Commit 344d5918614 for php

commit 344d5918614805c43ccb63c8e1f845f37930b6d0
Merge: 3e4a6a25d6f 79cd93f88ac
Author: Weilin Du <weilindu@php.net>
Date:   Wed Nov 4 15:28:00 2026 +0800

    Merge branch 'PHP-8.6'

    * PHP-8.6:
      ext/curl: Clear CURLOPT_PRIVATE in curl_reset() (#25170)

diff --cc NEWS
index 86cb1396386,8346bc32cd8..673437eec83
--- a/NEWS
+++ b/NEWS
@@@ -1,46 -1,508 +1,47 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? ????, PHP 8.6.1
 -
 -- Curl:
 -  . Fixed curl_reset() retaining CURLOPT_PRIVATE after reset. (lacatoire)
 -
 -- Opcache:
 -  . Fixed bug GH-22216 (spurious opcache.memory_consumption warning on each new
 -    ZTS thread; the directive is also reported as 0 in worker threads).
 -    (Daisuke Komazaki)
 -
 -05 Nov 2026, PHP 8.6.0RC5
 +?? ??? ????, PHP 8.7.0alpha1

  - Core:
 -  . Fix function and constant imports in compile_to_ast and add support
 -    for grouping. (Klaas Skelte van der Werf)
 -  . Fixed bug GH-24668 (zend_set_local_var() leaks the previous value of an
 -    existing CV). (yasu20200121web-prog, lazerg)
 -  . Fixed unmapping of an unrelated range when the aligned chunk mmap fails
 -    (Marti2203).
 -  . Fixed bug GH-25023 (ZEND_CONTAINER_OF() fails to compile with -std=c11).
 -    (lazerg)
 -  . Fixed bug GH-25007 (Partial function application: named args in a constant
 -    expression cause out-of-bounds write in zp_compile()). (lazerg)
 -  . Fixed AST printing dropping final on class constants and properties, and
 -    abstract on properties. (Jorg Sowa)
 -  . Fixed AST export of readonly anonymous classes dropping the readonly
 -    modifier. (Jorg Sowa)
 -  . Fixed memory leak of a duplicate named argument in new in initializer.
 -    (Jorg Sowa)
 -  . Fixed bug GH-25061 ($x = $x - 1 on null is optimized to PRE_DEC).
 -    (Lazizbek Ergashev)
 -  . Fixed bug GH-23911 (Don't use static closure cache when called_scope
 -    diverges). (Roman Ondráček)
 -  . Fixed first-class callables to static methods in trait constant
 -    expressions resolving to the method of the first using class and
 -    bypassing visibility checks. (Jorg Sowa)
 -
 -- CLI:
 -  . Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).
 -    (ndossche, devnexen)
 -  . Fixed bug GH-9670 (List -C and -q in the CLI help). (Juan Versolato Lopes)
 -
 -- COM:
 -  . Fixed bug GH-25008 (com_event_sink() and com_print_typeinfo() crash
 -    resolving an event source with no loaded typelib). (Ilia Alshanetsky)
 +  . A flat unkeyed list assignment from an array literal with one value per
 +    target, such as [$a, $b] = [$b, $a], no longer builds the array when the
 +    result is unused (GH-23048). (Artem Ukrainskiy)

  - Curl:
 -  . Fix use-after-free of CURLOPT_STDERR stream on cloned curl handle.
 -    (lacatoire)
 -  . Fix UAF on clone due to callback data pointer mismatch. (ndossche)
 -
 -- DBA:
 -  . Fixed bug GH-24641 (ndbm backend never checks dbm_open() return value,
 -    NULL deref on first use after a failed open). (Girgias)
 -
 -- DOM:
 -  . Fixed a use-after-free when reflected attribute setters replace an
 -    attribute whose child still has a live wrapper. (Jakub Zelenka)
 -  . Fix error paths in dom_xml_serializing_a_document_node(). (ndossche)
 -
 -- FFI:
 -  . Fixed bug GH-24582 (Memory leaks in ext/ffi parser when finalize_type()
 -    bails out). (matyapiro31, David Carlier)
++  . Fixed curl_reset() retaining CURLOPT_PRIVATE after reset. (lacatoire)
 +  . curl_multi_exec() now throws a TypeError when still_running is not an int.
 +    (arshidkv12)
 +  . Uploading multiple files with the same field name is now possible by
 +    passing an array of CURLFile or CURLStringFile objects to
 +    CURLOPT_POSTFIELDS. (Sjoerd Langkemper)

