CVS commit: pkgsrc/lang

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Fri May  8 02:04:25 UTC 2026

Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php83: distinfo

Log Message:
lang/php83: update to 8.3.31

PHP 8.3.31 (2026-05-07)

- Curl:
  . Add support for brotli and zstd on Windows. (Shivam Mathur)

- FPM:
  . Fixed GHSA-7qg2-v9fj-4mwv (XSS within status endpoint). (CVE-2026-6735)
    (Jakub Zelenka)

- MBString:
  . Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in
    php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
    (vi3tL0u1s)

- OpenSSL:
  . Fix compatibility issues with OpenSSL 4.0. (jordikroon, Remi)

- PDO_Firebird:
  . Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in quoted strings).
    (CVE-2025-14179) (SakiTakamachi)

- SOAP:
  . Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache
    Map). (CVE-2026-6722) (ilutov)
  . Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with
    SOAP_PERSISTENCE_SESSION). (CVE-2026-7261) (ilutov)
  . Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check).
    (CVE-2026-7262) (ilutov)

- Standard:
  . Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset).
    (CVE-2026-7568) (TimWolla)
  . Fixed GHSA-m8rr-4c36-8gq4 (Consistently pass unsigned char to ctype.h
    functions). (CVE-2026-7258) (ilutov)


To generate a diff of this commit:
cvs rdiff -u -r1.496 -r1.497 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.33 -r1.34 pkgsrc/lang/php83/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.496 pkgsrc/lang/php/phpversion.mk:1.497
--- pkgsrc/lang/php/phpversion.mk:1.496 Fri Apr 10 15:13:15 2026
+++ pkgsrc/lang/php/phpversion.mk       Fri May  8 02:04:24 2026
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.496 2026/04/10 15:13:15 taca Exp $
+# $NetBSD: phpversion.mk,v 1.497 2026/05/08 02:04:24 taca Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -111,7 +111,7 @@ PHPVERSION_MK=      defined
 PHP56_VERSION= 5.6.40
 PHP74_VERSION= 7.4.33
 PHP82_VERSION= 8.2.30
-PHP83_VERSION= 8.3.30
+PHP83_VERSION= 8.3.31
 PHP84_VERSION= 8.4.20
 PHP85_VERSION= 8.5.5
 

Index: pkgsrc/lang/php83/distinfo
diff -u pkgsrc/lang/php83/distinfo:1.33 pkgsrc/lang/php83/distinfo:1.34
--- pkgsrc/lang/php83/distinfo:1.33     Mon Jan 19 15:34:18 2026
+++ pkgsrc/lang/php83/distinfo  Fri May  8 02:04:25 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.33 2026/01/19 15:34:18 taca Exp $
+$NetBSD: distinfo,v 1.34 2026/05/08 02:04:25 taca Exp $
 
-BLAKE2s (php-8.3.30.tar.xz) = 7190c112c3db9b20e5ecb2c1e2f05d8f9e4ecf5caf17e04e00e1ab7d5dadceb4
-SHA512 (php-8.3.30.tar.xz) = 0d5ae6959d67762ab1e449b05042432cd94673d8e9407375821695e56cab125130556d553e5d98675f7d38c0195844c407f34268befc5b0cd06d1ea22dde26c7
-Size (php-8.3.30.tar.xz) = 12609216 bytes
+BLAKE2s (php-8.3.31.tar.xz) = a27fa1f416d480e82aa35c276d156a52037d56f3b1d70bb68ffa10a120773a22
+SHA512 (php-8.3.31.tar.xz) = 2341ce4061f5e654780c97145ea7bf92fa14f2d5c2ea83d38b8919ee5018c040a08c83c9b7cee97e4bba39267d412f5bf18c515f2001db1659a49449299cbeef
+Size (php-8.3.31.tar.xz) = 12603408 bytes
 SHA1 (patch-TSRM_TSRM.c) = 278007810b74fa7a9cd971dac051d6a2ea0ad90d
 SHA1 (patch-TSRM_TSRM.h) = 70ebc03a611124d76d6813f619ff18b3a8fbf1e8
 SHA1 (patch-build_Makefile.global) = 25ee73157c012aa731a2979cb0546ea94aa5ee16