Add CVEs

Fix #81726: phar wrapper: DOS when using quine gzip file

The phar wrapper needs to uncompress the file; the uncompressed file
might be compressed, so the wrapper implementation loops. Th

Fix #81726: phar wrapper: DOS when using quine gzip file

The phar wrapper needs to uncompress the file; the uncompressed file
might be compressed, so the wrapper implementation loops. This raises
potential DOS issues regarding too deep or even infinite recursion (the
latter are called compressed file quines[1]). We avoid that by
introducing a recursion limit; we choose the somewhat arbitrary limit
`3`.

This issue has been reported by real_as3617 and gPayl0ad.

[1] <https://honno.dev/gzip-quine/>

show more ...

Fix #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning.

Switch to sanitize CFLAGS for community build

PHP-8.0 doesn't support those flags, we can switch once we drop that
build.

Fix memory leak

Fixes oss-fuzz #51622

Backport community build to PHP-8.0 branch

It doesn't make sense to keep it on azure because it will be run for the
PHP-8.0 branch on nightly anyway, as the workflow is triggered on the

Backport community build to PHP-8.0 branch

It doesn't make sense to keep it on azure because it will be run for the
PHP-8.0 branch on nightly anyway, as the workflow is triggered on the
master branch which will then invoke it for each branch.

show more ...

Remove unused azure pipelines templates

Remove symfony and laravel from PHP-8.0 community job

These branches no longer support PHP-8.0.

Migrate MSAN build to GitHub actions

Move Opcache variation job to GitHub actions

Closes GH-9606

Reorder conditions to avoid valgrind "Conditional jump or move depends on uninitialised value" warning.

Skip nightly coverage job in forks

Bump for 8.0.25

Always skip randomly failing OCI8 extauth tests

This might be caused by an issue with the Oracle Instant Client
libraries[1]; we skip the tests for the time being.

[1] <https://

Always skip randomly failing OCI8 extauth tests

This might be caused by an issue with the Oracle Instant Client
libraries[1]; we skip the tests for the time being.

[1] <https://github.com/php/php-src/pull/9524#issuecomment-1244409815>

Closes GH-9524.

show more ...

Fix GH-9421 Incorrect argument number for ValueError in NumberFormatter

Closes GH-9489

Fix GH-9308 GMP throws the wrong error when a GMP object is passed to gmp_init()

Closes GH-9490

Reset FG(user_stream_current_filename) at the end of request

Attempt to fix oss-fuzz #51047

Skip oci tests that leak under asan

Fix undefined left shift in oci

The bit is shifted into the signed bit which is undefined. Make the
integer explicitly unsigned before shifting.

Fix lsp error in eval'd code referring to incorrect class for static type

Fixes GH-9407
Closes GH-9471

Private method incorrectly marked as "overwrites" in reflection

Fix GH-9409
Closes GH-9469

Fix GH-9411: PgSQL large object resource is incorrectly closed

Co-authored-by: Christoph M. Becker <cmbecker69@gmx.de>

Closes GH-9411.

Fix type inference

Fixes oss-fuzz #50792

[ci skip] NEWS

Add tests