CVS commit: pkgsrc/lang

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Fri Dec 19 14:32:35 UTC 2025

Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php84: distinfo

Log Message:
lang/php84: update to 8.4.16

PHP 8.4.16 (2025-12-18)

- Core:
  . Sync all boost.context files with release 1.86.0. (mvorisek)
  . Fixed bug GH-20435 (SensitiveParameter doesn't work for named argument
    passing to variadic parameter). (ndossche)
  . Fixed bug GH-20286 (use-after-destroy during userland stream_close()).
    (ndossche, David Carlier)

- Bz2:
  . Fix assertion failures resulting in crashes with stream filter
    object parameters. (ndossche)

- Date:
  . Fix crashes when trying to instantiate uninstantiable classes via date
    static constructors. (ndossche)

- DOM:
  . Fix memory leak when edge case is hit when registering xpath callback.
    (ndossche)
  . Fixed bug GH-20395 (querySelector and querySelectorAll requires elements
    in $selectors to be lowercase). (ndossche)
  . Fix missing NUL byte check on C14NFile(). (ndossche)

- Fibers:
  . Fixed bug GH-20483 (ASAN stack overflow with fiber.stack_size INI
    small value). (David Carlier)

- FTP:
  . Fixed bug GH-20601 (ftp_connect overflow on timeout). (David Carlier)

- GD:
  . Fixed bug GH-20511 (imagegammacorrect out of range input/output values).
    (David Carlier)
  . Fixed bug GH-20602 (imagescale overflow with large height values).
    (David Carlier)

- Intl:
  . Fixed bug GH-20426 (Spoofchecker::setRestrictionLevel() error message
    suggests missing constants). (DanielEScherzer)

- LibXML:
  . Fix some deprecations on newer libxml versions regarding input
    buffer/parser handling. (ndossche)

- MbString:
  . Fixed bug GH-20491 (SLES15 compile error with mbstring oniguruma).
    (ndossche)
  . Fixed bug GH-20492 (mbstring compile warning due to non-strings).
    (ndossche)

- MySQLnd:
  . Fixed bug GH-20528 (Regression breaks mysql connexion using an IPv6 address
    enclosed in square brackets). (Remi)

- Opcache:
  . Fixed bug GH-20329 (opcache.file_cache broken with full interned string
    buffer). (Arnaud)

- PDO:
  . Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
    (Jakub Zelenka)

- Phar:
  . Fixed bug GH-20442 (Phar does not respect case-insensitiveness of
    __halt_compiler() when reading stub). (ndossche, TimWolla)
  . Fix broken return value of fflush() for phar file entries. (ndossche)
  . Fix assertion failure when fseeking a phar file out of bounds. (ndossche)

- PHPDBG:
  . Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog().
    (Girgias)

- SPL:
  . Fixed bug GH-20614 (SplFixedArray incorrectly handles references
    in deserialization). (ndossche)

- Standard:
  . Fix memory leak in array_diff() with custom type checks. (ndossche)
  . Fixed bug GH-20583 (Stack overflow in http_build_query
    via deep structures). (ndossche)
  . Fixed GHSA-www2-q4fc-65wf (Null byte termination in dns_get_record()).
    (ndossche)
  . Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()).
    (CVE-2025-14178) (ndossche)
  . Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize).
    (CVE-2025-14177) (ndossche)

- Tidy:
  . Fixed bug GH-20374 (PHP with tidy and custom-tags). (ndossche)

- XML:
  . Fixed bug GH-20439 (xml_set_default_handler() does not properly handle
    special characters in attributes when passing data to callback). (ndossche)

- Zip:
  . Fix crash in property existence test. (ndossche)
  . Don't truncate return value of zip_fread() with user sizes. (ndossche)

- Zlib:
  . Fix assertion failures resulting in crashes with stream filter
    object parameters. (ndossche)


To generate a diff of this commit:
cvs rdiff -u -r1.484 -r1.485 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.15 -r1.16 pkgsrc/lang/php84/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.484 pkgsrc/lang/php/phpversion.mk:1.485
--- pkgsrc/lang/php/phpversion.mk:1.484 Fri Dec 19 14:31:20 2025
+++ pkgsrc/lang/php/phpversion.mk       Fri Dec 19 14:32:34 2025
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.484 2025/12/19 14:31:20 taca Exp $
+# $NetBSD: phpversion.mk,v 1.485 2025/12/19 14:32:34 taca Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -113,7 +113,7 @@ PHP74_VERSION=      7.4.33
 PHP81_VERSION= 8.1.34
 PHP82_VERSION= 8.2.30
 PHP83_VERSION= 8.3.29
-PHP84_VERSION= 8.4.15
+PHP84_VERSION= 8.4.16
 
 _VARGROUPS+=   php
 _USER_VARS.php=        PHP_VERSION_DEFAULT

Index: pkgsrc/lang/php84/distinfo
diff -u pkgsrc/lang/php84/distinfo:1.15 pkgsrc/lang/php84/distinfo:1.16
--- pkgsrc/lang/php84/distinfo:1.15     Sun Nov 23 12:40:14 2025
+++ pkgsrc/lang/php84/distinfo  Fri Dec 19 14:32:34 2025
@@ -1,12 +1,11 @@
-$NetBSD: distinfo,v 1.15 2025/11/23 12:40:14 taca Exp $
+$NetBSD: distinfo,v 1.16 2025/12/19 14:32:34 taca Exp $
 
-BLAKE2s (php-8.4.15.tar.xz) = ba71c5d4ce8cd293dde6cd85e42c5c8f86ea326c963be1766b221535cd252c35
-SHA512 (php-8.4.15.tar.xz) = 0ebb2b2e4448959cb12bafba32a879b9a65e785ddc41b2e928f634f7e90df18503ef915bec62e37667c4ce29c577de325cd0e04e214267757c999d2470882705
-Size (php-8.4.15.tar.xz) = 13652564 bytes
+BLAKE2s (php-8.4.16.tar.xz) = 5f8a62542656e6d142e24b694de8f33b2b3a3e7d2a49c9e96b93188e5c083cf0
+SHA512 (php-8.4.16.tar.xz) = 1943a3622b7d373f7e45ba1467968744a86d2819643459bd6351beffa00bb5f3acb983d6cf3485795f24c959cfc667f1dd6b584e8e76fe752b1a1b0c83211c8a
+Size (php-8.4.16.tar.xz) = 13660836 bytes
 SHA1 (patch-build_Makefile.global) = da9577733497d026315b4702cb19d673053148ed
 SHA1 (patch-build_php.m4) = bb72e38ab391ad587962940ba85e8d4de8633dca
 SHA1 (patch-configure.ac) = 2bdd1d2b1def552032dba5fbeb6140922b72c880
-SHA1 (patch-ext_iconv_iconv.c) = 4700eec0f48f3510b59e4da21857c232f6d9fc5e
 SHA1 (patch-ext_phar_Makefile.frag) = 53ea5c58b0bc27d236118d5750a74b1cba43e5dd
 SHA1 (patch-ext_standard_php__fopen__wrapper.c) = 0a2c19c18f089448a8d842e99738b292ab9e5640
 SHA1 (patch-main_streams_streams.c) = d699ce7d3a300ffb39494b3f1fa5e0958f714483