Commit 1c7f50ae42f for php.net

commit 1c7f50ae42f1cb7388d2c6a7c00f2b7636373dae
Merge: b56a0e0dfe0 ed1a6d4fdde
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Mon Jul 20 13:09:49 2026 -0400

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      Fix GH-22825: DOM attribute methods on a DTD default attribute

diff --cc NEWS
index 7dd8530af90,1f2b9540bfa..7a00f15c2ba
--- a/NEWS
+++ b/NEWS
@@@ -1,38 -1,17 +1,42 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? ????, PHP 8.5.10
 +?? ??? ????, PHP 8.6.0alpha3

 -- Date:
 -  . Fixed leak on double DatePeriod::__construct() call. (ilutov)
 +- Core:
 +  . Implemented partial function application RFC. (Arnaud)

+ - DOM:
+   . Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD
+     declares a default value for the attribute). (iliaal)
+
 +- GMP:
 +  . Fixed GMP power and shift operators to reject GMP right operands outside
 +    the unsigned long range instead of silently truncating them. (Weilin Du)
 +  . Fixed GMP integer string parsing to reject strings containing NUL bytes
 +    instead of silently truncating them. (Weilin Du)
 +
 +- Intl:
 +  . Fixed grammatical issues in Normalizer invalid form and IntlCalendar time
 +    zone offset error messages. (Weilin Du)
 +
 +- ODBC:
 +  . Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the
 +    driver-reported display size). (iliaal)
 +
  - Opcache:
 -  . Fixed GH-22693 (DT_TEXTREL in JIT-generated TLS access on x86_64).
 -    (David Carlier)
 +  . Re-enable JIT for ZTS builds on Apple Silicon. (realFlowControl)
 +
 +- PDO_ODBC:
 +  . Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the
 +    driver-reported display size). (iliaal)
 +  . Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is
 +    longer than the declared maxlen). (iliaal)
 +  . Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a
 +    diagnostic message length beyond the error buffer). (iliaal)
 +
 +- Reflection:
 +  . Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
 +    (DanielEScherzer)

  - Sockets:
    . Fixed socket_set_option() validation error messages for UDP_SEGMENT and
diff --cc ext/dom/element.c
index 8e6102e9658,a1301e10629..71fa39b59b5
--- a/ext/dom/element.c
+++ b/ext/dom/element.c
@@@ -464,7 -466,9 +464,9 @@@ PHP_METHOD(DOMElement, setAttribute
  					break;
  				case XML_NAMESPACE_DECL:
  					RETURN_FALSE;
+ 				case XML_ATTRIBUTE_DECL:
+ 					break;
 -				EMPTY_SWITCH_DEFAULT_CASE();
 +				default: ZEND_UNREACHABLE();
  			}
  		}

@@@ -591,7 -595,9 +593,9 @@@ static bool dom_remove_attribute(xmlNod

  			break;
  		}
+ 		case XML_ATTRIBUTE_DECL:
+ 			return false;
 -		EMPTY_SWITCH_DEFAULT_CASE();
 +		default: ZEND_UNREACHABLE();
  	}
  	return true;
  }