Commit 45013aad38a for php.net

commit 45013aad38a7da60b81094544c616cc81434ff5d
Merge: e353b8bed45 0dd7f31f151
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Tue Aug 18 14:42:44 2026 -0400

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix UAF when setAttributeNS() frees a wrapped attribute child

diff --cc NEWS
index 0fba79b14e9,d9f2e25bcdf..149cfc869e3
--- a/NEWS
+++ b/NEWS
@@@ -9,10 -9,10 +9,12 @@@ PH
  - DOM:
    . Fixed a use-after-free when cloning a DOMNameSpaceNode after
      DOMDocument::xinclude(). (iliaal)
 +  . Fixed a crash in DOMXPath when a php:function callback receives a nodeset
 +    and a later callback returns a node from another document. (iliaal)
    . Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children
      that still have a live wrapper). (iliaal)
+   . Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the
+     value of an attribute whose child still has a live wrapper. (iliaal)

  - Intl:
    . Fixed a double-free when IntlGregorianCalendar construction fails after