Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package php8 for openSUSE:Factory checked in at 2026-08-01 18:28:39 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/php8 (Old) and /work/SRC/openSUSE:Factory/.php8.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "php8" Sat Aug 1 18:28:39 2026 rev:111 rq:1368801 version:8.5.9 Changes: -------- --- /work/SRC/openSUSE:Factory/php8/php8.changes 2026-07-14 13:45:20.665590522 +0200 +++ /work/SRC/openSUSE:Factory/.php8.new.16738/php8.changes 2026-08-01 18:29:33.784247876 +0200 @@ -1,0 +2,85 @@ +Fri Jul 31 08:29:01 UTC 2026 - Petr Gajdos <[email protected]> + +- version update to 8.5.9 + Core: + Fixed bug GH-22290 (AST pretty printing does not correctly handle strings containing NUL). + Fixed bug GH-22206 (missing return in global register detection). + Lock unmodified readonly properties for modification after clone-with. + BCMath: + Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()). (CVE-2026-17544) + Calendar: + Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year). + Date: + Update timelib to 2022.17. + Fixed bug GH-19803 (Parsing a string with a single white space does create an error). + Fixed Unix timestamps in February of the year 0 are misparsed with @-notation. + Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes). + DBA: + Fixed OOB read on malformed length field in dba flatfile handler. + DOM: + Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument). + Fixed getElementsByClassName() item() returning the wrong element on random access. + Exif: + Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset). + GD: + Upgrade libgd. (CVE-2026-9672) + Hash: + Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment). + ODBC: + Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size). + Opcache: + Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through the wrong run_time_cache slot on megamorphic calls). + Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic calls from an undereferenced run_time_cache map_ptr offset). + Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache preloaded trait). + OpenSSL: + Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper. + Intl: + Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized. + Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice. + Fixed memory leak when calling IntlListFormatter::__construct() twice. + Fixed IntlChar methods leaving stale global error state after successful calls. + PDO_ODBC: + Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials). + Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size). + Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen). + Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer). + PGSQL: + Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543) + Phar: + Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction. + Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260) + PHPDBG: + Fixed bug GH-17387 (Trivial crash in phpdbg lexer). + Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break. + Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path. + Reflection: + Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()). + Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property). + Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output). + Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should not warn on NAN conversions). + Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes). + Session: + Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5). + SPL: + Fix class_parents for classes with leading slash in non-autoload mode. + Ignore leading back-slash in class_parents(), class_implements(), and class_uses(). + Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults). + Standard: + Fixed bug GH-22395 (base_convert() outputs at most 64 characters). + Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted). + URI: + Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty opaque hosts. + Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not performed). + Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and non-empty userinfo). + Zip: + Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex() could crash after overwriting an entry and resetting its inherited unchanged comment). + Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores ZipArchive::FL_UNCHANGED for deleted entries). +- modified patches + * php-build-reproducible-phar.patch (refreshed) + * php-systzdata-v24.patch (refreshed) +- fixes CVE-2026-17543 [bsc#1273075] + CVE-2026-17544 [bsc#1273076] + CVE-2026-7260 [bsc#1273077] + CVE-2026-9672 [bsc#1273078] + +------------------------------------------------------------------- Old: ---- php-8.5.8.tar.xz php-8.5.8.tar.xz.asc New: ---- php-8.5.9.tar.xz php-8.5.9.