Commit 5f65ab1428c for php

commit 5f65ab1428c2f262b8404f52fff3b970b743f6d1
Merge: 9cf88a77ace d886c777f18
Author: Weilin Du <weilindu@php.net>
Date:   Fri Nov 13 02:52:26 2026 +0800

    Merge branch 'PHP-8.6'

    * PHP-8.6:
      Fix uploaded files leak in request_parse_body() (#25387)

diff --cc NEWS
index a0bce4ed6f4,bc922e61a30..4938b79b071
--- a/NEWS
+++ b/NEWS
@@@ -158,20 -862,8 +158,22 @@@ PH
  - SQLite:
    . Fixed a crash when SQLite3::close() is called from a userland callback.
      (Ilia Alshanetsky)
 +  . Fixed bug GH-22051 (Inconsistent error reporting in SQLite3Result::reset()
 +    and SQLite3Result::finalize()). (Ilia Alshanetsky)
 +
 +- Streams:
 +  . Applied the so_linger, so_rcvbuf and so_sndbuf context options to unix
 +    sockets. (David Carlier)
 +  . Fixed a use-after-free when a user stream wrapper unregisters itself from
 +    its constructor, destructor or __set() during unlink(), rename(), mkdir(),
 +    rmdir(), touch(), chmod() or stat(). (Ilia Alshanetsky)

  - Standard:
++  . Fixed bug GH-25387 (Uploaded files leak in request_parse_body()).
++    (Kévin Dunglas)
 +  . Fixed quoted_printable_decode() truncating input at NUL bytes. (Weilin Du)
 +  . Fixed version_compare() silently truncating version strings at NUL bytes by
 +    rejecting such input. (Weilin Du)
    . Fixed bug #60110 (fclose(), file_put_contents(), copy() do not return false
      properly). (Jakub Zelenka, Ilija Tovilo)
    . Fixed three Windows-only proc_open() defects: an uninitialized