Commit 416985389d0 for php.net

commit 416985389d0a5c7ad97161c911a53f0e6df7bbbe
Merge: de7b4a6abd8 f93c48725d1
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Tue Jul 28 11:41:07 2026 +0200

    Merge branch 'PHP-8.2' into PHP-8.3

    * PHP-8.2:
      Add NEWS entries
      Fix GHSA-vc5h-9ppw-p5f3: phar circular symlink crash
      Fix SQL injection in ext-pgsql via E'...' backslash breakout
      libgd patch for CVE-2026-9672

diff --cc NEWS
index 03a3f4f89f7,c19ccfdc58f..875982a3eb9
--- a/NEWS
+++ b/NEWS
@@@ -5,11 -5,18 +5,22 @@@ PH
  - Date:
    . Fixed leak on double DatePeriod::__construct() call. (ilutov)

+ - GD:
+   . Upgrade libgd. (CVE-2026-9672) (Pierre Joye)
+
+ - PGSQL:
+   . Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
+     (CVE-2026-17543) (ilutov)
+
+ - Phar:
+   . Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
+     (Jakub Zelenka)
+
 -02 Jul 2026, PHP 8.2.32
 +02 Jul 2026, PHP 8.3.32
 +
 +- Streams:
 +  . Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL
 +    and a proxy set). (CVE-2026-12184) (ndossche)

  - OpenSSL:
    . Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in