).
- (Optimizer segfault with isset on static property with undef dynamic class name).
- (PHP8 RC1 - JIT Buffer not working).
- (Complex expression in while / if statements resolves to false incorrectly).
- (Opcache bug (bad condition result) in 8.0.0rc1).
- Fixed run-time binding of preloaded dynamically declared function.
OpenSSL:
- Added Cryptographic Message Syntax (CMS) support.
PCRE:
- Don't ignore invalid escape sequences.
- Updated to PCRE2 10.35.
PDO:
- Changed default PDO error mode to exceptions.
- (Disable cloning of PDO handle/connection objects).
PDO_Firebird:
- (Firebird PDO preprocessing sql).
PDO_OCI:
- Added support for setting and getting the oracle OCI 18c call timeout.
PDO_PGSQL:
- Bumped required libpq version to 9.1.
PGSQL:
- Bumped required libpq version to 9.1.
Phpdbg:
- (phpdbg support for display_errors=stderr).
- (too many open files).
- (phpdbg segfaults on listing some conditional breakpoints).
- (phpdbg build fails when readline is shared).
Reflection:
- (ReflectionClass::getMethods() returns methods out of scope).
- (Reflection does not honor trait conflict resolution / method aliasing).
- (Nested traits' aliased methods are lowercased).
- (ReflectionClassConstant::$class returns wrong class when extending).
- (ReflectionClass::implementsInterface - inaccurate error message with traits).
- (ReflectionMethod::getReturnType() does not handle static as part of union type).
- (ReflectionFunction->invokeArgs confused in arguments).
- (getAttributes segfault on dynamic properties).
- (Add $filter parameter for ReflectionClass::getConstants and ReflectionClass::getReflectionConstants) (carusogabriel)
- Implement ReflectionProperty::hasDefaultValue and Reflection::getDefaultValue (beberlei)
SNMP:
- (disable md5 code when it is not supported in net-snmp).
SPL:
- (spl_autoload_register fails with multiple callables using self, same method).
- (Circular references in SPL iterators are not garbage collected).
- (Second call of spl_autoload_register() does nothing if it has no arguments).
- (Memory leak in SplFileInfo because of missing zend_restore_error_handling()).
- SplFixedArray is now IteratorAggregate rather than Iterator.
SQLite3:
- Added SQLite3::setAuthorizer() and respective class constants.
Session:
- (session_decode() silently fails on wrong input).
- (session_gc return value for user defined session handlers).
Shmop:
- Converted shmop resources to objects.
SimpleXML:
- (Root elements are not properly cloned).
- (Don't set content of elements with only whitespaces).
Sodium:
- (sign_detached() strings not terminated).
Standard:
- Don't force rebuild of symbol table, when populating $http_response_header variable by the HTTP stream wrapper.
- (mixed LF and CRLF line endings in mail()).
- (lstat_stat_variation7.phpt fails on certain file systems).
- (str_replace should warn when misused with nested arrays).
- (stream_get_line skips data if used with data-generating filter).
- (getimagesize(): Read error! should mention file path).
- (parse_url() does not include 'query' when question mark is the last char).
- (Sorting with array_unique gives unwanted result).
- (file_get_contents strip first line with chunked encoding redirect).
- (parse_url silently drops port number 0).
- (Double free when ASSERT_CALLBACK is used with a dynamic message).
- (__PHP_Incomplete_Class should be final).
- Made quoting of cmd execution functions consistent.
Tidy:
- Removed the unused $use_include_path parameter from tidy_repair_string().
Tokenizer:
- (PhpToken::getAll() confusing name).
XML:
- (xml_parser_free() should never leak memory).
XMLWriter:
- Changed functions to accept/return XMLWriter objects instead of resources.
- (xmlwriter_write_attribute_ns: $prefix should be nullable).
- Removed return types from XMLWriter stubs.
Zip:
- Add "flags" options to ZipArchive::addGlob and addPattern methods keeping previous behavior having FL_OVERWRITE by default.
- Add ZipArchive::EM_UNKNOWN and ZipArchive::EM_TRAD_PKWARE constants.
- Add ZipArchive::isCompressionMethodSupported() and ZipArchive::isEncryptionMethodSupported() method (libzip 1.7.0).
- Add ZipArchive::replaceFile() method.
- Add ZipArchive::setCancelCallback method (since libzip 1.6.0).
- Add ZipArchive::setMtimeName and ZipArchive::setMtimeIndex methods.
- Add ZipArchive::setProgressCallback method (since libzip 1.3.0).
- Add lastId property to ZipArchive.
- Add optional "flags" parameter to ZipArchive::addEmptyDir, addFile and addFromString methods.
- (files extracted by ZipArchive class lost their original modified time).
- (remove_path strips first char of filename).
- (add compression / encryption options for ZipArchive::addGlob and ZipArchive::addPattern).
- ZipArchive::status and ZipArchive::statusSys properties and ZipArchive::getStatusString() method stay valid after the archive is closed.
Zlib:
- (fread() does not report zlib.inflate errors).
- (zlib.output_compression disabled by Content-Type: image/).

Version 8.3.6

Version 8.3.4

Version 8.3.3

Version 8.3.2

Version 8.3.1

Version 8.3.0

Version 8.2.18

Version 8.2.17

Version 8.2.16

Version 8.2.15

Version 8.2.14

Version 8.2.13

Version 8.2.12

Version 8.2.11

Version 8.2.10

Version 8.2.9

Version 8.2.8

Version 8.2.7

Version 8.2.6

Version 8.2.5

Version 8.2.4

Version 8.2.3

Version 8.2.2

Version 8.2.1

Version 8.2.0

Version 8.1.28

Version 8.1.27

Version 8.1.26

Version 8.1.25

Version 8.1.24

Version 8.1.23

Version 8.1.22

Version 8.1.21

Version 8.1.20

Version 8.1.19

Version 8.1.18

Version 8.1.17

Version 8.1.16

Version 8.1.15

Version 8.1.14

Version 8.1.13

Version 8.1.12

Version 8.1.11

Version 8.1.10

Version 8.1.9

Version 8.1.8

Version 8.1.7

Version 8.1.6

Version 8.1.5

Version 8.1.4

Version 8.1.3

Version 8.1.2

Version 8.1.1

Version 8.1.0

Version 8.0.30

Version 8.0.29

Version 8.0.28

Version 8.0.27

Version 8.0.26

Version 8.0.25

Version 8.0.24

Version 8.0.23

Version 8.0.22

Version 8.0.21

Version 8.0.20

Version 8.0.19

Version 8.0.18

Version 8.0.17

Version 8.0.16

Version 8.0.15

Version 8.0.14

Version 8.0.13

Version 8.0.12

Version 8.0.11

Version 8.0.10

Version 8.0.9

Version 8.0.8

Version 8.0.7

Version 8.0.6

Version 8.0.5