CVS commit: [pkgsrc-2026Q3] pkgsrc/lang

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Tue Oct 20 23:11:52 UTC 2026

Modified Files:
        pkgsrc/lang/php [pkgsrc-2026Q3]: phpversion.mk
        pkgsrc/lang/php83 [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7277 - requested by taca
lang/php83: Security fix

Revisions pulled up:
- lang/php/phpversion.mk                                        1.514
- lang/php83/Makefile                                           1.23
- lang/php83/distinfo                                           1.37

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Thu Sep 24 15:32:46 UTC 2026

   Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php83: distinfo

   Log Message:
   lang/php83: update to 8.3.35

   PHP 8.3.34 (seems to be skipped)

   PHP 8.3.35 (2026-09-24)

   - Filter:
     . Fixed GHSA-ch8v-r6jh-4vvr (FILTER_SANITIZE_ENCODED does not encode 0xFF).
       (Ilia Alshanetsky)

   - FPM:
     . Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients
       due to partial address comparison). (CVE-2026-91768) (Alexandre Daubois)

   - MySQLnd:
     . Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire
       protocol). (CVE-2025-1218) (Jakub Zelenka, Nora Dossche)

   - OpenSSL:
     . Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after
       SAN mismatch). (CVE-2026-91769) (Jakub Zelenka)
     . Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
       php_openssl_matches_wildcard_name() on crafted server certificate wildcard
       CN). (CVE-2026-91767) (Jakub Zelenka)

   - Phar:
     . Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing
       TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)

   - SOAP:
     . Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
       cleanup_xml_node()). (CVE-2026-91765) (Alexandre Daubois)
     . Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP
       parsing). (CVE-2025-14181) (Nora Dossche, Jakub Zelenka)

   - Standard:
     . Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters
       when line-break-chars contains NUL). (CVE-2026-92842) (geeknik)
     . Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream
       wrapper redirects). (CVE-2026-91766) (Alexandre Daubois, Jakub Zelenka)
     . Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper
       when following a redirect with an empty Location header). (CVE-2026-93682)
       (Ilia Alshanetsky, Jordi Kroon)

   - Windows:
     . Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before
       file and stream I/O). (CVE-2026-17545) (Shivam Mathur, Jakub Zelenka)

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Thu Sep 24 15:33:43 UTC 2026

   Modified Files:
        pkgsrc/lang/php83: Makefile

   Log Message:
   lang/php83: reset PKGREVISION


To generate a diff of this commit:
cvs rdiff -u -r1.513 -r1.513.2.1 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.22 -r1.22.2.1 pkgsrc/lang/php83/Makefile
cvs rdiff -u -r1.36 -r1.36.2.1 pkgsrc/lang/php83/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.513 pkgsrc/lang/php/phpversion.mk:1.513.2.1
--- pkgsrc/lang/php/phpversion.mk:1.513 Fri Aug 28 15:19:43 2026
+++ pkgsrc/lang/php/phpversion.mk       Tue Oct 20 23:11:52 2026
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.513 2026/08/28 15:19:43 taca Exp $
+# $NetBSD: phpversion.mk,v 1.513.2.1 2026/10/20 23:11:52 maya Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -111,7 +111,7 @@ PHPVERSION_MK=      defined
 PHP56_VERSION= 5.6.40
 PHP74_VERSION= 7.4.33
 PHP82_VERSION= 8.2.33
-PHP83_VERSION= 8.3.33
+PHP83_VERSION= 8.3.35
 PHP84_VERSION= 8.4.25
 PHP85_VERSION= 8.5.10
 

Index: pkgsrc/lang/php83/Makefile
diff -u pkgsrc/lang/php83/Makefile:1.22 pkgsrc/lang/php83/Makefile:1.22.2.1
--- pkgsrc/lang/php83/Makefile:1.22     Wed Sep  2 19:03:13 2026
+++ pkgsrc/lang/php83/Makefile  Tue Oct 20 23:11:52 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.22 2026/09/02 19:03:13 wiz Exp $
+# $NetBSD: Makefile,v 1.22.2.1 2026/10/20 23:11:52 maya Exp $
 
 #
 # We can't omit PKGNAME here to handle PKG_OPTIONS.
 #
 PKGNAME=               ${PHP_PKG_PREFIX}-${PHP_VERSION}
-PKGREVISION=           1
 CATEGORIES=            lang
 
 COMMENT=               PHP Hypertext Preprocessor version 8.3

Index: pkgsrc/lang/php83/distinfo
diff -u pkgsrc/lang/php83/distinfo:1.36 pkgsrc/lang/php83/distinfo:1.36.2.1
--- pkgsrc/lang/php83/distinfo:1.36     Fri Jul 31 04:49:00 2026
+++ pkgsrc/lang/php83/distinfo  Tue Oct 20 23:11:52 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.36 2026/07/31 04:49:00 taca Exp $
+$NetBSD: distinfo,v 1.36.2.1 2026/10/20 23:11:52 maya Exp $
 
-BLAKE2s (php-8.3.33.tar.xz) = 1b62738e5268a04665f8c76d4f59be3df8a3d8bfae78f4dcfd098331d643a103
-SHA512 (php-8.3.33.tar.xz) = e2340294b11ae47ba527018d700b6d896f73e04d06a8cdf099a60380f06b3899adaca01fe654bd9ac8e2dc5f3ff73c94ab1801a006a83558b222e448edd847dc
-Size (php-8.3.33.tar.xz) = 12613000 bytes
+BLAKE2s (php-8.3.35.tar.xz) = d6578dbb842554aca882e8d4de0cc0ae9654fbc6e0cd164f0112a6390c14768a
+SHA512 (php-8.3.35.tar.xz) = 40afcfb15a974b147e470c16809b96db0d6cd03e83cc77c71d6fd8e946cc707eb3d783c0e6452639cf644857a52ef46e0e0c25efeff464aaa15eac8aa8ecd2bf
+Size (php-8.3.35.tar.xz) = 12623068 bytes
 SHA1 (patch-TSRM_TSRM.c) = 278007810b74fa7a9cd971dac051d6a2ea0ad90d
 SHA1 (patch-TSRM_TSRM.h) = 70ebc03a611124d76d6813f619ff18b3a8fbf1e8
 SHA1 (patch-build_Makefile.global) = 25ee73157c012aa731a2979cb0546ea94aa5ee16