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ php8.spec ++++++ --- /var/tmp/diff_new_pack.vLLm67/_old 2026-08-01 18:29:34.896285762 +0200 +++ /var/tmp/diff_new_pack.vLLm67/_new 2026-08-01 18:29:34.900285898 +0200 @@ -57,7 +57,7 @@ %bcond_without sodium Name: %{pprefix}%{php_name}%{psuffix} -Version: 8.5.8 +Version: 8.5.9 Release: 0 Summary: Interpreter for the PHP scripting language version 8 License: MIT AND PHP-3.01 ++++++ php-8.5.8.tar.xz -> php-8.5.9.tar.xz ++++++ /work/SRC/openSUSE:Factory/php8/php-8.5.8.tar.xz /work/SRC/openSUSE:Factory/.php8.new.16738/php-8.5.9.tar.xz differ: char 13, line 1 ++++++ php-build-reproducible-phar.patch ++++++ --- /var/tmp/diff_new_pack.vLLm67/_old 2026-08-01 18:29:35.032290395 +0200 +++ /var/tmp/diff_new_pack.vLLm67/_new 2026-08-01 18:29:35.036290531 +0200 @@ -16,10 +16,10 @@ ext/phar/zip.c | 2 +- 6 files changed, 18 insertions(+), 5 deletions(-) -Index: php-8.5.2/ext/phar/phar.c +Index: php-8.5.9/ext/phar/phar.c =================================================================== ---- php-8.5.2.orig/ext/phar/phar.c -+++ php-8.5.2/ext/phar/phar.c +--- php-8.5.9.orig/ext/phar/phar.c ++++ php-8.5.9/ext/phar/phar.c @@ -2950,7 +2950,7 @@ int phar_flush_ex(phar_archive_data *pha 4: metadata-len +: metadata @@ -29,10 +29,10 @@ phar_set_32(entry_buffer, entry->uncompressed_filesize); phar_set_32(entry_buffer+4, mytime); phar_set_32(entry_buffer+8, entry->compressed_filesize); -Index: php-8.5.2/ext/phar/phar_internal.h +Index: php-8.5.9/ext/phar/phar_internal.h =================================================================== ---- php-8.5.2.orig/ext/phar/phar_internal.h -+++ php-8.5.2/ext/phar/phar_internal.h +--- php-8.5.9.orig/ext/phar/phar_internal.h ++++ php-8.5.9/ext/phar/phar_internal.h @@ -315,6 +315,21 @@ static inline php_stream *phar_get_pharf return PHAR_G(cached_fp)[phar->phar_pos].fp; } @@ -55,10 +55,10 @@ static inline enum phar_fp_type phar_get_fp_type(const phar_entry_info *entry) { if (!entry->is_persistent) { -Index: php-8.5.2/ext/phar/stream.c +Index: php-8.5.9/ext/phar/stream.c =================================================================== ---- php-8.5.2.orig/ext/phar/stream.c -+++ php-8.5.2/ext/phar/stream.c +--- php-8.5.9.orig/ext/phar/stream.c ++++ php-8.5.9/ext/phar/stream.c @@ -469,7 +469,7 @@ static int phar_stream_flush(php_stream phar_entry_data *data = (phar_entry_data *) stream->abstract; @@ -68,10 +68,10 @@ ret = phar_flush(data->phar, &error); if (error) { php_stream_wrapper_log_error(stream->wrapper, REPORT_ERRORS, "%s", error); -Index: php-8.5.2/ext/phar/tar.c +Index: php-8.5.9/ext/phar/tar.c =================================================================== ---- php-8.5.2.orig/ext/phar/tar.c -+++ php-8.5.2/ext/phar/tar.c +--- php-8.5.9.orig/ext/phar/tar.c ++++ php-8.5.9/ext/phar/tar.c @@ -977,7 +977,7 @@ int phar_tar_flush(phar_archive_data *ph char *buf, *signature, sigbuf[8]; @@ -81,11 +81,11 @@ entry.is_modified = 1; entry.is_crc_checked = 1; entry.is_tar = 1; -Index: php-8.5.2/ext/phar/util.c +Index: php-8.5.9/ext/phar/util.c =================================================================== ---- php-8.5.2.orig/ext/phar/util.c -+++ php-8.5.2/ext/phar/util.c -@@ -700,7 +700,7 @@ phar_entry_data *phar_get_or_create_entr +--- php-8.5.9.orig/ext/phar/util.c ++++ php-8.5.9/ext/phar/util.c +@@ -729,7 +729,7 @@ phar_entry_data *phar_get_or_create_entr phar_add_virtual_dirs(phar, path, path_len); etemp.is_modified = 1; @@ -94,11 +94,11 @@ etemp.is_crc_checked = 1; etemp.phar = phar; etemp.filename = zend_string_init(path, path_len, false); -Index: php-8.5.2/ext/phar/zip.c +Index: php-8.5.9/ext/phar/zip.c =================================================================== ---- php-8.5.2.orig/ext/phar/zip.c -+++ php-8.5.2/ext/phar/zip.c -@@ -1253,7 +1253,7 @@ int phar_zip_flush(phar_archive_data *ph +--- php-8.5.9.orig/ext/phar/zip.c ++++ php-8.5.9/ext/phar/zip.c +@@ -1275,7 +1275,7 @@ int phar_zip_flush(phar_archive_data *ph pass.error = &temperr; entry.flags = PHAR_ENT_PERM_DEF_FILE; ++++++ php-systzdata-v24.patch ++++++ --- /var/tmp/diff_new_pack.vLLm67/_old 2026-08-01 18:29:35.088292303 +0200 +++ /var/tmp/diff_new_pack.vLLm67/_new 2026-08-01 18:29:35.096292576 +0200 @@ -36,10 +36,10 @@ r1: initial revision -Index: php-8.5.0RC4/ext/date/config0.m4 +Index: php-8.5.9/ext/date/config0.m4 =================================================================== ---- php-8.5.0RC4.orig/ext/date/config0.m4 -+++ php-8.5.0RC4/ext/date/config0.m4 +--- php-8.5.9.orig/ext/date/config0.m4 ++++ php-8.5.9/ext/date/config0.m4 @@ -4,6 +4,19 @@ AC_CHECK_HEADERS([io.h]) dnl Check for strtoll, atoll AC_CHECK_FUNCS([strtoll atoll]) @@ -60,10 +60,10 @@ AX_CHECK_COMPILE_FLAG([-Wno-implicit-fallthrough], [PHP_DATE_CFLAGS="$PHP_DATE_CFLAGS -Wno-implicit-fallthrough"]) -Index: php-8.5.0RC4/ext/date/lib/parse_tz.c +Index: php-8.5.9/ext/date/lib/parse_tz.c =================================================================== ---- php-8.5.0RC4.orig/ext/date/lib/parse_tz.c -+++ php-8.5.0RC4/ext/date/lib/parse_tz.c +--- php-8.5.9.orig/ext/date/lib/parse_tz.c ++++ php-8.5.9/ext/date/lib/parse_tz.c @@ -26,9 +26,33 @@ #include "timelib.h" #include "timelib_private.h" @@ -728,11 +728,11 @@ } else { *error_code = TIMELIB_ERROR_NO_SUCH_TIMEZONE; tmp = NULL; -Index: php-8.5.0RC4/ext/date/php_date.c +Index: php-8.5.9/ext/date/php_date.c =================================================================== ---- php-8.5.0RC4.orig/ext/date/php_date.c -+++ php-8.5.0RC4/ext/date/php_date.c -@@ -491,7 +491,11 @@ PHP_MINFO_FUNCTION(date) +--- php-8.5.9.orig/ext/date/php_date.c ++++ php-8.5.9/ext/date/php_date.c +@@ -485,7 +485,11 @@ PHP_MINFO_FUNCTION(date) php_info_print_table_row(2, "date/time support", "enabled"); php_info_print_table_row(2, "timelib version", TIMELIB_ASCII_VERSION); php_info_print_table_row(2, "\"Olson\" Timezone Database Version", tzdb->version);
