CVS commit: pkgsrc/lang

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Fri Jul 31 04:52:14 UTC 2026

Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php84: distinfo

Log Message:
lang/php84: update to 8.4.24

PHP 8.4.24 (2026-07-30)

- BCMath:
  . Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()).
    (CVE-2026-17544) (Recep Asan)

- Calendar:
  . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
    INT_MAX year). (arshidkv12)

- Date:
  . Update timelib to 2022.17. (Derick)
  . Fixed bug GH-19803 (Parsing a string with a single white space does create
    an error). (Derick)
  . Fixed Unix timestamps in February of the year 0 are misparsed with
    @-notation. (LukasGelbmann)
  . Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending
    Date classes). (Derick)

- DBA:
  . Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)

- DOM:
  . Fixed bug GH-22570 (Stack overflow when serializing a deeply nested
    Dom\XMLDocument). (iliaal)

- Exif:
  . Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size"
    warning when an IFD is not followed by a next-IFD offset). (Eyüp Can Akman)

- GD:
  . Upgrade libgd. (CVE-2026-9672) (Pierre Joye)

- Hash:
  . Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc
    alignment). (iliaal)

- Intl:
  . Fixed Locale::lookup() and locale_lookup() to return NULL instead of the
    fallback locale when a language tag cannot be canonicalized. (Weilin Du)
  . Fixed memory leaks when calling Collator::__construct() or
    Spoofchecker::__construct() twice. (Weilin Du)
  . Fixed IntlChar methods leaving stale global error state after successful
    calls. (Xuyang Zhang)

- ODBC:
  . Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the
    driver-reported display size). (iliaal)

- OpenSSL:
  . Fixed timeout for supplemental read at end of a blocking stream in SSL
    stream wrapper. (ilutov)

- PDO_ODBC:
  . Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN
    carries no credentials). (iliaal)
  . Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the
    driver-reported display size). (iliaal)
  . Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is
    longer than the declared maxlen). (iliaal)
  . Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a
    diagnostic message length beyond the error buffer). (iliaal)

- PGSQL:
  . Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
    (CVE-2026-17543) (ilutov)

- Phar:
  . Fixed inconsistent handling of the magic ".phar" directory. Paths such as
    "/.phar" remain protected, while non-magic paths that merely start with
    ".phar" are handled consistently across file and directory creation,
    copying, ArrayAccess, stream lookup, directory iteration and extraction.
    (Weilin Du)
  . Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
    (Jakub Zelenka)

- PHPDBG:
  . Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal)
  . Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
    (jorgsowa)
  . Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to
    always fail during phpdbg's signal-safe interruption path. (jorgsowa)

- Reflection:
  . Fixed bug GH-22324 (Ignore leading namespace separator in
    ReflectionParameter::__construct()). (jorgsowa)
  . Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore
    dynamic properties shadowing a private parent property). (iliaal)
  . Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value
    with null bytes truncates output). (DanielEScherzer)
  . Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
    (DanielEScherzer)

- Session:
  . Fixed bug GH-21314 (Different session garbage collector behavior between
    PHP 8.3 and PHP 8.5). (jorgsowa)

- SPL:
  . Fix class_parents for classes with leading slash in non-autoload mode.
    (jorgsowa)
  . Ignore leading back-slash in class_parents(), class_implements(), and
    class_uses(). (jorgsowa)
  . Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object
    segfaults). (iliaal)

- Standard:
  . Fixed bug GH-22360 (convert.base64-encode corruption on
    incremental flush). (David Carlier)
  . Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
    (Weilin Du)
  . Fixed integer overflow in getimagesize() and getimagesizefromstring()
    when parsing an IFF chunk with a size of INT_MAX. (David Carlier, Weilin Du)
  . Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator
    mutates the array being sorted). (azchin, iliaal)

- Streams:
  . Fixed bug GH-22617 (persistent stream keys truncated at null bytes, causing
    distinct abstract unix domain sockets to share a resource). (David Carlier)

- Zip:
  . Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex()
    could crash after overwriting an entry and resetting its inherited
    unchanged comment). (Weilin Du)
  . Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores
    ZipArchive::FL_UNCHANGED for deleted entries). (Weilin Du)


To generate a diff of this commit:
cvs rdiff -u -r1.509 -r1.510 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.23 -r1.24 pkgsrc/lang/php84/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.509 pkgsrc/lang/php/phpversion.mk:1.510
--- pkgsrc/lang/php/phpversion.mk:1.509 Fri Jul 31 04:49:00 2026
+++ pkgsrc/lang/php/phpversion.mk       Fri Jul 31 04:52:14 2026
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.509 2026/07/31 04:49:00 taca Exp $
+# $NetBSD: phpversion.mk,v 1.510 2026/07/31 04:52:14 taca Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -112,7 +112,7 @@ PHP56_VERSION=      5.6.40
 PHP74_VERSION= 7.4.33
 PHP82_VERSION= 8.2.33
 PHP83_VERSION= 8.3.33
-PHP84_VERSION= 8.4.23
+PHP84_VERSION= 8.4.24
 PHP85_VERSION= 8.5.8
 
 _VARGROUPS+=   php

Index: pkgsrc/lang/php84/distinfo
diff -u pkgsrc/lang/php84/distinfo:1.23 pkgsrc/lang/php84/distinfo:1.24
--- pkgsrc/lang/php84/distinfo:1.23     Sat Jul  4 06:22:54 2026
+++ pkgsrc/lang/php84/distinfo  Fri Jul 31 04:52:14 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.23 2026/07/04 06:22:54 taca Exp $
+$NetBSD: distinfo,v 1.24 2026/07/31 04:52:14 taca Exp $
 
-BLAKE2s (php-8.4.23.tar.xz) = 947a32d49180ea9addb0b3a87bd6af981a2a3f6844136d55ea7fd8f594581df6
-SHA512 (php-8.4.23.tar.xz) = 96a240e15f470e6386ddf5049fecacc4e007da9883bd64752a6620a96e1cf0441068cbaa946b729dd9c441d0648645f7201a78f17f91f257f9e51119b67a2b9b
-Size (php-8.4.23.tar.xz) = 13741236 bytes
+BLAKE2s (php-8.4.24.tar.xz) = 4ad7e4b40a148a6bda9732d6df81958447089bae8ab232a8ae22331ce04bca52
+SHA512 (php-8.4.24.tar.xz) = 4db6ba60459148f23445c0f0f20d9ac9828b80b55033e21c0d374f2c544d695ee925825466d538a8d1befde486054d90c5eb375687000c709b03b224b8fdd022
+Size (php-8.4.24.tar.xz) = 13752320 bytes
 SHA1 (patch-build_Makefile.global) = da9577733497d026315b4702cb19d673053148ed
 SHA1 (patch-build_php.m4) = bb72e38ab391ad587962940ba85e8d4de8633dca
 SHA1 (patch-configure.ac) = 2bdd1d2b1def552032dba5fbeb6140922b72c880