The PHP Foundation
The PHP Foundation
Welcome back to the tenth in the PHP Core Roundup series. As February comes to end we have plenty of PHP developments to write about. February was a month full of new RFCs for upcoming PHP 8.3, merged changes, security releases for PHP 8.2, 8.1, and 8.0, as well as several discussions in the mailing list about improving PHP.
The PHP Foundation currently supports six part-time PHP contributors who work on maintenance and new features for PHP. Maintenance is not limited to fixing bugs, but also includes work to reduce technical debt, making life easier for everyone working on PHP. The contributors funded by the PHP Foundation collaborate with other contributors on code, documentation, and discussions.
We publish the posts on our website, and you can subscribe to a newsletter; You donโt necessarily have to be a PHP Foundation backer to follow PHP Core Roundup.
Sergey Panteleev, one of the PHP 8.2 release managers, called for the volunteers to put their names forward to be the release managers for the upcoming PHP 8.3. Typically, each major PHP version gets two or three release managers, one of whom is a "veteran" RM with previous experience being an RM.
Release managers will be responsible for tagging releases, coordinating releases, triaging security issues, and will have the ultimate say on last-minute RFCs and the release schedule. The standard PHP support cycle of two years of active support, followed by a year of security support means this position lasts for three years.
The release managers will be elected with the same RFC voting process. Applications will be accepted until 31 March 12:00:00 UTC. Elections (if needed) will start on 1 April and run until 16 April 12:00:00 UTC.
The RM process is thoroughly documented, and previous RMs and PHP core contributors will be there to help. If you have reasonable internals knowledge, are able to triage security issues and bugs, review and merge pull requests, and overall take responsibility for managing a branch of one of the most widely used programming languages in the world, feel free to email the list and put your name forward.
PHP 8.2.3, 8.1.16, and 8.0.28 were released on February 14, containing fixes for three security vulnerabilities along with several bug fixes.
PHP 7.4 has reached its End-Of-Life, and there will be no security fix releases.
Changes and improvements to PHP are discussed, reported, and voted on by the PHP Foundation Team, the PHP development team, and contributors. Bug reports are made to the PHP issue tracker, changes are discussed in mailing lists, minor code changes are proposed as pull requests, and major changes are discussed in detail and voted on as PHP RFCs. Documentation and the php.net website changes are also discussed and improved at their relevant Git repositories on GitHub.
Hundreds of awesome PHP contributors put their efforts into improvements to the PHP code base, documentation, and the php.net website. Here is a summary of some changes made by the people behind PHP. Things marked with ๐ are done by the PHP Foundation team.
Following are the RFCs and major pull-requests discussed, voted on, and implemented since our last update.
RFC In Voting: Saner array_(sum|product)() by Gina Peter Banyard ๐
Proposes to change the current behavior of array_sum and array_product to properly handle non-numeric values. This results in additional warnings when these functions encounter unsupported types such as certain objects, arrays, and resources. Further, it can result in different return values on objects that support arithmetic operations.
RFC In Voting: Typed class constants by Benas Seliuginas and Mรกtรฉ Kocsis ๐
Despite the huge efforts put into improving the type system of PHP year after year, it is still not possible to declare constant types. This is less of a concern for global constants, but can indeed be a source of bugs and confusion for class constants: This RFC proposes to add support for declaring class, interface, trait, as well as enum constant types:
enum E {
const string TEST = "Test1";
}
trait T {
const string TEST = E::TEST;
}
interface I {
const string TEST = E::TEST;
}
class C {
const string TEST = E::TEST;
}
RFC Partially Accepted: Readonly amendments by Nicolas Grekas and Mรกtรฉ Kocsis๐
This RFC attempts to address some of the shortcomings of PHP 8.1 readonly properties and 8.2 readonly classes.
This RFC proposed allowing readonly classes to be extended by non-readonly classes (currently not allowed, and causes a fatal error), and to allow reinitializing readonly properties during cloning (within the __clone() magic method).
During the two-part RFC vote, the first change of allowing readonly classes to be extended by non-readonly classes was rejected. The second change of making it possible to reinitialize readonly properties during cloning was accepted.
