CVS commit: pkgsrc/lang

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Thu Sep 24 15:37:57 UTC 2026

Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php82: Makefile distinfo

Log Message:
lang/php82: update to 8.2.34

PHP 8.2.34 (2026-09-24)

- Filter:
  . Fixed GHSA-ch8v-r6jh-4vvr (FILTER_SANITIZE_ENCODED does not encode 0xFF).
    (Ilia Alshanetsky)

- FPM:
  . Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients
    due to partial address comparison). (CVE-2026-91768) (Alexandre Daubois)

- MySQLnd:
  . Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire
    protocol). (CVE-2025-1218) (Jakub Zelenka, Nora Dossche)

- OpenSSL:
  . Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after
    SAN mismatch). (CVE-2026-91769) (Jakub Zelenka)
  . Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
    php_openssl_matches_wildcard_name() on crafted server certificate wildcard
    CN). (CVE-2026-91767) (Jakub Zelenka)

- Phar:
  . Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing
    TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)

- SOAP:
  . Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
    cleanup_xml_node()). (CVE-2026-91765) (Alexandre Daubois)
  . Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP
    parsing). (CVE-2025-14181) (Nora Dossche, Jakub Zelenka)

- Standard:
  . Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters
    when line-break-chars contains NUL). (CVE-2026-92842) (geeknik)
  . Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream
    wrapper redirects). (CVE-2026-91766) (Alexandre Daubois, Jakub Zelenka)
  . Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper
    when following a redirect with an empty Location header). (CVE-2026-93682)
    (Ilia Alshanetsky, Jordi Kroon)

- Windows:
  . Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before
    file and stream I/O). (CVE-2026-17545) (Shivam Mathur, Jakub Zelenka)


To generate a diff of this commit:
cvs rdiff -u -r1.515 -r1.516 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.26 -r1.27 pkgsrc/lang/php82/Makefile
cvs rdiff -u -r1.38 -r1.39 pkgsrc/lang/php82/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.515 pkgsrc/lang/php/phpversion.mk:1.516
--- pkgsrc/lang/php/phpversion.mk:1.515 Thu Sep 24 15:35:55 2026
+++ pkgsrc/lang/php/phpversion.mk       Thu Sep 24 15:37:56 2026
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.515 2026/09/24 15:35:55 taca Exp $
+# $NetBSD: phpversion.mk,v 1.516 2026/09/24 15:37:56 taca Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -110,7 +110,7 @@ PHPVERSION_MK=      defined
 # Define each PHP's version.
 PHP56_VERSION= 5.6.40
 PHP74_VERSION= 7.4.33
-PHP82_VERSION= 8.2.33
+PHP82_VERSION= 8.2.34
 PHP83_VERSION= 8.3.35
 PHP84_VERSION= 8.4.25
 PHP85_VERSION= 8.5.11

Index: pkgsrc/lang/php82/Makefile
diff -u pkgsrc/lang/php82/Makefile:1.26 pkgsrc/lang/php82/Makefile:1.27
--- pkgsrc/lang/php82/Makefile:1.26     Wed Sep  2 19:03:13 2026
+++ pkgsrc/lang/php82/Makefile  Thu Sep 24 15:37:57 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.26 2026/09/02 19:03:13 wiz Exp $
+# $NetBSD: Makefile,v 1.27 2026/09/24 15:37:57 taca Exp $
 
 #
 # We can't omit PKGNAME here to handle PKG_OPTIONS.
 #
 PKGNAME=               ${PHP_PKG_PREFIX}-${PHP_VERSION}
-PKGREVISION=           1
 CATEGORIES=            lang
 
 COMMENT=               PHP Hypertext Preprocessor version 8.2

Index: pkgsrc/lang/php82/distinfo
diff -u pkgsrc/lang/php82/distinfo:1.38 pkgsrc/lang/php82/distinfo:1.39
--- pkgsrc/lang/php82/distinfo:1.38     Fri Jul 31 04:46:42 2026
+++ pkgsrc/lang/php82/distinfo  Thu Sep 24 15:37:57 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.38 2026/07/31 04:46:42 taca Exp $
+$NetBSD: distinfo,v 1.39 2026/09/24 15:37:57 taca Exp $
 
-BLAKE2s (php-8.2.33.tar.xz) = 79702ce4c202b8aa16f5803abd3e7b66127d732bb4032dc08538696e1bbe0289
-SHA512 (php-8.2.33.tar.xz) = 4d96978f1f59a61c1c49bcb5e884799805ba26d4dac9e1bdaeaf659de85e1c025df765f4cdb8b1ea957519fd62cd54c060611abc2a11f9828c53d407077992eb
-Size (php-8.2.33.tar.xz) = 12166568 bytes
+BLAKE2s (php-8.2.34.tar.xz) = 3b8bdf743b5b6fbeb75bf1c3105e028f6356e86e765bc0e3add8933e8409514b
+SHA512 (php-8.2.34.tar.xz) = 843128b656003c931584bfaeb780119500f2e67f4c6c868afb2c9c9e5abea20b75d23e917d46169b9fb1dec20798b3ee8d03c0d053e63f6e9932c7b2796d7557
+Size (php-8.2.34.tar.xz) = 12174884 bytes
 SHA1 (patch-build_Makefile.global) = 87c533087a536649b5f51108ef4f4b72c8efc5b2
 SHA1 (patch-build_php.m4) = 465d2896c8c4d88c325414caf221e1f2aec27fc3
 SHA1 (patch-configure.ac) = 97d6378ca03682aca635af45df3e7d777fd1d787