CVS commit: [pkgsrc-2026Q3] pkgsrc/lang

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Oct 21 14:51:42 UTC 2026

Modified Files:
        pkgsrc/lang/php [pkgsrc-2026Q3]: phpversion.mk
        pkgsrc/lang/php84 [pkgsrc-2026Q3]: distinfo

Log Message:
Pullup ticket #7309 - requested by taca
lang/php84: Security fix

Revisions pulled up:
- lang/php/phpversion.mk                                        1.520
- lang/php84/Makefile                                           1.16
- lang/php84/distinfo                                           1.27

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Wed Oct 21 13:58:37 UTC 2026

   Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php84: Makefile distinfo

   Log Message:
   lang/php84: update to 8.4.27

   PHP 8.4.27 (2026-10-22)

   - Core:
     . Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
       bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
       ndossche, Nicolas Grekas)
     . Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object
       comparison. (Arnaud)
     . Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
       (ndossche)
     . Fixed AVX being reported as supported when the OS has not enabled AVX
       state. (Ilia Alshanetsky)
     . Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). (ndossche)
     . Fixed bug GH-23896 (Assertion failure in zend_call_function() after a
       throwing deprecation). (lazerg)
     . Fixed use-after-free when a dl()-loaded extension declares a frameless
       function and a later request calls it. (Ilia Alshanetsky)
     . Fixed System V shared memory emulation for Windows attaching segments past
       the end of their mapping. (Ilia Alshanetsky)
     . Fixed bug GH-24050 (GC frees an object still held by a resurrected closure
       when (object) and use share an array). (David Carlier)
     . Fixed exception thrown by destructor during GC in a Fiber not being rethrown
       into the frame that triggered the GC. (Nicolas Grekas)

   - BCMath:
     . Fixed BcMath\Number results that truncate to zero keeping a negative sign
       and comparing less than zero. (Ilia Alshanetsky)

   - BZ2:
     . Fixed double close of the descriptor and use-after-free of the inner
       stream when bzopen() is given a stream resource. (Jakub Zelenka)

   - CLI:
     . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
       request activation). (matyhtf)
     . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD
       request for a static file). (jakubskopal)
     . Fixed crash in the built-in server when a client is reset before being
       accepted. (David Carlier)
     . Fixed the built-in server truncating an error page and leaking its
       unsent part after a partial socket write. (Ilia Alshanetsky)

   - DOM:
     . Fixed use-after-free when re-constructing a DOMXPath whose php:function
       registrations are freed while still reachable from the cycle collector.
       (Ilia Alshanetsky)
     . Fixed bug GH-23365 (DOMNode::insertBefore($n, $n) drops the node and
       leaves a self-referencing sibling list). (David Carlier)
     . Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and
       MathML elements. (Ilia Alshanetsky)
     . Fixed Dom\HTMLDocument giving attributes the namespace of their element
       when a fragment is parsed with an xlink, xml or xmlns context element.
       (Ilia Alshanetsky)
     . Fixed bug GH-23729 (DOMXPath::__construct() use-after-free during an
       evaluation). (David Carlier)
     . Fixed bug GH-23897 (php:function() assertion failure after a failed
       registerPHPFunctions()). (David Carlier)
     . Fixed DOMXPath and Dom\XPath losing the context node and in-scope
       namespaces of an evaluation after a php:function() callback evaluated
       another expression on the same object. (Ilia Alshanetsky)

   - FFI:
     . Fixed crashes with FFI callbacks created from __call() trampolines
       and array callables whose object is released. (Ilia Alshanetsky)

   - FTP:
     . Fixed bug GH-23619 (cryptic error on servers that don't support TLS
       session resumption on data connection). (ndossche)

   - GD:
     . Fixed undefined behavior with GD2 images with `INT_MAX`-sized chunks.
       (DanielEScherzer, cmb)
     . Fixed undefined behavior with GIFs with problematic LZW compression data.
       (DanielEScherzer, vapier)

   - Intl:
     . Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar()
       treating the offset as UTF-16 code units instead of bytes.
       (Ilia Alshanetsky)
     . Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state
       such as dateType, timeType, calendar and the message pattern.
       (Ilia Alshanetsky)
     . Fixed Collator attribute and strength methods not rejecting an
       unconstructed Collator. (Ilia Alshanetsky)
     . Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings
       when supplementary characters precede the match. (Weilin Du)
     . Fixed grapheme_strstr() and grapheme_strpos() missing canonically
       equivalent matches, and grapheme searches reporting ICU errors for empty
       haystacks. (Weilin Du)
     . Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches
       when using a negative offset. (Weilin Du)

   - Lexbor:
     . Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a
       heap buffer overflow in :lexbor-contains() parsing and buffer overflows
       in malformed decode replay. (alexandre-daubois)