  - FPM:
 -  . Fixed crash and stack memory disclosure in the worker output logging with
 -    a pool name longer than the message prefix buffer or log_limit.
 -    (Martin Mirchev)
 -  . Fixed bug GH-24046 (FPM worker stdio pipe fd closed twice when a child
 -    process outlives the worker, breaking a later worker's stdio).
 -    (Ian P. Christian, ndossche)
 -  . Fixed memory leaks of the _GET string on the status page error and HEAD
 -    request paths. (Marcel Hernandez)
 -  . Fixed use-after-free of the scoreboard copy when logging invalid status
 -    values. (Marcel Hernandez)
 -  . Fixed null pointer dereference in fpm_get_status() when the scoreboard
 -    copy fails. (Marcel Hernandez)
 -
 -- GD:
 -  . Fixed imagetruecolortopalette() error message. (Marc Bennewitz)
 +  . Use recommended TYPE, HELP order for OpenMetrics metadata.
 +    (Marcel Hernandez)

  - Hash:
 -  . Fix GOST and Snefru digests of 512 MiB or more. (Martin Mirchev)
 -
 -- Intl:
 -  . Fixed IntlDateFormatter parse functions truncating an $offset below
 -    INT_MIN. (Marc Bennewitz)
 -
 -- JSON:
 -  . Fixed json_encode() leaving the recursion guard set on objects with hooked
 -    properties after running out of memory while escaping a property name.
 -    (adapik)
 -  . Fixed json_encode() silently narrowing $depth values outside the int range,
 -    which wrapped to an unrelated depth. (cuishuang)
 -  . Fixed json_encode() continuing to encode after an array or object key
 -    failed to encode. (Ilia Alshanetsky)
 -
 -- LDAP:
 -  . Fix crash in ldap_exop_sync() when $response_data is omitted. (lacatoire)
 -
 -- MBString:
 -  . Fixed negative mbstring.regex_stack_limit and mbstring.regex_retry_limit
 -    on 32bit platforms. (Marc Bennewitz)
 -
 -- MySQLnd:
 -  . Fixed bug GH-24609 (OK packets without an info message rejected on x32
 -    builds). (lazerg)
 -
 -- ODBC:
 -  . Fixed bug GH-25036 (odbc_prepare() corrupts the heap when the driver
 -    cannot describe a parameter). (Ilia Alshanetsky)
 -
 -- Opcache:
 -  . Fixed bug GH-24397 (Assertion failure when dumping JIT IR).
 -    (Ilia Alshanetsky)
 -  . Fixed tracing JIT returning a wrapped integer instead of a float on
 -    integer overflow after an integer was compared with a float or
 -    numeric-string literal. (Ilia Alshanetsky)
 -  . Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an
 -    empty array element. (jorgsowa)
 -  . Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding"
 -    with chained Pi nodes). (ndossche)
 -  . Fixed JIT treating an array as packed after a string key write turned it
 -    into a hash. (jorgsowa)
 -  . Fixed bug GH-24436 (Tracing JIT: keep the SEND_VAL type guard after
 -    assigning to a reference). (waroad)
 -  . Fixed bug GH-24745 (File cache loses attributes on constants on 32-bit
 -    builds). (Yannick Decat, Lazizbek Ergashev)
 -  . Fixed bug GH-17733 (System entropy does not take into account function
 -    order, resulting in wrong functions possibly called
 -    in different configurations). (ndossche)
 -  . Fixed bug GH-24438 (Preserve indirect types in JIT side traces). (aasul)
 -  . Fixed bug GH-24577 (CE-cache flag on interned class name visible before
 -    map_ptr offset). (prateekbhujel)
 -  . Fixed tracing JIT losing register-allocated CVs when an interrupt is
 -    handled at the end of a loop trace. (Levi Morrison)
 -  . Fixed bug GH-24675 (function with >~1.7 MB of machine code corrupts JIT
 -    buffer accounting). (ndossche)
 -  . Call orig_post_shutdown_cb(). (ndossche)
 -  . Fixed JIT segfault on switch over a string reference holding a
 -    non-string value. (jorgsowa)
 -  . Fixed AArch64 JIT encoding of invalid logical immediates. (jorgsowa)
 -  . Fixed JIT crashes when handling a VM interrupt with a stale saved opline
