CVS commit: [pkgsrc-2026Q2] pkgsrc/lang
"Maya Rashish" <[email protected]> Wed, 5 Aug 2026 15:29:19 +0000
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.cvs |
|---|---|
| Message-ID | <[email protected]> |
Module Name: pkgsrc
Committed By: maya
Date: Wed Aug 5 15:29:19 UTC 2026
Modified Files:
pkgsrc/lang/php [pkgsrc-2026Q2]: phpversion.mk
pkgsrc/lang/php84 [pkgsrc-2026Q2]: distinfo
Log Message:
Pullup ticket #7219 - requested by taca
lang/php84: Security fix
Revisions pulled up:
- lang/php/phpversion.mk 1.510
- lang/php84/distinfo 1.24
---
Module Name: pkgsrc
Committed By: taca
Date: Fri Jul 31 04:52:14 UTC 2026
Modified Files:
pkgsrc/lang/php: phpversion.mk
pkgsrc/lang/php84: distinfo
Log Message:
lang/php84: update to 8.4.24
PHP 8.4.24 (2026-07-30)
- BCMath:
. Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()).
(CVE-2026-17544) (Recep Asan)
- Calendar:
. Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overfl=
ow with
INT_MAX year). (arshidkv12)
- Date:
. Update timelib to 2022.17. (Derick)
. Fixed bug GH-19803 (Parsing a string with a single white space does=
create
an error). (Derick)
. Fixed Unix timestamps in February of the year 0 are misparsed with
@-notation. (LukasGelbmann)
. Fixed bug GH-11310 (__debugInfo does nothing on userland classes ex=
tending
Date classes). (Derick)
- DBA:
. Fixed OOB read on malformed length field in dba flatfile handler. (=
alhudz)
- DOM:
. Fixed bug GH-22570 (Stack overflow when serializing a deeply nested=
Dom\XMLDocument). (iliaal)
- Exif:
. Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD =
size"
warning when an IFD is not followed by a next-IFD offset). (Ey=FCp =
Can Akman)
- GD:
. Upgrade libgd. (CVE-2026-9672) (Pierre Joye)
- Hash:
. Fixed bug GH-18173 (ext/hash relies on implementation-defined mallo=
c
alignment). (iliaal)
- Intl:
. Fixed Locale::lookup() and locale_lookup() to return NULL instead o=
f the
fallback locale when a language tag cannot be canonicalized. (Weili=
n Du)
. Fixed memory leaks when calling Collator::__construct() or
Spoofchecker::__construct() twice. (Weilin Du)
. Fixed IntlChar methods leaving stale global error state after succe=
ssful
calls. (Xuyang Zhang)
- ODBC:
. Fixed bug GH-22668 (Heap buffer over-read when a column value excee=
ds the
driver-reported display size). (iliaal)
- OpenSSL:
. Fixed timeout for supplemental read at end of a blocking stream in =
SSL
stream wrapper. (ilutov)
- PDO_ODBC:
. Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN=
carries no credentials). (iliaal)
. Fixed bug GH-22667 (Heap buffer over-read when a column value excee=
ds the
driver-reported display size). (iliaal)
. Fixed bug GH-22666 (Heap buffer overflow when an output parameter v=
alue is
longer than the declared maxlen). (iliaal)
. Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver report=
s a
diagnostic message length beyond the error buffer). (iliaal)
- PGSQL:
. Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash break=
out).
(CVE-2026-17543) (ilutov)
- Phar:
. Fixed inconsistent handling of the magic ".phar" directory. Paths s=
uch as
"/.phar" remain protected, while non-magic paths that merely start =
with
".phar" are handled consistently across file and directory creation=
,
copying, ArrayAccess, stream lookup, directory iteration and extrac=
tion.
(Weilin Du)
. Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026=
-7260)
(Jakub Zelenka)
- PHPDBG:
. Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal)
. Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break=
.=
(jorgsowa)
. Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookup=
s to
always fail during phpdbg's signal-safe interruption path. (jorgsow=
a)
- Reflection:
. Fixed bug GH-22324 (Ignore leading namespace separator in
ReflectionParameter::__construct()). (jorgsowa)
. Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty(=
) ignore
dynamic properties shadowing a private parent property). (iliaal)
. Fixed bug GH-22658 (ReflectionConstant::__toString() with a string =
value
with null bytes truncates output). (DanielEScherzer)
. Fixed bug GH-22681 (Reflection*::__toString() truncates on null byt=
es).
(DanielEScherzer)
- Session:
. Fixed bug GH-21314 (Different session garbage collector behavior be=
tween
PHP 8.3 and PHP 8.5). (jorgsowa)
- SPL:
. Fix class_parents for classes with leading slash in non-autoload mo=
de.