   - MBString:
     . Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
       a truncated UTF-8 sequence). (Lazizbek Ergashev)
     . Fixed mbstring functions emitting surrogates in UTF-8 output and flagging
       it as valid UTF-8. (Nicolas Grekas)

   - MySQLi:
     . Fix GH-22854: Fixed failed assertion when accessing mysqli property after
       failed reconnection. (Kamil Tekiela)

   - MySQLnd:
     . Fixed field_count not resetting on OK packet. (Kamil Tekiela)
     . Fixed memory leak when closing a prepared statement after its connection
       was killed. (Kamil Tekiela)

   - Opcache:
     . Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with
       FCCs and inlining). (ndossche)
     . Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a
       loop-invariant addition). (Ilia Alshanetsky)
     . Fixed OSS-Fuzz #5674034779193344 (Read of uninitialized memory in
       is_cacheable_stream_path()). (ndossche)
     . Fix zend_analyze_calls() call_stack buffer overrun. (Mrmaxmeier)
     . Fixed bug GH-23637 (PHP-FPM worker SIGSEGV: run_time_cache map_ptr offset
       beyond CG(map_ptr_last) when a class is reached through the CE cache).
       (David Carlier)
     . Fix multiple incorrect DCE due to unsound escape analysis. (ndossche,
       arnaud-lb)
     . Fixed bug GH-24063 (OPcache optimizer folds `$cond ? -0.0 : 0.0` into a
       single `-0.0` constant). (lazerg)
     . Fixed crash when a file cache is reused with a different set of
       extensions declaring frameless functions. (Ilia Alshanetsky)
     . Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).
       (ndossche)
     . Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.
       (ndossche)

   - OpenSSL:
     . Fixed stream_socket_enable_crypto() leaving the socket non-blocking
       after a handshake timeout. (Ilia Alshanetsky)
     . Fixed feof() on a TLS stream staying false after a close_notify on Windows.
       (Jakub Zelenka)

   - PCNTL:
     . Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while
       an exception is pending. (nicolas-grekas)
     . Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler
       that throws. (nicolas-grekas)
     . Fixed pcntl_setcpuaffinity() error message advertising the cpu count as
       the inclusive upper bound. (lacatoire)
     . Fixed pcntl_setqos_class() requiring its optional $qos_class argument.
       (lacatoire)
     . Fixed bug GH-23986 (/proc/self paths resolve to the parent process after
       pcntl_fork()). (Lazizbek Ergashev)

   - PDO:
     . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
       column index. (Ilia Alshanetsky)
     . Fixed PDOStatement::bindColumn() registering a binding for a column name
       that is not in the result set. (Ilia Alshanetsky)
     . Fixed PDOStatement::execute() leaving the previous result available
       after a failed execution. (Ilia Alshanetsky)
     . Fixed a use-after-free when bindValue()/execute()/closeCursor() is called
       from a bound parameter's __toString() during execute(). (Ilia Alshanetsky)
     . Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a
       transaction still in use by another instance). (Lazizbek Ergashev)
     . Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class
       whose constructor arguments it rejects. (Ilia Alshanetsky)
     . Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting
       "array given" regardless of the value passed. (Ilia Alshanetsky)
     . Fixed PDOStatement::bindParam() and bindColumn() leaking the driver
       options value. (Ilia Alshanetsky)
     . Fixed PDOStatement not reporting its bound parameters and columns to the
       cycle collector. (Ilia Alshanetsky)
     . Fixed PDOStatement::setFetchMode() not applying changes atomically.
       (Ilia Alshanetsky)

   - PDO_DBLIB:
     . Fixed bug GH-23741 (segfault after a failed query inside a PDO
       transaction). Errors raised by beginTransaction(), commit(), rollBack()
       and lastInsertId() are now reported instead of being dropped.
       (Ilia Alshanetsky)

   - PDO_Firebird:
     . Fixed bug GH-23758 (PDO_Firebird returns null for non-null empty BLOBs).
       (Lazizbek Ergashev)

   - Readline:
     . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
       set to an empty string. (Ilia Alshanetsky)

   - Session:
     . Fixed session_start() continuing after a failed create_sid() when
       session.use_strict_mode rejects the supplied ID. (Ilia Alshanetsky)
     . Fixed exceptions from user-defined create_sid() handlers being replaced
       by return-value validation errors. (Ilia Alshanetsky)

   - SimpleXML:
     . Fixed reconstructing a SimpleXMLElement freeing a child element that
       another variable still references. (Ilia Alshanetsky)

   - SOAP:
     . Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with
       an illegal key). (David Carlier)
     . Fixed memory leak when load_wsdl_ex() failed to load. (DanielEScherzer)

   - Sockets:
     . Fixed socket_select() silently truncating sets larger than FD_SETSIZE on
       Windows. (David Carlier)

