Commit 4e55e35ead7 for php.net

commit 4e55e35ead7d707f7e1f36da17cef1391a47e66b
Merge: aa847c0bdf0 4c955f4a2b2
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Sun Aug 9 14:13:49 2026 -0400

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      Fix SimpleXML integer offsets that cannot resolve aliasing a node

diff --cc NEWS
index 447d052e21d,e99924f024e..d7b60866a32
--- a/NEWS
+++ b/NEWS
@@@ -67,115 -57,24 +67,119 @@@ PH
    . Fixed segfault in ReflectionMethod::createFromMethodName() on an
      uninstantiable subclass. (iliaal)

 -- Session:
 -  . Fix corruption in mod_mm. (ndossche)
 -  . Fixed bug GH-23043 (broken session id code can cause zend_mm_heap
 -    corrupted). (ndossche)
 -
+ - SimpleXML:
+   . Fixed integer element offsets that cannot resolve aliasing an existing
+     element. (iliaal)
+
 +- Standard:
 +  . Added the "filter.max_filter_count" stream context option for php://filter
 +    URLs. Using more than 16 filters without configuring this option is now
 +    deprecated. (Sjoerd Langkemper)
 +  . Improved performance of array_intersect(). (mehmetcansahin)
 +  . Fixed bug GH-23006 (phpcredits() full-page HTML title says phpinfo()).
 +    (Weilin Du)
 +  . The following functions now raise a ValueError when the $filename argument
 +    contains NUL bytes: fileperms(), fileinode(), filesize(), fileowner(),
 +    filegroup(), fileatime(), filemtime(), filectime(), filetype(),
 +    is_writable(), is_readable(), is_executable(), is_file(), is_dir(),
 +    is_link(), file_exists(), lstat(), stat(). (Girgias)
 +  . Fixed bug GH-22818 (stream_filter_register() orphaned user_filter_map on
 +    shutdown re-registration). (David Carlier)
 +  . Io\Poll\Context::wait() now takes a Time\Duration object as a timeout.
 +    (timwolla)
 +
 +30 Jul 2026, PHP 8.6.0alpha3
 +
 +- Core:
 +  . Implemented partial function application RFC. (Arnaud)
 +  . Fixed bug GH-22263 (reset typed property default on every unserialize
 +    failure path). (David Carlier)
 +  . Fixed bug GH-18985 (Wrong line numbers for match with constant arms).
 +    (ilutov)
 +  . Fixed bug GH-18847 (SEGV in zend_fetch_debug_backtrace() when the memory
 +    limit is reached while the tracing JIT enters a call frame). (Arnaud,
 +    iliaal)
 +
 +- DOM:
 +  . Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD
 +    declares a default value for the attribute). (iliaal)
 +  . Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes
 +    with DOMNode::isEqualNode()). (Weilin Du)
 +
 +- Embed:
 +  . Made php-cli functionality available in embed builds. (henderkes)
 +
 +- GMP:
 +  . Added gmp_prevprime(). (Weilin Du, David Carlier)
 +  . Fixed GMP power and shift operators to reject GMP right operands outside
 +    the unsigned long range instead of silently truncating them. (Weilin Du)
 +  . Fixed GMP integer string parsing to reject strings containing NUL bytes
 +    instead of silently truncating them. (Weilin Du)
 +  . Fixed GMP error messages that referenced outdated parameter names.
 +    (Weilin Du)
 +
 +- Intl:
 +  . Fixed grammatical issues in Normalizer invalid form and IntlCalendar time
 +    zone offset error messages. (Weilin Du)
 +  . Removed the dependency on the ICU IO library. (Weilin Du)
 +
 +- ODBC:
 +  . Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the
 +    driver-reported display size). (iliaal)
 +
 +- Opcache:
 +  . Re-enable JIT for ZTS builds on Apple Silicon. (realFlowControl)
 +
 +- PDO_ODBC:
 +  . Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the
 +    driver-reported display size). (iliaal)
 +  . Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is
 +    longer than the declared maxlen). (iliaal)
 +  . Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a
 +    diagnostic message length beyond the error buffer). (iliaal)
 +
 +- Phar:
 +  . Fixed grammatical issues and outdated terminology in Phar error messages.
 +    (Weilin Du)
 +
 +- Reflection:
 +  . Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
 +    (DanielEScherzer)
 +
 +- SOAP:
 +  . Fixed header injection through the Content-Type context option, the
 +    soapaction and the cookie names and values. (David Carlier)
 +  . Fixed the SoapClient and SoapServer "classmap" option to reject arrays
 +    containing integer keys, and made SoapClient throw TypeError/ValueError
 +    for invalid "classmap" options. (Weilin Du, David Carlier)
 +
 +- MBString:
 +  . Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative
 +    offset in a non-UTF-8 encoding). (Eyüp Can Akman)
 +  . Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi()
 +    invalidates the regex cache). (Matthias Goergens)
 +
 +- PCRE:
 +  . Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is
 +    now forbidden. (Arnaud)
 +
  - Sockets:
    . Fixed socket_set_option() validation error messages for UDP_SEGMENT and
 -    SO_LINGER options. (Weilin Du)
 +    TCP_USER_TIMEOUT, and SO_LINGER options. (Weilin Du)
    . Fixed various memory related issues in ext/sockets. (David Carlier)

 -- SQLite:
 -  . Fix leak when trying to close db if blob stream is still open. (ndossche)
 +- Standard:
 +  . Fixed setlocale() to reject locale names containing NUL bytes instead of
 +    silently truncating them, and to reject arrays passed after the $locales
 +    argument or additional arguments passed after an array $locales argument.
 +    (Weilin Du)

  - Streams:
 +  . Added a new IO copy API used by php_stream_copy_to_stream_ex() that
 +    leverages platform primitives (sendfile, splice, copy_file_range,
 +    TransmitFile) for faster stream copying. (Jakub Zelenka, David Carlier)
 +  . Fixed bug GH-22841 (php_stream_copy_to_stream_ex() drops progress
 +    notifications when using the copy fast path). (David Carlier)
    . Fixed bug GH-15836 (Use-after-free when a user stream filter accesses
      $this->stream during the close flush). (iliaal)