RFC Implemented: More Appropriate Date/Time Exceptions ๐
RFC by Derick Rethans, proposed to introduce Date/Time extension-specific exceptions and errors. This detailed RFC suggests more specificity in the exceptions with exception classes such as DateInvalidTimeZoneException, and DateMalformedPeriodStringException as well as promoting some of the current PHP warnings to Error exceptions.
The changes are now merged.
Following are some changes that did not go through an RFC process because they are either planned, bug fixes, or progressive enhancements. There are automated unit and integration tests for each of these changes, the PHP core developers review all pull requests.
max_multipart_body_parts to PHP 8.0, 8.1, and 8.2 (in addition to the master branch). When set, PHP limits the number of body parts PHP processes in multipart requests. This is to prevent a DoS attack vector reported as GHSA-54hq-v5wp-fqgvclass_alias() to work with internal classes. Previously, it was not possible to alias an internal class with class_alias(), and resulted in a ValueError exception saying the class must be a user-defined class.ZEND_GENERATOR_IN_FIBER flag in b9bca2dadb by Bob Weinandbool and zend_result where it makes sense in sockets extension in 3eb9dd47e0 by Gina Peter Banyard ๐php_sock_array_from_fd_set() as result is never used in 735edd1c17 by Gina Peter Banyard ๐spprintf in 93fb2c12b9 by Derick Rethans ๐zend_string is marked as valid UTF-8 in 0b9fb636d1 by Gina Peter Banyard ๐zend_test to check UTF8 flag is added in 0c9181b646 by Gina Peter Banyard ๐github/workflows/push.yml: enable ccache in GH-10395 by Max Kellermannlineno for all constant expressions in GH-8855 by Ilija Tovilo ๐CG(zend_lineno) in fb670f2b80 by Ilija Tovilo ๐write_property when object is released in GH-10179 by Ilija Tovilo ๐reset/end/next/prev() on ffi classes in GH-9711 by Tyson Andrestrto{upper,lower} (only on 'AVX2-native' builds for now) in c02af98ae5 by Alex Dowadstr_repeat in c2d4bafc4f by Niels Dosscheext/snmp: use memcpy() instead of memmove() (#10498) in d3abcae4a2 by Max Kellermannzend_adler32 (#10507) in 722fbd01a3 by Niels Dosscheexit_counters memory leak in ZTS build in a21195650e by Dmitry StogovZEND_MMAP_AHEAD in 5c5707d44d by Dmitry Stogovext/opcache/zend_jit: cast function to fix -Wincompatible-pointer-types (#10527) in afbb28dfb7 by Max Kellermannext/opcache/zend_jit: call TSRM dtor before unloading opcache.so (#10533) in 131b862ac0 by Max KellermannZend/zend_cpuinfo, ext/standard/crc32_x86: fix -Wstrict-prototypes in 0752baa583 by Max Kellermannphp.ini-production: disable opcache.huge_code_pages by default in GH-10336 by Max Kellermannarray_slice (#10539) in 3ff8333473 by Niels Dosschezval_undefined_cv in GH-10524 by Niels Dosschegithub/workflows/nightly.yml: add job to build out-of-tree extensions in GH-10404 by Max Kellermannrandom: Use branchless implementation for mask generation in Randomizer::getBytesFromString() (#10522) in 0cfc45b667 by Tim Dรผsterhusext/curl: suppress -Wdeprecated-declarations in GH-10531 by Max Kellermannre2c version requirement to 1.0.3 in df853cb305 by Derick Rethans ๐opcache/pcntl/cli: Fixes few functions signatures in 81aedad452 by David Carlier_php_stream_copy_to_stream_ex when using copy_file_range (#10440) in b4db690cb3 by Niels Dosscheext-tidy in GH-10545 by Gina Peter Banyard ๐XFAIL in 13c34aac05 by Ilija Tovilo ๐php_reflection.c, class name cannot start with backslash (#10536) in a11e9c9d02 by Michael Voลรญลกekcopy() fails on cifs mounts because of incorrect length (cfr_max) specified in streams.c:1584 