   - SPL:
     . Fixed SplFixedArray::setSize() doing nothing on subclasses whose
       constructor does not call parent::__construct(). (Marc Bennewitz)
     . Fixed memory leak when __construct(), __wakeup() or __unserialize() is
       called from an element destructor during setSize(0). (Marc Bennewitz)

   - SQLite:
     . Fixed a crash when SQLite3::close() is called from a userland callback.
       (Ilia Alshanetsky)

   - Standard:
     . Fixed sha1_file() returning a digest for incomplete data after a stream
       read failure. (Ilia Alshanetsky)
     . Fixed iptcembed() corrupting JPEG headers when called recursively from an
       output handler. (Ilia Alshanetsky)
     . Fixed proc_open() leaking descriptor zero when descriptor setup fails.
       (Ilia Alshanetsky)
     . Fixed three Windows-only proc_open() defects: an uninitialized
       PROCESS_INFORMATION, an indeterminate comspec pointer after a failed
       lookup, and an unchecked CreateFileA() failure. (Ilia Alshanetsky)
     . Fix persistent stream context lifetime during shutdown (Levi Morrison)
     . Fix wordwrap() ignoring an existing break at the end of the string
       (Nicolas Grekas)
     . Fixed convert.quoted-printable-decode decoding lowercase hex digits to
       the wrong byte. (Ilia Alshanetsky)

   - Tidy:
     . Fixed a use-after-free when a tidyNode is used after its document is
       reparsed. (Ilia Alshanetsky)

   - XSL:
     . Fixed bug GH-23730 (use-after-free when XSLTProcessor::importStylesheet()
       is called during a transformation). (David Carlier)

   - Zip:
     . Fixed ZipArchive::extractTo() ignoring files given in a non-list array.
       (David Carlier)
     . Fixed bug GH-23747 (ZipArchive::close() use-after-free from a progress or
       cancel callback). (David Carlier)


To generate a diff of this commit:
cvs rdiff -u -r1.513.2.6 -r1.513.2.7 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.25.2.1 -r1.25.2.2 pkgsrc/lang/php84/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.513.2.6 pkgsrc/lang/php/phpversion.mk:1.513.2.7
--- pkgsrc/lang/php/phpversion.mk:1.513.2.6     Wed Oct 21 14:47:58 2026
+++ pkgsrc/lang/php/phpversion.mk       Wed Oct 21 14:51:42 2026
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.513.2.6 2026/10/21 14:47:58 maya Exp $
+# $NetBSD: phpversion.mk,v 1.513.2.7 2026/10/21 14:51:42 maya Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -112,7 +112,7 @@ PHP56_VERSION=      5.6.40
 PHP74_VERSION= 7.4.33
 PHP82_VERSION= 8.2.35
 PHP83_VERSION= 8.3.36
-PHP84_VERSION= 8.4.26
+PHP84_VERSION= 8.4.27
 PHP85_VERSION= 8.5.11
 
 _VARGROUPS+=   php

Index: pkgsrc/lang/php84/distinfo
diff -u pkgsrc/lang/php84/distinfo:1.25.2.1 pkgsrc/lang/php84/distinfo:1.25.2.2
--- pkgsrc/lang/php84/distinfo:1.25.2.1 Wed Oct 21 00:51:17 2026
+++ pkgsrc/lang/php84/distinfo  Wed Oct 21 14:51:42 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.25.2.1 2026/10/21 00:51:17 maya Exp $
+$NetBSD: distinfo,v 1.25.2.2 2026/10/21 14:51:42 maya Exp $
 
-BLAKE2s (php-8.4.26.tar.xz) = 4a8051b8721192c6ff2622b43f83a90b6f45948a0cac920fad4cf447353acca7
-SHA512 (php-8.4.26.tar.xz) = 7c1909185187dc54789727861afdce567eae9e39eb34aabf0da0ec7515b2c9c73b011740f5122724c5b1306ad3ec2bf1d5d0a46b0bf932c40e685e05c8c4dda7
-Size (php-8.4.26.tar.xz) = 13791528 bytes
+BLAKE2s (php-8.4.27.tar.xz) = 654d8635ffff31c266416d735b04a4da4d7274e380767dbab8c1cc8f4bdb520f
+SHA512 (php-8.4.27.tar.xz) = 61b5bde7634e083820c383f2f5f249a1c3f685d589b68f8a02bd6032c4ab04297abcbf0f51d3465794e47f878a57f531ac3d6c084dd8f87124d3d31578e180b0
+Size (php-8.4.27.tar.xz) = 13862944 bytes
 SHA1 (patch-build_Makefile.global) = da9577733497d026315b4702cb19d673053148ed
 SHA1 (patch-build_php.m4) = bb72e38ab391ad587962940ba85e8d4de8633dca
 SHA1 (patch-configure.ac) = 2bdd1d2b1def552032dba5fbeb6140922b72c880