Commit 5210969d096 for php.net

commit 5210969d096de4f0db2717eb4b03da1802dd9302
Merge: 030de777986 45013aad38a
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Tue Aug 18 14:48:10 2026 -0400

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      Fix UAF when setAttributeNS() frees a wrapped attribute child

diff --cc NEWS
index ea09c13c2b1,149cfc869e3..91406b2905c
--- a/NEWS
+++ b/NEWS
@@@ -23,17 -13,10 +23,19 @@@ PH
      and a later callback returns a node from another document. (iliaal)
    . Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children
      that still have a live wrapper). (iliaal)
+   . Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the
+     value of an attribute whose child still has a live wrapper. (iliaal)

 +- PDO_PGSQL:
 +  . Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite
 +    loop when cleaning up a fetch left in a COPY, a use-after-free when a
 +    statement with emulated or disabled prepares is destroyed, a connection
 +    left busy for the next fetch, and rows delivered from a result another
 +    statement took over. (KentarouTakeda)
 +
  - Intl:
 +  . Fixed grapheme_strrev() treating UBRK_DONE as a byte index and leaving
 +    the result without a terminating NUL. (iliaal)
    . Fixed a double-free when IntlGregorianCalendar construction fails after
      the ICU constructor adopts the TimeZone. (iliaal)
    . Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions