CVS commit: pkgsrc/lang

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Fri Jul 31 04:55:12 UTC 2026

Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php85: distinfo

Log Message:
lang/php85: update to 8.5.9

PHP 8.5.9 (2026-07-30)

- Core:
  . Fixed bug GH-22290 (AST pretty printing does not correctly handle strings
    containing NUL). (iliaal)
  . Fixed bug GH-22206 (missing return in global register detection).
    (P3p111n0)
  . Lock unmodified readonly properties for modification after clone-with.
    (NickSdot)

- BCMath:
  . Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()).
    (CVE-2026-17544) (Recep Asan)

- Calendar:
  . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
    INT_MAX year). (arshidkv12)

- Date:
  . Update timelib to 2022.17. (Derick)
  . Fixed bug GH-19803 (Parsing a string with a single white space does create
    an error). (Derick)
  . Fixed Unix timestamps in February of the year 0 are misparsed with
    @-notation. (LukasGelbmann)
  . Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending
    Date classes). (Derick)

- DBA:
  . Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)

- DOM:
  . Fixed bug GH-22570 (Stack overflow when serializing a deeply nested
    Dom\XMLDocument). (iliaal)
  . Fixed getElementsByClassName() item() returning the wrong element on
    random access. (David Carlier)

- Exif:
  . Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size"
    warning when an IFD is not followed by a next-IFD offset). (Eyüp Can Akman)

- GD:
  . Upgrade libgd. (CVE-2026-9672) (Pierre Joye)

- Hash:
  . Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc
    alignment). (iliaal)

- ODBC:
  . Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the
    driver-reported display size). (iliaal)

- Opcache:
  . Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler
    through the wrong run_time_cache slot on megamorphic calls). (ptondereau,
    iliaal)
  . Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic calls from
    an undereferenced run_time_cache map_ptr offset). (iliaal)
  . Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache
    preloaded trait). (iliaal)

- OpenSSL:
  . Fixed timeout for supplemental read at end of a blocking stream in SSL
    stream wrapper. (ilutov)

- Intl:
  . Fixed Locale::lookup() and locale_lookup() to return NULL instead of the
    fallback locale when a language tag cannot be canonicalized. (Weilin Du)
  . Fixed memory leaks when calling Collator::__construct() or
    Spoofchecker::__construct() twice. (Weilin Du)
  . Fixed memory leak when calling IntlListFormatter::__construct() twice.
    (Weilin Du)
  . Fixed IntlChar methods leaving stale global error state after successful
    calls. (Xuyang Zhang)

- PDO_ODBC:
  . Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN
    carries no credentials). (iliaal)
  . Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the
    driver-reported display size). (iliaal)
  . Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is
    longer than the declared maxlen). (iliaal)
  . Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a
    diagnostic message length beyond the error buffer). (iliaal)

- PGSQL:
  . Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
    (CVE-2026-17543) (ilutov)

- Phar:
  . Fixed inconsistent handling of the magic ".phar" directory. Paths such as
    "/.phar" remain protected, while non-magic paths that merely start with
    ".phar" are handled consistently across file and directory creation,
    copying, ArrayAccess, stream lookup, directory iteration and extraction.
    (Weilin Du)
  . Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
    (Jakub Zelenka)

- PHPDBG:
  . Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal)
  . Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
    (jorgsowa)
  . Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to
    always fail during phpdbg's signal-safe interruption path. (jorgsowa)

- Reflection:
  . Fixed bug GH-22324 (Ignore leading namespace separator in
    ReflectionParameter::__construct()). (jorgsowa)
  . Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore
    dynamic properties shadowing a private parent property). (iliaal)
  . Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value
    with null bytes truncates output). (DanielEScherzer)
  . Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should not warn
    on NAN conversions). (Khaled Alam)
  . Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
    (DanielEScherzer)

- Session:
  . Fixed bug GH-21314 (Different session garbage collector behavior between
    PHP 8.3 and PHP 8.5). (jorgsowa)

- SPL:
  . Fix class_parents for classes with leading slash in non-autoload mode.
    (jorgsowa)
  . Ignore leading back-slash in class_parents(), class_implements(), and
    class_uses(). (jorgsowa)
  . Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object
    segfaults). (iliaal)

- Standard:
  . Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
    (Weilin Du)
  . Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator
    mutates the array being sorted). (azchin, iliaal)

- URI:
  . Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty
    opaque hosts. (kocsismate)
  . Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not
    performed). (kocsismate)
  . Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and
    non-empty userinfo). (kocsismate)

- Zip:
  . Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex()
    could crash after overwriting an entry and resetting its inherited
    unchanged comment). (Weilin Du)
  . Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores
    ZipArchive::FL_UNCHANGED for deleted entries). (Weilin Du)


To generate a diff of this commit:
cvs rdiff -u -r1.510 -r1.511 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.8 -r1.9 pkgsrc/lang/php85/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.510 pkgsrc/lang/php/phpversion.mk:1.511
--- pkgsrc/lang/php/phpversion.mk:1.510 Fri Jul 31 04:52:14 2026
+++ pkgsrc/lang/php/phpversion.mk       Fri Jul 31 04:55:12 2026
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.510 2026/07/31 04:52:14 taca Exp $
+# $NetBSD: phpversion.mk,v 1.511 2026/07/31 04:55:12 taca Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -113,7 +113,7 @@ PHP74_VERSION=      7.4.33
 PHP82_VERSION= 8.2.33
 PHP83_VERSION= 8.3.33
 PHP84_VERSION= 8.4.24
-PHP85_VERSION= 8.5.8
+PHP85_VERSION= 8.5.9
 
 _VARGROUPS+=   php
 _USER_VARS.php=        PHP_VERSION_DEFAULT

Index: pkgsrc/lang/php85/distinfo
diff -u pkgsrc/lang/php85/distinfo:1.8 pkgsrc/lang/php85/distinfo:1.9
--- pkgsrc/lang/php85/distinfo:1.8      Sat Jul  4 06:24:46 2026
+++ pkgsrc/lang/php85/distinfo  Fri Jul 31 04:55:12 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.8 2026/07/04 06:24:46 taca Exp $
+$NetBSD: distinfo,v 1.9 2026/07/31 04:55:12 taca Exp $
 
-BLAKE2s (php-8.5.8.tar.xz) = 1ab2203df6ba434faa204b676408fcb9d92a6f8fc5b2a8fa378c941ae015925c
-SHA512 (php-8.5.8.tar.xz) = 9c58a121f91a23ec78834cb89b504031ba4d5d8ecb501c3de2172a315f2dad8a1dc39234e39f7b0e70c278c880a13f1eb198858fa7f1ee028701b583dbfbde28
-Size (php-8.5.8.tar.xz) = 14410156 bytes
+BLAKE2s (php-8.5.9.tar.xz) = 3bbdda7ed7a9f574ad1129a421f76802d9c0e3a9cd56637ea3264e07751e1800
+SHA512 (php-8.5.9.tar.xz) = 2567bf804e308d27e74430757e41e3a37b70ec65bd8b10bc675c5b180ad31bd2bdcc75f64d984d23dbf6b6e580ed47120f1e77874372da352ee17db17a23dec1
+Size (php-8.5.9.tar.xz) = 14419304 bytes
 SHA1 (patch-build_Makefile.global) = 570d813a05626f633e2ce380ab6668fdc7e8f030
 SHA1 (patch-build_php.m4) = bb72e38ab391ad587962940ba85e8d4de8633dca
 SHA1 (patch-configure.ac) = 20c95915d5e4aa622d04ee923c626789c44fef11