copy_file_range() (#10551) in e787d6c9e6 by Niels DosscheSO_RERROR/SO_ZEROIZE/SO_SPLICE net/openbsd's constants in GH-10563 by David Carlierphp_crypt() in a92acbad87 by Tim Dรผsterhusvar_dump'ing void FFI result (#10568) in 1a5fc6e1a3 by Niels Dosscheposix: fix misuse of bool (invalid code in c23) in GH-10577 by Cristian Rodrรญguez*_ASSIGN_OP (#10458) in d94ddbed2c by Niels Dosschemax_multipart_body_parts INI in 716de0cff5 and fd3cc17cbd by Jakub Zelenka ๐NEWS in caaaf75990 by Jakub Zelenka ๐NEWS for GHSA-54hq-v5wp-fqgv as it is for all SAPIs in eef29d434a by Jakub Zelenka ๐gtar if it's in the PATH in 843ba82b53 by Ben Ramseytar is not bsdtar in d9ac59b0a9 by Ben RamseySECURITY.md community health file to the repo in 5845a52973 and bbc1f821dd by Ben Ramseyzval_undefined_cv" in 7b68ff46da by Ilija Tovilo ๐UNEXPECTED around RETURN_VALUE_USED in specialized RETVAL handler" in 81f3fcd5cc by Ilija Tovilo ๐ext/json: add php_json_scanner_defs.h as make target in 2fde3afffb by Daniel Blackext/Zend: zend_language_scanner_defs.h as make target in e83cda0887 by Daniel Blackphp_json_scanner_defs.h target in ext/json/Makefile.frag in 4f731fa2ec by Jakub Zelenka ๐NEWS with scanner and parser build fixes in a9e4f51844 by Jakub Zelenka ๐makedist: Use fixed owner/group in generated tarball (#10613) in 7d229787b0 by Tim Dรผsterhusproc_open: reject array with empty command name (#10559) in 5e617d0b4d by Cristian RodrรญguezZend/zend_types.h: deprecate zend_bool, zend_intptr_t, zend_uintptr_t (#10597) in 413844d626 by Max Kellermannext/opcache/zend_shared_alloc: bool fixups in 3b9812f8be by Max Kellermannext/opcache/zend_shared_alloc: convert more int to bool in 3dcd47243c by Max Kellermannext/opcache/ZendAccelerator: accel_is_inactive() returns bool in a50de37013 by Max Kellermannext/opcache/ZendAccelerator: fix functions to return zend_result in 04c85a3371 by Max KellermannZend/zend_alloc: make stderr_last_error() static (#10587) in c0d89e54c8 by Max KellermannZend/zend_globals: convert fiber_stack_size to size_t (#10619) in bf036fa2a3 by Max KellermannReflectionFunction::getClosureUsedVariables() returns empty array in presence of variadic arguments in ae16471628 by Niels DosscheZend/zend_types.h: move zend_result to separate header (#10609) in 3bce116069 by Max KellermannZend/zend_extensions: make zend_extension_version_info const (#10592) in 7029fd08b1 by Max KellermannCODING_STANDARDS.md: establish C99 as the implementation language (#10631) in 5bfd3fa40f by Max Kellermannext/mbstring: fix new_value length check in GH-10532 by Max Kellermannmb_convert_encoding crashes PHP on Windows in GH-10628 by Niels DosscheZend/zend_ini: fix zend_result return values in d51eb1d74c by Max Kellermannext/curl/interface: fix zend_result return value in GH-10640 by Max Kellermannconst (#10646) in 263b22f374 by Max Kellermannpcre2_match() in GH-10632 by ndosscheenums instead of preprocessor macros (#10617) in bb07e20203 by Max Kellermannsapi/fpm: remove use of variable-length arrays (#10645) in ff2a211d55 by Max Kellermannps_files_cleanup_dir() in GH-10644 by nielsdosSpoofchecker isSuspicious/areConfusable methods error code's argument in GH-10653 by NathanFreemanext/opcache/minilua in GH-10656 by Kรฉvin Dunglasclass_alias() work with internal classes (#10483) in 821fc55a68 by Niels Dosscheproc_close after proc_get_status always returns -1 in GH-10250 by Niels DosscheCODING_STANDARDS.md: add rules for bool/zend_result return types (#10630) in da777d493a by Max Kellermannmakedist: Use fixed sort in generated tarball (#10615) in 9660a7fa59 by