pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: [pkgsrc-2026Q3] pkgsrc/lang
Module Name: pkgsrc
Committed By: maya
Date: Wed Oct 21 00:51:17 UTC 2026
Modified Files:
pkgsrc/lang/php [pkgsrc-2026Q3]: phpversion.mk
pkgsrc/lang/php84 [pkgsrc-2026Q3]: Makefile distinfo
Log Message:
Pullup ticket #7294 - requested by taca
lang/php84: Security fix
Revisions pulled up:
- lang/php/phpversion.mk 1.517
- lang/php84/Makefile 1.13
- lang/php84/distinfo 1.26
---
Module Name: pkgsrc
Committed By: taca
Date: Thu Sep 24 15:44:50 UTC 2026
Modified Files:
pkgsrc/lang/php: phpversion.mk
pkgsrc/lang/php84: Makefile distinfo
Log Message:
lang/php84: udpate to 8.4.26
PHP 8.4.26 (2026-09-24)
- BCMath:
. Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds
n_scale. (Ilia Alshanetsky)
- Core:
. Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection.
(Yudai Takada)
. Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or
next() call on the inner generator). (iliaal)
. Fixed bug GH-23232 (lone namespace separator asks the autoloader for an
empty class name). (spawnia)
. Fixed bug GH-23301 (Nested "yield from" yields a value twice when the
middle generator delegates again). (Lazizbek Ergashev)
- CLI:
. Fixed bug GH-23425 (sapi_cli_server_send_headers() does not check the
return value of php_cli_server_client_send_through()). (Lazizbek Ergashev)
- DOM:
. Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching
the null namespace in spec-following mode. (Ilia Alshanetsky)
. Fixed a use-after-free when cloning a DOMNameSpaceNode after
DOMDocument::xinclude(). (iliaal)
. Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children
that still have a live wrapper). (iliaal)
. Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the
value of an attribute whose child still has a live wrapper. (iliaal)
- GD:
. Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the
wrong argument in error messages. (Weilin Du)
. Fixed bug GH-23457 (imagebmp() is extremely slow when writing to a file).
(Lazizbek Ergashev)
- FPM:
. Fixed bug GH-19320 (FPM UID and GID overflow). (Pratik Bhujel)
. Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients
due to partial address comparison). (CVE-2026-91768) (Alexandre Daubois)
- Hash:
. Fixed a buffer overflow in hash_pbkdf2() with a large output length.
(Lazizbek Ergashev)
- Intl:
. Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle
returning UTF-16 offsets instead of grapheme offsets. (Ilia Alshanetsky)
. Fixed a memory leak when dumping IntlCalendar instances. (Ilia Alshanetsky)
. Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator()
results. (iliaal)
. Fixed a double-free when IntlGregorianCalendar construction fails after
the ICU constructor adopts the TimeZone. (iliaal)
. Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions
for UTF-8 strings). (ColumbusLabs)
. Fixed Locale::parseLocale() reading past a trailing '-' or '_'.
(iliaal, Xuyang Zhang)
. Fixed grapheme_str_split() treating UBRK_DONE as a byte index. (iliaal)
. Fixed a leak in Locale::getKeywords() when a keyword value cannot be
read. (iliaal)
. Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed
from compiled rules. (iliaal)
- MBString:
. Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the
replacement when a \k<name> backref has no closing delimiter.
(Ilia Alshanetsky)
- MySQLnd:
. Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire
protocol). (CVE-2025-1218) (Jakub Zelenka, Nora Dossche)
- ODBC:
. Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type()
returning uninitialized memory when SQLColAttribute fails.
(Ilia Alshanetsky)
- Opcache:
. Fixed a crash when the huge page SHM remap discarded mappings outside the
reserved address range. (Piotr Ha┅as)
. Fixed opcache.protect_memory race under ZTS. (realFlowControl)
. Fixed bug GH-23288 (Crash on restart when opcache.interned_strings_buffer
is overridden in an individual FPM pool). (David Carlier)
. Fixed a tracing JIT crash when compiling a side trace for a method of a
class that could not be stored in the inheritance cache. (GH-21710)
(Arnaud, iliaal)
- OpenSSL:
. Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after
SAN mismatch). (CVE-2026-91769) (Jakub Zelenka)
. Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
php_openssl_matches_wildcard_name() on crafted server certificate wildcard
CN). (CVE-2026-91767) (Jakub Zelenka)
- PDO:
. Fixed a leak when a persistent connection failed a liveness check
with no other live PDO handle. (iliaal)
- PDO_ODBC:
. Fixed bug GH-23444 (ODBC_ATTR_ASSUME_UTF8 corrupts Unicode data outside
Windows). (Calvin Buckley, Lazizbek Ergashev)
- PDO_PGSQL:
. Fixed PDO::CURSOR_SCROLL statements closing a cursor that does not exist.
(KentarouTakeda)
- PDO Sqlite:
. Fixed bug GH-20214 (PDO::FETCH_DEFAULT unexpected behavior with
PDOStatement::setFetchMode). (SakiTakamachi)
- Phar:
. Fixed bug GH-23418 (Use-after-free when looking up mounted directories).
(Weilin Du)
. Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).
(Weilin Du)
. Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing
TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)
- SNMP:
. Fixed bug GH-23453 (SNMP::setSecurity() frees a non-malloced address with a
context engine ID longer than 32 bytes). (Lazizbek Ergashev)
- SOAP:
. Fixed bug GH-23447 (Segfault when a class passed to SoapServer::setClass()
fails to initialize). (Lazizbek Ergashev)
. Fixed WSDL cache corruption when a soap:header defines headerfaults.
(Ilia Alshanetsky)
. Fixed stack overflow when parsing a WSDL with self-referential schema
groups or attributeGroups. (Ilia Alshanetsky)
. Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
cleanup_xml_node()). (CVE-2026-91765) (Alexandre Daubois)
. Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP
parsing). (CVE-2025-14181) (Nora Dossche, Jakub Zelenka)
- Standard:
. Fixed a segfault when a stream filter callback unsets StreamBucket::$data
before re-attaching the bucket. (iliaal)
. Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper
when following a redirect with an empty Location header). (CVE-2026-93682)
(Ilia Alshanetsky, Jordi Kroon)
. Fixed a memory leak in array_merge_recursive() when the recursive merge of
an object converted to an array fails. (David Carlier)
. Fixed read buffer compaction in php_stream_filter_flush(). (crystarm)
. Fixed bug GH-22410 (Incorrect float behavior with large numbers).
(arshidkv12)
. Fixed GH-23338 (fsockopen()/pfsockopen() ValueError reported wrong
argument number for $timeout). (lacatoire)
. Fixed bug GH-23576 (Next index for array returned from array_keys() is
wrong). (Lazizbek Ergashev)
. Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters
when line-break-chars contains NUL). (CVE-2026-92842) (geeknik)
. Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream
wrapper redirects). (CVE-2026-91766) (Alexandre Daubois, Jakub Zelenka)
- SimpleXML:
. Fixed writing to a dimension of the object returned by attributes() not
creating the attribute. (Ilia Alshanetsky)
. Fixed child elements of the element returned by
SimpleXMLElement::addChild() not being accessible by property name when
namespaces are involved. (Ilia Alshanetsky)
- Windows:
. Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before
file and stream I/O). (CVE-2026-17545) (Shivam Mathur, Jakub Zelenka)
- Zip:
. Fixed bug GH-23276 (ZipArchive subclass storing its own stream cannot be
garbage collected). (Weilin Du, ndossche)
. Fixed ZipArchive::extractTo() and ZipArchive::getFrom*() reporting success
on corrupted entries. (David Carlier)
. Fixed ZipArchive::getNameIndex() truncating the entry index to int.