 -    in the tailcall VM. (Levi Morrison)
 -  . Fixed function JIT misinterpreting VM-enter results after an interrupt
 -    callback in the CALL and TAILCALL VMs. (Levi Morrison)
 -  . Fixed unsound shift_left_overflows range when shift wraps. (mkrishna793)
 -  . Fixed bug GH-23572 (Tracing JIT calls the wrong method for self::/parent::
 -    static calls in trait methods shared by several classes). (jorgsowa,
 -    mgoulart)
 -  . Fix block pass dropping ZEND_FAST_CALL OP2 definition. (Mrmaxmeier)
 -  . Fixed bug GH-23626 (orphaned temporaries cause leaks and assertions).
 -    (ndossche, khaledalam)
 -  . Fix preloaded functions JIT-compiled on load being overwritten
 -    after restart. (Pavel Gushcha)
 -  . Fix opcache.interned_strings_buffer being 0 in threads started later (ZTS).
 -    (Pavel Gushcha)
 -  . Fixed potential infinite recursion/hang (HYBRID/TAILCALL respectively)
 -    when zend_interrupt_function resets EG(vm_interrupt).  (Levi Morrison)
 -  . Fix JIT losing the called scope of self::/parent:: calls in included files.
 -    (ndossche)
 -  . Fixed preloaded functions not JIT-compiled again after OPcache restart.
 -    (Jorg Sowa)
 -  . Fixed bug GH-24988 (Incorrect opcode range check causes bugs with exceptions in
 -    function JIT). (ndossche, Jorg Sowa)
 -  . Fix opcache phar check. (ndossche)
 -
 -- OpenSSL:
 -  . Fixed build with OpenSSL 4.1. (Weilin Du)
 -  . Fixed bug GH-24784 (openssl_pkcs7_read() and openssl_cms_read() overwrite
 -    certificates with CRLs). (Alexander Danilov)
 -  . Fixed use-after-free in the TLS session remove callback when the listener
 -    stream is closed while a shared context is still in use. (Jakub Zelenka)
 -  . Fixed heap buffer overflow in TLS PSK callbacks. (Jakub Zelenka)
 -
 -- PDO_Firebird:
 -  . Fixed bug GH-25006 (getColumnMeta() reads out of bounds for an
 -    out-of-range column index). (Ilia Alshanetsky)
 -
 -- PDO_PGSQL:
 -  . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops
 -    PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)
 -  . Fixed a use-after-free when a persistent connection receives a notice
 -    after the request that called Pdo\Pgsql::setNoticeCallback() has ended.
 -    (Ilia Alshanetsky)
 -
 -- PDO_SQLite:
 -  . Fixed bug GH-24990 (Statement unusable after a failed execute()). (lazerg)
 -
 -- Phar:
 -  . Fixed bug GH-25093 (Phar::webPhar() redirect reads past the request URI).
 -    (lazerg)
 -  . Fixed bug GH-25089 (Heap buffer over-read via crafted alias size in
 -    zip-based phar). (Lazizbek Ergashev)
 -  . Fixed bug GH-8469 (Phar::decompressFiles() and Phar::compressFiles() retain
 -    compressed contents after changing compression). (Raphael Paez)
 -  . Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
 -    (Lazizbek Ergashev)
 -  . Fixed bug GH-25090 (UAF in phar rename() of an entry with metadata).
 -    (Lazizbek Ergashev)
 -  . Fixed bug GH-25091 (UAF in phar rename() when source and destination
 -    are equal). (Lazizbek Ergashev)
 -  . Fixed bug GH-25092 (Double free in Phar::copy() on link and
 -    mounted entries). (Lazizbek Ergashev)
 -  . Fixed bug GH-24531 (Crash when modifying a zip-based phar whose file was
 -    renamed). (Ilia Alshanetsky)
 -  . Fixed Phar::buildFromIterator() accepting a negative getMTime() on 32bit
 -    platforms. (Marc Bennewitz)
 -
 -- Reflection:
 -  . Fixed bug GH-21768 (Assertion failure in ReflectionProperty::isReadable()
 -    and isWritable() on internal virtual properties). (David Carlier)
 -
 -- SAPI:
 -  . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
 -    (Martin Mirchev)
 -
 -- Session:
 -  . Validate whole session ID instead of stopping at the first NUL byte.
 -    (Sjoerd Langkemper)
 -
 -- Sodium:
 -  . Pass sodium_crypto_xof_*() state via objects instead of by-ref strings.
