CVS commit: [pkgsrc-2026Q2] pkgsrc/lang
"Maya Rashish" <[email protected]> Wed, 5 Aug 2026 15:33:47 +0000
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.cvs |
|---|---|
| Message-ID | <[email protected]> |
Module Name: pkgsrc
Committed By: maya
Date: Wed Aug 5 15:33:47 UTC 2026
Modified Files:
pkgsrc/lang/php [pkgsrc-2026Q2]: phpversion.mk
pkgsrc/lang/php85 [pkgsrc-2026Q2]: distinfo
Log Message:
Pullup ticket #7220 - requested by taca
lang/php85: Security fix
Revisions pulled up:
- lang/php/phpversion.mk 1.511
- lang/php85/distinfo 1.9
---
Module Name: pkgsrc
Committed By: taca
Date: Fri Jul 31 04:55:12 UTC 2026
Modified Files:
pkgsrc/lang/php: phpversion.mk
pkgsrc/lang/php85: distinfo
Log Message:
lang/php85: update to 8.5.9
PHP 8.5.9 (2026-07-30)
- Core:
. Fixed bug GH-22290 (AST pretty printing does not correctly handle s=
trings
containing NUL). (iliaal)
. Fixed bug GH-22206 (missing return in global register detection).
(P3p111n0)
. Lock unmodified readonly properties for modification after clone-wi=
th.
(NickSdot)
- BCMath:
. Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()).
(CVE-2026-17544) (Recep Asan)
- Calendar:
. Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overfl=
ow with
INT_MAX year). (arshidkv12)
- Date:
. Update timelib to 2022.17. (Derick)
. Fixed bug GH-19803 (Parsing a string with a single white space does=
create
an error). (Derick)
. Fixed Unix timestamps in February of the year 0 are misparsed with
@-notation. (LukasGelbmann)
. Fixed bug GH-11310 (__debugInfo does nothing on userland classes ex=
tending
Date classes). (Derick)
- DBA:
. Fixed OOB read on malformed length field in dba flatfile handler. (=
alhudz)
- DOM:
. Fixed bug GH-22570 (Stack overflow when serializing a deeply nested=
Dom\XMLDocument). (iliaal)
. Fixed getElementsByClassName() item() returning the wrong element o=
n
random access. (David Carlier)
- Exif:
. Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD =
size"
warning when an IFD is not followed by a next-IFD offset). (Ey=FCp =
Can Akman)
- GD:
. Upgrade libgd. (CVE-2026-9672) (Pierre Joye)
- Hash:
. Fixed bug GH-18173 (ext/hash relies on implementation-defined mallo=
c
alignment). (iliaal)
- ODBC:
. Fixed bug GH-22668 (Heap buffer over-read when a column value excee=
ds the
driver-reported display size). (iliaal)
- Opcache:
. Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handl=
er
through the wrong run_time_cache slot on megamorphic calls). (ptond=
ereau,
iliaal)
. Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic call=
s from
an undereferenced run_time_cache map_ptr offset). (iliaal)
. Fixed bug GH-21770 (Infinite recursion in property hook getter in o=
pcache
preloaded trait). (iliaal)
- OpenSSL:
. Fixed timeout for supplemental read at end of a blocking stream in =
SSL
stream wrapper. (ilutov)
- Intl:
. Fixed Locale::lookup() and locale_lookup() to return NULL instead o=
f the
fallback locale when a language tag cannot be canonicalized. (Weili=
n Du)
. Fixed memory leaks when calling Collator::__construct() or
Spoofchecker::__construct() twice. (Weilin Du)
. Fixed memory leak when calling IntlListFormatter::__construct() twi=
ce.
(Weilin Du)
. Fixed IntlChar methods leaving stale global error state after succe=
ssful
calls. (Xuyang Zhang)
- PDO_ODBC:
. Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN=
carries no credentials). (iliaal)
. Fixed bug GH-22667 (Heap buffer over-read when a column value excee=
ds the
driver-reported display size). (iliaal)
. Fixed bug GH-22666 (Heap buffer overflow when an output parameter v=
alue is
longer than the declared maxlen). (iliaal)
. Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver report=
s a
diagnostic message length beyond the error buffer). (iliaal)
- PGSQL:
. Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash break=
out).
(CVE-2026-17543) (ilutov)
- Phar:
. Fixed inconsistent handling of the magic ".phar" directory. Paths s=
uch as
"/.phar" remain protected, while non-magic paths that merely start =
with
".phar" are handled consistently across file and directory creation=
,
copying, ArrayAccess, stream lookup, directory iteration and extrac=
tion.
(Weilin Du)
. Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026=
-7260)
(Jakub Zelenka)
- PHPDBG:
. Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal)
. Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break=
.=
(jorgsowa)
. Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookup=
s to
always fail during phpdbg's signal-safe interruption path. (jorgsow=
a)
- Reflection:
. Fixed bug GH-22324 (Ignore leading namespace separator in
ReflectionParameter::__construct()). (jorgsowa)
. Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty(=
) ignore
dynamic properties shadowing a private parent property). (iliaal)
. Fixed bug GH-22658 (ReflectionConstant::__toString() with a string =
value
with null bytes truncates output). (DanielEScherzer)
. Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should =
not warn
on NAN conversions). (Khaled Alam)
. Fixed bug GH-22681 (Reflection*::__toString() truncates on null byt=
es).
