CVS commit: [pkgsrc-2026Q3] pkgsrc/lang

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: [pkgsrc-2026Q3] pkgsrc/lang
From: "Maya Rashish" <maya%netbsd.org@localhost>
Date: Wed, 21 Oct 2026 00:58:19 +0000

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Oct 21 00:58:19 UTC 2026

Modified Files:
        pkgsrc/lang/php [pkgsrc-2026Q3]: phpversion.mk
        pkgsrc/lang/php85 [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7295 - requested by taca
lang/php85: Security fix

Revisions pulled up:
- lang/php/phpversion.mk                                        1.515
- lang/php85/Makefile                                           1.4
- lang/php85/distinfo                                           1.11

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Thu Sep 24 15:35:55 UTC 2026

   Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php85: Makefile distinfo

   Log Message:
   lang/php85: update to 8.5.11

   PHP 8.5.11 (2026-09-24)

   - BCMath:
     . Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds
       n_scale. (Ilia Alshanetsky)

   - Core:
     . Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection.
       (Yudai Takada)
     . Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or
       next() call on the inner generator). (iliaal)
     . Fixed bug GH-23232 (lone namespace separator asks the autoloader for an
       empty class name). (spawnia)
     . Fixed bug GH-23301 (Nested "yield from" yields a value twice when the
       middle generator delegates again). (Lazizbek Ergashev)

   - DOM:
     . Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching
       the null namespace in spec-following mode. (Ilia Alshanetsky)
     . Fixed stale getElementsByClassName() and other node list caches after
       className/classList writes and attribute removals. (Ilia Alshanetsky)
     . Fixed a use-after-free when cloning a DOMNameSpaceNode after
       DOMDocument::xinclude(). (iliaal)
     . Fixed a crash in DOMXPath when a php:function callback receives a nodeset
       and a later callback returns a node from another document. (iliaal)
     . Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children
       that still have a live wrapper). (iliaal)
     . Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the
       value of an attribute whose child still has a live wrapper. (iliaal)

   - GD:
     . Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the
       wrong argument in error messages. (Weilin Du)

   - FPM:
     . Fixed bug GH-19320 (FPM UID and GID overflow). (Pratik Bhujel)
     . Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients
       due to partial address comparison). (CVE-2026-91768) (Alexandre Daubois)

   - Intl:
     . Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle
       returning UTF-16 offsets instead of grapheme offsets. (Ilia Alshanetsky)
     . Fixed a memory leak when dumping IntlCalendar instances. (Ilia Alshanetsky)
     . Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator()
       results. (iliaal)
     . Fixed a double-free when IntlGregorianCalendar construction fails after
       the ICU constructor adopts the TimeZone. (iliaal)
     . Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions
       for UTF-8 strings). (ColumbusLabs)
     . Fixed Locale::parseLocale() reading past a trailing '-' or '_'.
       (iliaal, Xuyang Zhang)
     . Fixed grapheme_str_split() treating UBRK_DONE as a byte index. (iliaal)
     . Fixed a leak in Locale::getKeywords() when a keyword value cannot be
       read. (iliaal)
     . Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed
       from compiled rules. (iliaal)

   - MBString:
     . Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the
       replacement when a \k<name> backref has no closing delimiter.
       (Ilia Alshanetsky)

   - MySQLnd:
     . Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire
       protocol). (CVE-2025-1218) (Jakub Zelenka, Nora Dossche)

   - ODBC:
     . Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type()
       returning uninitialized memory when SQLColAttribute fails.
       (Ilia Alshanetsky)

   - Opcache:
     . Fixed opcache.protect_memory race under ZTS. (realFlowControl)
     . Fixed a tracing JIT crash when compiling a side trace for a method of a
       class that could not be stored in the inheritance cache. (GH-21710)
       (Arnaud, iliaal)
     . Fixed a crash when the huge page SHM remap discarded mappings outside the
       reserved address range. (Piotr Hałas)