(jorgsowa)
. Ignore leading back-slash in class_parents(), class_implements(), a=
nd
class_uses(). (jorgsowa)
. Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized ob=
ject
segfaults). (iliaal)
- Standard:
. Fixed bug GH-22360 (convert.base64-encode corruption on
incremental flush). (David Carlier)
. Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
(Weilin Du)
. Fixed integer overflow in getimagesize() and getimagesizefromstring=
()
when parsing an IFF chunk with a size of INT_MAX. (David Carlier, W=
eilin Du)
. Fixed bug GH-22678 (Use-after-free in array_multisort() when the co=
mparator
mutates the array being sorted). (azchin, iliaal)
- Streams:
. Fixed bug GH-22617 (persistent stream keys truncated at null bytes,=
causing
distinct abstract unix domain sockets to share a resource). (David =
Carlier)
- Zip:
. Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentInde=
x()
could crash after overwriting an entry and resetting its inherited
unchanged comment). (Weilin Du)
. Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores
ZipArchive::FL_UNCHANGED for deleted entries). (Weilin Du)
To generate a diff of this commit:
cvs rdiff -u -r1.502.2.6 -r1.502.2.7 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.22.2.1 -r1.22.2.2 pkgsrc/lang/php84/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(unnamed)
(text/x-diff, 1.9 KB)
Modified files: Index: pkgsrc/lang/php/phpversion.mk diff -u pkgsrc/lang/php/phpversion.mk:1.502.2.6 pkgsrc/lang/php/phpversion.mk:1.502.2.7 --- pkgsrc/lang/php/phpversion.mk:1.502.2.6 Wed Aug 5 15:24:23 2026 +++ pkgsrc/lang/php/phpversion.mk Wed Aug 5 15:29:19 2026 @@ -1,4 +1,4 @@ -# $NetBSD: phpversion.mk,v 1.502.2.6 2026/08/05 15:24:23 maya Exp $ +# $NetBSD: phpversion.mk,v 1.502.2.7 2026/08/05 15:29:19 maya Exp $ # # This file selects a PHP version, based on the user's preferences and # the installed packages. It does not add a dependency on the PHP @@ -112,7 +112,7 @@ PHP56_VERSION= 5.6.40 PHP74_VERSION= 7.4.33 PHP82_VERSION= 8.2.33 PHP83_VERSION= 8.3.33 -PHP84_VERSION= 8.4.23 +PHP84_VERSION= 8.4.24 PHP85_VERSION= 8.5.8 _VARGROUPS+= php Index: pkgsrc/lang/php84/distinfo diff -u pkgsrc/lang/php84/distinfo:1.22.2.1 pkgsrc/lang/php84/distinfo:1.22.2.2 --- pkgsrc/lang/php84/distinfo:1.22.2.1 Mon Jul 13 17:30:47 2026 +++ pkgsrc/lang/php84/distinfo Wed Aug 5 15:29:19 2026 @@ -1,8 +1,8 @@ -$NetBSD: distinfo,v 1.22.2.1 2026/07/13 17:30:47 bsiegert Exp $ +$NetBSD: distinfo,v 1.22.2.2 2026/08/05 15:29:19 maya Exp $ -BLAKE2s (php-8.4.23.tar.xz) = 947a32d49180ea9addb0b3a87bd6af981a2a3f6844136d55ea7fd8f594581df6 -SHA512 (php-8.4.23.tar.xz) = 96a240e15f470e6386ddf5049fecacc4e007da9883bd64752a6620a96e1cf0441068cbaa946b729dd9c441d0648645f7201a78f17f91f257f9e51119b67a2b9b -Size (php-8.4.23.tar.xz) = 13741236 bytes +BLAKE2s (php-8.4.24.tar.xz) = 4ad7e4b40a148a6bda9732d6df81958447089bae8ab232a8ae22331ce04bca52 +SHA512 (php-8.4.24.tar.xz) = 4db6ba60459148f23445c0f0f20d9ac9828b80b55033e21c0d374f2c544d695ee925825466d538a8d1befde486054d90c5eb375687000c709b03b224b8fdd022 +Size (php-8.4.24.tar.xz) = 13752320 bytes SHA1 (patch-build_Makefile.global) = da9577733497d026315b4702cb19d673053148ed SHA1 (patch-build_php.m4) = bb72e38ab391ad587962940ba85e8d4de8633dca SHA1 (patch-configure.ac) = 2bdd1d2b1def552032dba5fbeb6140922b72c880