CVS commit: pkgsrc/lang

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Fri Dec 19 14:31:20 UTC 2025

Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php83: distinfo

Log Message:
lang/php83: update to 8.3.29

PHP 8.3.29 (2025-12-18)

- Core:
  . Sync all boost.context files with release 1.86.0. (mvorisek)
  . Fixed bug GH-20435 (SensitiveParameter doesn't work for named argument
    passing to variadic parameter). (ndossche)
  . Fixed bug GH-20286 (use-after-destroy during userland stream_close()).
    (ndossche, David Carlier)

- Bz2:
  . Fix assertion failures resulting in crashes with stream filter
    object parameters. (ndossche)

- Date:
  . Fix crashes when trying to instantiate uninstantiable classes via date
    static constructors. (ndossche)

- DOM:
  . Fix missing NUL byte check on C14NFile(). (ndossche)

- Fibers:
  . Fixed bug GH-20483 (ASAN stack overflow with fiber.stack_size INI
    small value). (David Carlier)

- FTP:
  . Fixed bug GH-20601 (ftp_connect overflow on timeout). (David Carlier)

- GD:
  . Fixed bug GH-20511 (imagegammacorrect out of range input/output values).
    (David Carlier)
  . Fixed bug GH-20602 (imagescale overflow with large height values).
    (David Carlier)

- Intl:
  . Fixed bug GH-20426 (Spoofchecker::setRestrictionLevel() error message
    suggests missing constants). (DanielEScherzer)

- LibXML:
  . Fix some deprecations on newer libxml versions regarding input
    buffer/parser handling. (ndossche)

- MbString:
  . Fixed bug GH-20491 (SLES15 compile error with mbstring oniguruma).
    (ndossche)
  . Fixed bug GH-20492 (mbstring compile warning due to non-strings).
    (ndossche)

- MySQLnd:
  . Fixed bug GH-20528 (Regression breaks mysql connexion using an IPv6 address
    enclosed in square brackets). (Remi)

- Opcache:
  . Fixed bug GH-20329 (opcache.file_cache broken with full interned string
    buffer). (Arnaud)

- PDO:
  . Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
    (Jakub Zelenka)

- Phar:
  . Fixed bug GH-20442 (Phar does not respect case-insensitiveness of
    __halt_compiler() when reading stub). (ndossche, TimWolla)
  . Fix broken return value of fflush() for phar file entries. (ndossche)
  . Fix assertion failure when fseeking a phar file out of bounds. (ndossche)

- PHPDBG:
  . Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog().
    (Girgias)

- SPL:
  . Fixed bug GH-20614 (SplFixedArray incorrectly handles references
    in deserialization). (ndossche)

- Standard:
  . Fix memory leak in array_diff() with custom type checks. (ndossche)
  . Fixed bug GH-20583 (Stack overflow in http_build_query
    via deep structures). (ndossche)
  . Fixed GHSA-www2-q4fc-65wf (Null byte termination in dns_get_record()).
    (ndossche)
  . Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()).
    (CVE-2025-14178) (ndossche)
  . Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize).
    (CVE-2025-14177) (ndossche)

- Tidy:
  . Fixed bug GH-20374 (PHP with tidy and custom-tags). (ndossche)

- XML:
  . Fixed bug GH-20439 (xml_set_default_handler() does not properly handle
    special characters in attributes when passing data to callback). (ndossche)

- Zip:
  . Fix crash in property existence test. (ndossche)
  . Don't truncate return value of zip_fread() with user sizes. (ndossche)

- Zlib:
  . Fix assertion failures resulting in crashes with stream filter
    object parameters. (ndossche)


To generate a diff of this commit:
cvs rdiff -u -r1.483 -r1.484 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.31 -r1.32 pkgsrc/lang/php83/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.483 pkgsrc/lang/php/phpversion.mk:1.484
--- pkgsrc/lang/php/phpversion.mk:1.483 Fri Dec 19 14:29:57 2025
+++ pkgsrc/lang/php/phpversion.mk       Fri Dec 19 14:31:20 2025
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.483 2025/12/19 14:29:57 taca Exp $
+# $NetBSD: phpversion.mk,v 1.484 2025/12/19 14:31:20 taca Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -112,7 +112,7 @@ PHP56_VERSION=      5.6.40
 PHP74_VERSION= 7.4.33
 PHP81_VERSION= 8.1.34
 PHP82_VERSION= 8.2.30
-PHP83_VERSION= 8.3.28
+PHP83_VERSION= 8.3.29
 PHP84_VERSION= 8.4.15
 
 _VARGROUPS+=   php

Index: pkgsrc/lang/php83/distinfo
diff -u pkgsrc/lang/php83/distinfo:1.31 pkgsrc/lang/php83/distinfo:1.32
--- pkgsrc/lang/php83/distinfo:1.31     Sun Nov 23 12:38:01 2025
+++ pkgsrc/lang/php83/distinfo  Fri Dec 19 14:31:20 2025
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.31 2025/11/23 12:38:01 taca Exp $
+$NetBSD: distinfo,v 1.32 2025/12/19 14:31:20 taca Exp $
 
-BLAKE2s (php-8.3.28.tar.xz) = 5e4bb41b3ae4835df0f7f727730186040371eccf5c453144ec78faf5995eb92c
-SHA512 (php-8.3.28.tar.xz) = 8dc88361d59710e165239e16a8c976230d3e355c73c1c44126701591fcc02cf97e223dae51349319eca09191311a15f5596a3341ed09ed7b9cb40c1e230c6fd4
-Size (php-8.3.28.tar.xz) = 12604244 bytes
+BLAKE2s (php-8.3.29.tar.xz) = 2f2d12e16526698cd37c26b013f4c81f8527f0b38adfd035814a0c779c5623aa
+SHA512 (php-8.3.29.tar.xz) = d5739ff7f13638c60cd7e62bad9aec831282eca7c9e9487c12ca72f4ed4494e46eb45555a19fc5eccb43d36253d2bada12611c691e0edc6dbb8cc9908d449733
+Size (php-8.3.29.tar.xz) = 12601944 bytes
 SHA1 (patch-TSRM_TSRM.c) = 278007810b74fa7a9cd971dac051d6a2ea0ad90d
 SHA1 (patch-TSRM_TSRM.h) = 70ebc03a611124d76d6813f619ff18b3a8fbf1e8
 SHA1 (patch-build_Makefile.global) = 25ee73157c012aa731a2979cb0546ea94aa5ee16