   - OpenSSL:
     . Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after
       SAN mismatch). (CVE-2026-91769) (Jakub Zelenka)
     . Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
       php_openssl_matches_wildcard_name() on crafted server certificate wildcard
       CN). (CVE-2026-91767) (Jakub Zelenka)

   - PDO:
     . Fixed a leak when a persistent connection failed a liveness check
       with no other live PDO handle. (iliaal)

   - PDO_PGSQL:
     . Fixed PDO::CURSOR_SCROLL statements failing under lazy fetching
       (PDO::ATTR_PREFETCH => 0). (KentarouTakeda)

   - PDO Sqlite:
     . Fixed bug GH-20214 (PDO::FETCH_DEFAULT unexpected behavior with
       PDOStatement::setFetchMode). (SakiTakamachi)

   - Phar:
     . Fixed bug GH-23418 (Use-after-free when looking up mounted directories).
       (Weilin Du)
     . Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).
       (Weilin Du)
     . Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing
       TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)

   - Readline:
     . Fixed the interactive shell not waiting for the pager process to exit.
       (Weilin Du)

   - SOAP:
     . Fixed WSDL cache corruption when a soap:header defines headerfaults.
       (Ilia Alshanetsky)
     . Fixed stack overflow when parsing a WSDL with self-referential schema
       groups or attributeGroups. (Ilia Alshanetsky)
     . Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
       cleanup_xml_node()). (CVE-2026-91765) (Alexandre Daubois)
     . Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP
       parsing). (CVE-2025-14181) (Nora Dossche, Jakub Zelenka)

   - Standard:
     . Fixed a segfault when a stream filter callback unsets StreamBucket::$data
       before re-attaching the bucket. (iliaal)
     . Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper
       when following a redirect with an empty Location header). (CVE-2026-93682)
       (Ilia Alshanetsky, Jordi Kroon)
     . Fixed read buffer compaction in php_stream_filter_flush(). (crystarm)
     . Fixed bug GH-22410 (Incorrect float behavior with large numbers).
       (arshidkv12)
     . Fixed GH-23338 (fsockopen()/pfsockopen() ValueError reported wrong
       argument number for $timeout). (lacatoire)
     . Fixed bug GH-23576 (Next index for array returned from array_keys() is
       wrong). (Lazizbek Ergashev)
     . Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters
       when line-break-chars contains NUL). (CVE-2026-92842) (geeknik)
     . Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream
       wrapper redirects). (CVE-2026-91766) (Alexandre Daubois)

   - SimpleXML:
     . Fixed writing to a dimension of the object returned by attributes() not
       creating the attribute. (Ilia Alshanetsky)
     . Fixed child elements of the element returned by
       SimpleXMLElement::addChild() not being accessible by property name when
       namespaces are involved. (Ilia Alshanetsky)

   - Windows:
     . Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before
       file and stream I/O). (CVE-2026-17545) (Shivam Mathur, Jakub Zelenka)

   - Zip:
     . Fixed bug GH-17787 (ZipArchive stream stops reading early when the archive
       is freed while the stream is still open). (Eyüp Can Akman)
     . Fixed bug GH-23276 (ZipArchive subclass storing its own stream cannot be
       garbage collected). (Weilin Du, ndossche)

   - SAPI:
     . Fixed fuzzer targets failing to build in isolation. (Mrmaxmeier)
     . Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo)


To generate a diff of this commit:
cvs rdiff -u -r1.513.2.3 -r1.513.2.4 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.3 -r1.3.2.1 pkgsrc/lang/php85/Makefile
cvs rdiff -u -r1.10 -r1.10.2.1 pkgsrc/lang/php85/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.513.2.3 pkgsrc/lang/php/phpversion.mk:1.513.2.4
--- pkgsrc/lang/php/phpversion.mk:1.513.2.3     Wed Oct 21 00:51:17 2026
+++ pkgsrc/lang/php/phpversion.mk       Wed Oct 21 00:58:18 2026
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.513.2.3 2026/10/21 00:51:17 maya Exp $
+# $NetBSD: phpversion.mk,v 1.513.2.4 2026/10/21 00:58:18 maya Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -113,7 +113,7 @@ PHP74_VERSION=      7.4.33
 PHP82_VERSION= 8.2.34
 PHP83_VERSION= 8.3.35
 PHP84_VERSION= 8.4.26
-PHP85_VERSION= 8.5.10
+PHP85_VERSION= 8.5.11
 
