Commit 030de777986 for php.net

commit 030de777986884918a25ca8f8698728069313b56
Merge: 170ca63f7bb e353b8bed45
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Tue Aug 18 14:32:44 2026 -0400

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      Fix GH-23331: UAF when an attribute child keeps a live wrapper

diff --cc NEWS
index 0890a7da982,0fba79b14e9..ea09c13c2b1
--- a/NEWS
+++ b/NEWS
@@@ -21,17 -11,10 +21,19 @@@ PH
      DOMDocument::xinclude(). (iliaal)
    . Fixed a crash in DOMXPath when a php:function callback receives a nodeset
      and a later callback returns a node from another document. (iliaal)
+   . Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children
+     that still have a live wrapper). (iliaal)

 +- PDO_PGSQL:
 +  . Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite
 +    loop when cleaning up a fetch left in a COPY, a use-after-free when a
 +    statement with emulated or disabled prepares is destroyed, a connection
 +    left busy for the next fetch, and rows delivered from a result another
 +    statement took over. (KentarouTakeda)
 +
  - Intl:
 +  . Fixed grapheme_strrev() treating UBRK_DONE as a byte index and leaving
 +    the result without a terminating NUL. (iliaal)
    . Fixed a double-free when IntlGregorianCalendar construction fails after
      the ICU constructor adopts the TimeZone. (iliaal)
    . Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions