CVS commit: [pkgsrc-2026Q2] pkgsrc/lang

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Mon Jul 13 17:30:47 UTC 2026

Modified Files:
        pkgsrc/lang/php [pkgsrc-2026Q2]: phpversion.mk
        pkgsrc/lang/php84 [pkgsrc-2026Q2]: distinfo

Log Message:
Pullup ticket #7165 - requested by taca
lang/php84: security fix

Revisions pulled up:
- lang/php/phpversion.mk                                        1.505
- lang/php84/distinfo                                           1.23

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sat Jul  4 06:22:54 UTC 2026

   Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php84: distinfo

   Log Message:
   lang/php84: update to 8.4.23

   PHP 8.4.23 (2026-07-03)

   - Core:
     . Fixed bug GH-22280 (Incorrect compile error for goto to label preceding
       try/finally block). (Pratik Bhujel)

   - BCMath:
     . Fixed issues with oversized allocations and signed overflow in bcround()
       and BcMath\Number::round(). (edorian)

   - Date:
     . Fix incorrect recurrence check of DatePeriod::createFromISO8601String().
       (ndossche)

   - DOM:
     . Fix GH-22219 (Dom\XMLDocument::schemaValidate fails to resolve
       xs:QName with prefix from imported schema). (David Carlier)

   - Exif:
     . Read correct value for single and double tags. (ndossche)

   - GD:
     . Fixed bug GH-22121 (Double free in gdImageSetStyle() after
       overflow-triggered early return). (iliaal)
     . Fixed bug GH-19666 (imageconvolution() unexpected nan filter value).
       (David Carlier)
     . Fixed bug GH-19739 (imageellipse/imagefilledellipse overflow).
       (David Carlier)
     . Fixed bug GH-19730 (imageaffine overflow).
       (David Carlier)

   - Intl:
     . Fix incorrect argument positions for uninitialized calendar arguments in
       IntlCalendar::equals(), ::before(), ::after(), and ::isEquivalentTo(), and
       for invalid start/end arguments in transliterator_transliterate().
       (Weilin Du)
     . Fixed IntlTimeZone::getDisplayName() to synchronize object error state
       for invalid display types. (Weilin Du)
     . Fixed Spoofchecker restriction-level APIs to only be exposed with ICU 53
       and later. (Graham Campbell)

   - mysqli:
     . Fix stmt->query leak in mysqli_execute_query() validation errors.
       (David Carlier)

   - Opcache:
     . Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant
       autoloading). (Levi Morrison)

   - OpenSSL:
     . Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in
       openssl_encrypt with AES-WRAP-PAD). (David Carlier)

   - Phar:
     . Fixed a bypass of the magic ".phar" directory protection in
       Phar::addEmptyDir() for paths starting with "/.phar", while allowing
       non-magic directory names that merely share the ".phar" prefix. (Weilin Du)

   - Reflection:
     . Preserve class-name case in ReflectionClass::getProperty() error messages
       and autoloading. (jorgsowa)

   - Sqlite:
     . Fix error checks for column retrieval. (ndossche)

   - Zlib:
     . Fixed memory leak if deflate initialization fails and there is a dict.
       (ndossche)
     . Fixed memory leak in inflate_add(). (ndossche)

   - Zip:
     . Fixed error-related memory leaks. (ndossche)


To generate a diff of this commit:
cvs rdiff -u -r1.502.2.2 -r1.502.2.3 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.22 -r1.22.2.1 pkgsrc/lang/php84/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.502.2.2 pkgsrc/lang/php/phpversion.mk:1.502.2.3
--- pkgsrc/lang/php/phpversion.mk:1.502.2.2     Mon Jul 13 17:25:57 2026
+++ pkgsrc/lang/php/phpversion.mk       Mon Jul 13 17:30:47 2026
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.502.2.2 2026/07/13 17:25:57 bsiegert Exp $
+# $NetBSD: phpversion.mk,v 1.502.2.3 2026/07/13 17:30:47 bsiegert Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -112,7 +112,7 @@ PHP56_VERSION=      5.6.40
 PHP74_VERSION= 7.4.33
 PHP82_VERSION= 8.2.32
 PHP83_VERSION= 8.3.32
-PHP84_VERSION= 8.4.22
+PHP84_VERSION= 8.4.23
 PHP85_VERSION= 8.5.7
 
 _VARGROUPS+=   php

Index: pkgsrc/lang/php84/distinfo
diff -u pkgsrc/lang/php84/distinfo:1.22 pkgsrc/lang/php84/distinfo:1.22.2.1
--- pkgsrc/lang/php84/distinfo:1.22     Sat Jun  6 02:43:55 2026
+++ pkgsrc/lang/php84/distinfo  Mon Jul 13 17:30:47 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.22 2026/06/06 02:43:55 taca Exp $
+$NetBSD: distinfo,v 1.22.2.1 2026/07/13 17:30:47 bsiegert Exp $
 
-BLAKE2s (php-8.4.22.tar.xz) = 547836a8f0291a22c574d6f60c471d8ffdd4d6b508724f47d3d0656596e37195
-SHA512 (php-8.4.22.tar.xz) = 44adb8dcc422813e92530a936e432d72e4a9328a23b40f4d2e68b471386c6048886b4810ae813f1277e47822c18645d78299c0e30fac41adbf69862222393ff4
-Size (php-8.4.22.tar.xz) = 13731260 bytes
+BLAKE2s (php-8.4.23.tar.xz) = 947a32d49180ea9addb0b3a87bd6af981a2a3f6844136d55ea7fd8f594581df6
+SHA512 (php-8.4.23.tar.xz) = 96a240e15f470e6386ddf5049fecacc4e007da9883bd64752a6620a96e1cf0441068cbaa946b729dd9c441d0648645f7201a78f17f91f257f9e51119b67a2b9b
+Size (php-8.4.23.tar.xz) = 13741236 bytes
 SHA1 (patch-build_Makefile.global) = da9577733497d026315b4702cb19d673053148ed
 SHA1 (patch-build_php.m4) = bb72e38ab391ad587962940ba85e8d4de8633dca
 SHA1 (patch-configure.ac) = 2bdd1d2b1def552032dba5fbeb6140922b72c880