 _VARGROUPS+=   php
 _USER_VARS.php=        PHP_VERSION_DEFAULT

Index: pkgsrc/lang/php85/Makefile
diff -u pkgsrc/lang/php85/Makefile:1.3 pkgsrc/lang/php85/Makefile:1.3.2.1
--- pkgsrc/lang/php85/Makefile:1.3      Wed Sep  2 19:03:13 2026
+++ pkgsrc/lang/php85/Makefile  Wed Oct 21 00:58:19 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.3 2026/09/02 19:03:13 wiz Exp $
+# $NetBSD: Makefile,v 1.3.2.1 2026/10/21 00:58:19 maya Exp $
 
 #
 # We can't omit PKGNAME here to handle PKG_OPTIONS.
 #
 PKGNAME=               ${PHP_PKG_PREFIX}-${PHP_VERSION}
-PKGREVISION=           1
 CATEGORIES=            lang
 
 COMMENT=               PHP Hypertext Preprocessor version 8.5

Index: pkgsrc/lang/php85/distinfo
diff -u pkgsrc/lang/php85/distinfo:1.10 pkgsrc/lang/php85/distinfo:1.10.2.1
--- pkgsrc/lang/php85/distinfo:1.10     Fri Aug 28 15:19:43 2026
+++ pkgsrc/lang/php85/distinfo  Wed Oct 21 00:58:19 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.10 2026/08/28 15:19:43 taca Exp $
+$NetBSD: distinfo,v 1.10.2.1 2026/10/21 00:58:19 maya Exp $
 
-BLAKE2s (php-8.5.10.tar.xz) = 1198067bbebfa69922390cd81d742ea5da7095f14220e89cdc6f9875693dab34
-SHA512 (php-8.5.10.tar.xz) = a8b901acd4cbb4f86d0ce0a4f04e4c1867088f9682150bc991f0151b1e768889ab1b15002228873705c8aba9499beaa1cec8e5a5abd4b502877b2c62c9992745
-Size (php-8.5.10.tar.xz) = 14455696 bytes
+BLAKE2s (php-8.5.11.tar.xz) = dc7b1a6dbc7ccecc99b31c7fbe605369009ddac23b79eacbd55b8207ef9e52d3
+SHA512 (php-8.5.11.tar.xz) = 77099e425c991d68afb143bbdc7f86124b5f797b1bf2a84659b8a9dab86b27682cbbb925744c0e586ce82a46038575b5388b15d2a15a7503aeb4369c1bf6fff5
+Size (php-8.5.11.tar.xz) = 14469364 bytes
 SHA1 (patch-build_Makefile.global) = 570d813a05626f633e2ce380ab6668fdc7e8f030
 SHA1 (patch-build_php.m4) = bb72e38ab391ad587962940ba85e8d4de8633dca
 SHA1 (patch-configure.ac) = 20c95915d5e4aa622d04ee923c626789c44fef11

Prev by Date: CVS commit: [pkgsrc-2026Q3] pkgsrc/lang
Next by Date: CVS commit: [pkgsrc-2026Q3] pkgsrc/finance/ruby-braintree
Previous by Thread: CVS commit: [pkgsrc-2026Q3] pkgsrc/lang
Next by Thread: CVS commit: [pkgsrc-2026Q3] pkgsrc/finance/ruby-braintree
Indexes:

Home | Main Index | Thread Index | Old Index