(David Carlier)
. Fixed fstat() on a zip:// stream reporting success when the archive cannot
be opened. (David Carlier)
- SAPI:
. Fixed fuzzer targets failing to build in isolation. (Mrmaxmeier)
. Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo)
To generate a diff of this commit:
cvs rdiff -u -r1.513.2.2 -r1.513.2.3 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.12 -r1.12.2.1 pkgsrc/lang/php84/Makefile
cvs rdiff -u -r1.25 -r1.25.2.1 pkgsrc/lang/php84/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.513.2.2 pkgsrc/lang/php/phpversion.mk:1.513.2.3
--- pkgsrc/lang/php/phpversion.mk:1.513.2.2 Tue Oct 20 23:16:18 2026
+++ pkgsrc/lang/php/phpversion.mk Wed Oct 21 00:51:17 2026
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.513.2.2 2026/10/20 23:16:18 maya Exp $
+# $NetBSD: phpversion.mk,v 1.513.2.3 2026/10/21 00:51:17 maya Exp $
#
# This file selects a PHP version, based on the user's preferences and
# the installed packages. It does not add a dependency on the PHP
@@ -112,7 +112,7 @@ PHP56_VERSION= 5.6.40
PHP74_VERSION= 7.4.33
PHP82_VERSION= 8.2.34
PHP83_VERSION= 8.3.35
-PHP84_VERSION= 8.4.25
+PHP84_VERSION= 8.4.26
PHP85_VERSION= 8.5.10
_VARGROUPS+= php
Index: pkgsrc/lang/php84/Makefile
diff -u pkgsrc/lang/php84/Makefile:1.12 pkgsrc/lang/php84/Makefile:1.12.2.1
--- pkgsrc/lang/php84/Makefile:1.12 Wed Sep 2 19:03:13 2026
+++ pkgsrc/lang/php84/Makefile Wed Oct 21 00:51:17 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.12 2026/09/02 19:03:13 wiz Exp $
+# $NetBSD: Makefile,v 1.12.2.1 2026/10/21 00:51:17 maya Exp $
#
# We can't omit PKGNAME here to handle PKG_OPTIONS.
#
PKGNAME= ${PHP_PKG_PREFIX}-${PHP_VERSION}
-PKGREVISION= 1
CATEGORIES= lang
COMMENT= PHP Hypertext Preprocessor version 8.4
Index: pkgsrc/lang/php84/distinfo
diff -u pkgsrc/lang/php84/distinfo:1.25 pkgsrc/lang/php84/distinfo:1.25.2.1
--- pkgsrc/lang/php84/distinfo:1.25 Fri Aug 28 15:18:33 2026
+++ pkgsrc/lang/php84/distinfo Wed Oct 21 00:51:17 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.25 2026/08/28 15:18:33 taca Exp $
+$NetBSD: distinfo,v 1.25.2.1 2026/10/21 00:51:17 maya Exp $
-BLAKE2s (php-8.4.25.tar.xz) = d475e6fed922520d3f309914f34e70b3d66a7cdf84e6309e536ce476c6bbaaf0
-SHA512 (php-8.4.25.tar.xz) = 8966ccaa8e1be9cf19281a46dc967ebcaf86ddede80708dcd5015e0c381a427a1a6081aa0ab25df8774395a2d934d558fabc7d5af2cf22c39ad96dd06ad66689
-Size (php-8.4.25.tar.xz) = 13759432 bytes
+BLAKE2s (php-8.4.26.tar.xz) = 4a8051b8721192c6ff2622b43f83a90b6f45948a0cac920fad4cf447353acca7
+SHA512 (php-8.4.26.tar.xz) = 7c1909185187dc54789727861afdce567eae9e39eb34aabf0da0ec7515b2c9c73b011740f5122724c5b1306ad3ec2bf1d5d0a46b0bf932c40e685e05c8c4dda7
+Size (php-8.4.26.tar.xz) = 13791528 bytes
SHA1 (patch-build_Makefile.global) = da9577733497d026315b4702cb19d673053148ed
SHA1 (patch-build_php.m4) = bb72e38ab391ad587962940ba85e8d4de8633dca
SHA1 (patch-configure.ac) = 2bdd1d2b1def552032dba5fbeb6140922b72c880
Home |
Main Index |
Thread Index |
Old Index