Commit 1423149fb6b for php.net

commit 1423149fb6b083e935d1ab0e782bdfa8044d58cf
Merge: bf5141c5e66 3a1b95e43ae
Author: Weilin Du <weilindu@php.net>
Date:   Sat Aug 8 16:57:16 2026 +0800

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      Fix GH-23116 and GH-23117: stack overflow when normalizing a deeply nested document (#23127)

diff --cc NEWS
index c4b6eacb606,19cb73aba23..fef83b8412c
--- a/NEWS
+++ b/NEWS
@@@ -1,44 -1,47 +1,50 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? ????, PHP 8.5.10
 +?? ??? ????, PHP 8.6.0beta1

  - Core:
 -  . Fixed bug GH-22782 (Const expr FCC crashes under preloading). (Arnaud)
 +  . Changed run-tests.php to run test subprocesses without a shell where
 +    possible. (NickSdot)
 +  . Fixed GH-23083 (SEGV build_trace_args in zend_exceptions.c with
 +    -d error_include_args=On). (David Carlier)
 +
 +- Curl:
 +  . Improved cURL option validation errors to include the option name.
 +    (Sjoerd Langkemper)
 +  . Raise a value error when the callback registered with CURLOPT_READFUNCTION
 +    returns an unexpected long. (Sjoerd Langkemper)
 +  . Fix bug GH-16513 (curl: exceptions in callbacks do not abort the request).
 +    (Sjoerd Langkemper)

  - Date:
 -  . Fixed leak on double DatePeriod::__construct() call. (ilutov)
 +  . Update timelib to 2026.02. (Derick, timwolla)
 +  . Added Time\Duration. (timwolla, Derick)

+ - DOM:
+   . Fixed bug GH-23116 (Stack overflow when normalizing a deeply nested
+     DOMDocument). (Lazizbek Ergashev)
+   . Fixed bug GH-23117 (Stack overflow when normalizing a deeply nested
+     Dom\XMLDocument). (Lazizbek Ergashev)
 -  . Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD
 -    declares a default value for the attribute). (iliaal)
++
 +- GMP:
 +  . Added optional $definitely_prime output parameter to gmp_prevprime().
 +    (Weilin Du)
 +  . Added gmp_powm_sec(). (Weilin Du)

  - Intl:
 +  . Added static methods IntlDatePatternGenerator::getSkeleton() and
 +    IntlDatePatternGenerator::getBaseSkeleton(). (Weilin Du)
 +  . Fixed Collator::sort(), collator_sort(), Collator::asort(), and
 +    collator_asort() to report UTF-8/UTF-16 conversion errors through the intl
 +    error handler instead of emitting a warning and continuing with an empty
 +    string. (Weilin Du)
    . Fixed IntlListFormatter::__construct() leaving stale global error state
      after successful calls. (Weilin Du)
 -
 -- Opcache:
 -  . Fixed GH-22693 (DT_TEXTREL in JIT-generated TLS access on x86_64).
 -    (David Carlier)
 -  . Fixed bug GH-22763 (JIT fails to clear ZREG_TYPE_ONLY after setting reg).
 -    (Arnaud)
 -  . Fixed bug GH-22857 (Function JIT emits wrong code for FETCH_OBJ_FUNC_ARG on
 -    a property hook getter, losing register-held variables). (Zhao Hao)
 -  . Fixed bug GH-22916 (Preserve parent regs in zend_jit_deoptimizer_start()).
 -    (Arnaud)
 -
 -- OpenSSL:
 -  . Fix missing error check on invalid alpn protocols. (ndossche)
 -
 -- MBString:
 -  . Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative
 -    offset in a non-UTF-8 encoding). (Eyüp Can Akman)
 -  . Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi()
 -    invalidates the regex cache). (Matthias Goergens)
 -
 -- PCRE:
 -  . Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is
 -    now forbidden. (Arnaud)
 +  . Implemented GH-20255 (Add a predefined calendar constant in
 +    IntlDateFormatter for the proleptic gregorian calendar). (David Carlier)
 +  . Added SpoofChecker::areBidiConfusable(). (David Carlier)
 +  . Added SpoofChecker::getBidiSkeleton(). (Weilin Du)
 +  . Added SpoofChecker::getSkeleton(). (David Carlier)

  - PDO_ODBC:
    . Fixed bug GH-23016 (NULL values in long columns come back as garbage