(DanielEScherzer)
- Session:
. Fixed bug GH-21314 (Different session garbage collector behavior be=
tween
PHP 8.3 and PHP 8.5). (jorgsowa)
- SPL:
. Fix class_parents for classes with leading slash in non-autoload mo=
de.
(jorgsowa)
. Ignore leading back-slash in class_parents(), class_implements(), a=
nd
class_uses(). (jorgsowa)
. Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized ob=
ject
segfaults). (iliaal)
- Standard:
. Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
(Weilin Du)
. Fixed bug GH-22678 (Use-after-free in array_multisort() when the co=
mparator
mutates the array being sorted). (azchin, iliaal)
- URI:
. Fixed behavior of Uri\WhatWg\Url wither methods with regards to emp=
ty
opaque hosts. (kocsismate)
. Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths i=
s not
performed). (kocsismate)
. Fixed bug GH-22629 (WHATWG Validation error incorrect with empty ho=
st and
non-empty userinfo). (kocsismate)
- Zip:
. Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentInde=
x()
could crash after overwriting an entry and resetting its inherited
unchanged comment). (Weilin Du)
. Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores
ZipArchive::FL_UNCHANGED for deleted entries). (Weilin Du)
To generate a diff of this commit:
cvs rdiff -u -r1.502.2.7 -r1.502.2.8 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.7.2.1 -r1.7.2.2 pkgsrc/lang/php85/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(unnamed)
(text/x-diff, 1.9 KB)
Modified files: Index: pkgsrc/lang/php/phpversion.mk diff -u pkgsrc/lang/php/phpversion.mk:1.502.2.7 pkgsrc/lang/php/phpversion.mk:1.502.2.8 --- pkgsrc/lang/php/phpversion.mk:1.502.2.7 Wed Aug 5 15:29:19 2026 +++ pkgsrc/lang/php/phpversion.mk Wed Aug 5 15:33:47 2026 @@ -1,4 +1,4 @@ -# $NetBSD: phpversion.mk,v 1.502.2.7 2026/08/05 15:29:19 maya Exp $ +# $NetBSD: phpversion.mk,v 1.502.2.8 2026/08/05 15:33:47 maya Exp $ # # This file selects a PHP version, based on the user's preferences and # the installed packages. It does not add a dependency on the PHP @@ -113,7 +113,7 @@ PHP74_VERSION= 7.4.33 PHP82_VERSION= 8.2.33 PHP83_VERSION= 8.3.33 PHP84_VERSION= 8.4.24 -PHP85_VERSION= 8.5.8 +PHP85_VERSION= 8.5.9 _VARGROUPS+= php _USER_VARS.php= PHP_VERSION_DEFAULT Index: pkgsrc/lang/php85/distinfo diff -u pkgsrc/lang/php85/distinfo:1.7.2.1 pkgsrc/lang/php85/distinfo:1.7.2.2 --- pkgsrc/lang/php85/distinfo:1.7.2.1 Mon Jul 13 18:24:06 2026 +++ pkgsrc/lang/php85/distinfo Wed Aug 5 15:33:47 2026 @@ -1,8 +1,8 @@ -$NetBSD: distinfo,v 1.7.2.1 2026/07/13 18:24:06 bsiegert Exp $ +$NetBSD: distinfo,v 1.7.2.2 2026/08/05 15:33:47 maya Exp $ -BLAKE2s (php-8.5.8.tar.xz) = 1ab2203df6ba434faa204b676408fcb9d92a6f8fc5b2a8fa378c941ae015925c -SHA512 (php-8.5.8.tar.xz) = 9c58a121f91a23ec78834cb89b504031ba4d5d8ecb501c3de2172a315f2dad8a1dc39234e39f7b0e70c278c880a13f1eb198858fa7f1ee028701b583dbfbde28 -Size (php-8.5.8.tar.xz) = 14410156 bytes +BLAKE2s (php-8.5.9.tar.xz) = 3bbdda7ed7a9f574ad1129a421f76802d9c0e3a9cd56637ea3264e07751e1800 +SHA512 (php-8.5.9.tar.xz) = 2567bf804e308d27e74430757e41e3a37b70ec65bd8b10bc675c5b180ad31bd2bdcc75f64d984d23dbf6b6e580ed47120f1e77874372da352ee17db17a23dec1 +Size (php-8.5.9.tar.xz) = 14419304 bytes SHA1 (patch-build_Makefile.global) = 570d813a05626f633e2ce380ab6668fdc7e8f030 SHA1 (patch-build_php.m4) = bb72e38ab391ad587962940ba85e8d4de8633dca SHA1 (patch-configure.ac) = 20c95915d5e4aa622d04ee923c626789c44fef11