Tim Dรผsterhusmbfl_name2no_encoding in a85adb170c by Alex Dowadmbfl_no2preferred_mime_name in 117f2263ce by Alex Dowadmb_decode_mimeheader using fast text conversion filters in 157ca654f2 by Alex Dowadmb_decode_mimeheader obeys RFC 2047 regarding underscores and QPrint encoding in 8995f60258 by Alex Dowadimagegd2 (#10569) in 101178214c by Mรกtรฉ Kocsis ๐Zend/zend_variables: use C99 designated initializers (#10655) in 0460420205 by Max Kellermannzend_compiler, ...: use uint8_t instead of zend_uchar (#10621) in d5c649b36b by Max Kellermannoutput_handler in zlib ini code in GH-10667 by Niels Dosschezend_result functions in the scanner (#10688) in 91857ccaf9 by Niels DosscheUnixODBC testing in 939c546ea1 by DanackReflectionFiber (fixes #10439) in GH-10478 by Daniil Gentiliext/opcache/zend_shared_alloc: use memfd for locking if available in GH-10589 by Max Kellermannrandom: Fix return type of php_random_(bytes|int) (#10687) in f079aa2e24 by Tim Dรผsterhuspg_lo_open segfaults in the strict_types mode) in GH-10677 by Gina Peter Banyard ๐CURL_READFUNC_PAUSE in readfunc callback in GH-10607 by Pierrick Charronzend_update_static_property_ex() in GH-10691 by nielsdosrun-tests.php does not escape path when building cmd (#10560) in dcc3255b18 by Niels Dosschehash/xxhash applying build upstream fix in GH-10693 by David CarlierDOMCharacterData::appendData return type to true (#10690) in e1967ca9ed by othercoreyaccel_move_code_to_huge_pages() in eb7bb3430b by Niels Dosschephp_openssl_set_server_dh_param() in GH-10705 by Niels Dosschezend_result where appropriate in ext/openssl Remove dead code in GH-10704 by Niels DosscheUBSAN warning about applying zero offset to null pointer (#10700) in 382148d7bb by Gina Peter Banyard ๐ext/xmlwriter (#10701) in 07fe46fb5d by Niels DosscheZend/zend_types.h: move zend_rc_debug to zend_rc_debug.h in d6e95041e2 by Max KellermannZend/zend_rc_debug: convert ZEND_RC_MOD_CHECK() to function in e509a66a9c by Max KellermannZend/zend_types.h: move IS_* to zend_type_code.h in 0270a1e54c by Max KellermannZend/zend_type_code.h: convert to enum in b98f18e7c3 by Max KellermannZend/zend_types.h: move zend_refcounted to zend_refcounted.h in eb34c28fed by Max KellermannZend/zend_types.h: move zend_uchar.h to zend_char.h in 42577c6b6b by Max KellermannZend/zend_types.h: move zend_string to zend_string.h in 02690fe3c0 by Max KellermannValueError message in substr_compare() in 2133970152 by Gina Peter Banyard ๐ValueError message in count_chars() in adc5edd411 by Gina Peter Banyard ๐Zend/zend_fibers: change return value to zend_result in GH-10622 by Max Kellermannftp_fopen_wrapper.c (#10711) in edacfbd1d4 by Niels Dosschegen_stub.php to parse and ignore extended docblock types in 81abd8dc37 by Bob WeinandZend/zend_type_code: remove hard-coded integer values and remove unused macro ZEND_SAME_FAKE_TYPE Zend/zend_variables: add _Static_assert on the size zend_rc_dtor_func _Static_assert is C11, but has been supported since GCC 4.6 in GH-10714 by Max Kellermannext/sockets: add TCP_REPAIR to silently close a connection in GH-10724 by David CARLIERAt PHP Foundation, we support, promote, and advance the PHP language. We financially support six part-time PHP core developers to contribute to the PHP project. You can help support PHP Foundation at OpenCollective.
A big thanks to all our sponsors โ PHP Foundation is all of us!
Follow us on Twitter @ThePHPF to get the latest updates from the Foundation.
๐๏ธ ๐
PHP Roundup is prepared by Ayesh Karunaratne from PHP.Watch, a source for PHP News, Articles, Upcoming Changes, and more.