PHP 8.6.0RC2: Downloads, Changelog, News

Core

• Fixed incorrect internal pointer and foreach iterator positions when compacting arrays with holes.
• Fix handling of references to typed properties during unserialization of various internal classes.
• Fixed OSS-Fuzz 532353396 (assertion failure with static type).
• Fix GH-23662 (Avoid NAN warning in print_r()).
• Fixed bug GH-23752 (Use scoped diagnostic suppression for the global register declarations so the caller's -Wvolatile-register-var state is restored).
• Fixed OSS-Fuzz #538730793 (Assertion failure when returning by-ref from closure invoke).
• Fixed OSS-Fuzz #540904105 (ASSERT: ast->attr == T_CLASS_C).

CLI

• Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation).
• Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD request for a static file).

Date

• Fix unserialization of Time\Duration.
• Add comparison handler for Time\Duration.

DOM

• Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector.
• Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and MathML elements.
• Fixed Dom\HTMLDocument giving attributes the namespace of their element when a fragment is parsed with an xlink, xml or xmlns context element.

Fileinfo

• Upgrade to file 5.48.

Intl

• Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state such as dateType, timeType, calendar and the message pattern.
• Fixed a crash when converting with a cloned UConverter that uses toUCallback/fromUCallback.
• Fixed Collator attribute and strength methods not rejecting an unconstructed Collator.

Lexbor

• Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a heap buffer overflow in :lexbor-contains() parsing and buffer overflows in malformed decode replay.

MBString

• Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in a truncated UTF-8 sequence).
• Updated Unicode data tables to Unicode 18.0

MySQLi

• Fix GH-22854: Fixed failed assertion when accessing mysqli property after failed reconnection.

Opcache

• Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a loop-invariant addition).
• Fixed OSS-Fuzz #545352966 (default value AST of an SHM-persisted partial).

PDO

• Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid column index.
• Fixed PDOStatement::bindColumn() registering a binding for a column name that is not in the result set.

PGSQL

• Fixed pg_lo_write() rejecting data containing null bytes.

Posix

• Reverted the validity check on the flags argument of posix_access().

Readline

• Fixed a heap over-read in the interactive shell prompt when cli.prompt is set to an empty string.

Session

• Fixed session_start() continuing after a failed create_sid() when session.use_strict_mode rejects the supplied ID.
• Fixed exceptions from user-defined create_sid() handlers being replaced by return-value validation errors.

SPL

• Fixed bug GH-23385 (SplDoublyLinkedList::serialize() use-after-free when __serialize() removes an element).

SQLite

• Fixed a crash when SQLite3::close() is called from a userland callback.

Standard

• Fixed bug #60110 (fclose(), file_put_contents(), copy() do not return false properly).
• Fixed three Windows-only proc_open() defects: an uninitialized PROCESS_INFORMATION, an indeterminate comspec pointer after a failed lookup, and an unchecked CreateFileA() failure.
• Fixed bug GH-23780 (unserialize('') fails silently).

URI

• Fix casing of enum cases in UriHostType and UrlHostType to match the RFC and PHP’s naming policy.

Zlib

• Fixed inflate_init() dropping the preset dictionary for raw streams with a non-default window.