 -    (timwolla)
 -
 -- SPL:
 -  . Fixed bug GH-24264 (Unwind/GracefulExit discarded in spl_iterators.c).
 -    (Lazizbek Ergashev)
 -
 -- Sockets:
 -  . Fixed bug GH-24748 (socket_set_option() crashes with declared object
 -    properties). (Lazizbek Ergashev)
 -
 -- Standard:
 -  . Fixed bug GH-25086 (Io\Poll kqueue backend leaks memory on every
 -    Watcher::modifyEvents() call). (Lazizbek Ergashev, Jakub Zelenka)
 -  . Fixed Io\Poll WSAPoll backend accepting handles that are not sockets, which
 -    were then silently dropped by wait(). Adding them now fails with
 -    ERROR_NOSUPPORT. (Nicolas Grekas)
 -  . Fixed memory leaks in checkdnsrr() and dns_check_record() on Windows.
 -    (Ilia Alshanetsky)
 -  . Fixed __unserialize() and __wakeup() being called for objects with a missing
 -    closing brace. (Ilia Alshanetsky)
 -  . Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog
 -    was not opened by PHP). (lazerg)
 -  . Fixed bug GH-24552 (Case-insensitive substr_compare(), ksort() and
 -    krsort() are still locale-dependent). (Lazizbek Ergashev, Jon Surrell)
 -  . Fix use-after-free in Randomizer::shuffleArray() when the engine throws.
 -    (Marti2203)
 -
 -- Streams:
 -  . Fixed bug GH-24506 (stream_select() leaks a stream-error operation level
 -    on its FD_SETSIZE failure path). (azjezz)
 -  . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header
 -    parsing fails after Transfer-Encoding). (bercedev)
 -  . Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty
 -    Location header). (bercedev)
 -  . Fix out-of-bounds reads parsing ftp:// wrapper server replies.
 -    (Alejandro Pacheco)
 -
 -- URI:
 -  . Upgrade to uriparser 1.0.3. (CVE-2026-48841) (Sebastian Pipping, timwolla)
 -
 -- Windows:
 -  . Fixed bug GH-25009 (GetConsoleTitleW() buffer size passed in bytes).
 -    (Lazizbek Ergashev)
 -  . Fixed sapi_windows_cp_set() and sapi_windows_cp_conv() accepting a negative
 -    codepage on 32bit platforms. (Marc Bennewitz)
 -
 -- Zip:
 -  . Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows
 -    configuration. (Weilin Du)
 -  . Excluded libzip 1.12.0 due to a regression preventing additions and
 -    replacements in torrentzip archives. (Weilin Du)
 -
 -- Zlib:
 -  . Fixed bug GH-24533 (zlib.lib could not be found because zlib 1.3.2
 -    CMake build does not emit it). (Lazizbek Ergashev)
 -
 -21 Oct 2026, PHP 8.6.0RC4
 -
 -- Core:
 -  . Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
 -    bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
 -    ndossche, Nicolas Grekas)
 -  . Fixed bug GH-24184 (System ID not being reinitialized after an Apache
 -    graceful restart, potentially causing incompatible OPcache file cache
 -    entries to be reused). (Levi Morrison)
 -  . Fixed memory leak when an exception already contains the pending exception
 -    in its previous chain. (Edmond)
 -  . Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an
 -    enclosing function). (ndossche)
 -  . Fixed memory manager keeping a block reallocated to exactly the size of
 -    the next smaller bin in its larger bin, which efree_size() then freed
 -    into the wrong one. (Marc Bennewitz)
 -  . Fix throwing behaviour with recursive arrays in VM. (ndossche)
 -  . Fixed skipped catch block when switching fibers during exception unwinding
 -    (Nicolas Grekas)
 -  . Fix escape analysis for objects implementing ArrayAccess. (ndossche, Arnaud)
 -  . Fixed array_map() optimization not resolving the class name of a static
 -    first-class callable. (Claudio Dekker)
 -
 -- Date:
 -  . Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property
 -    hash construction). (heathdutton)
 -  . Fixed bug GH-24350 (MINIT reads a stale external tz database after an
 -    in-process module restart). (Lazizbek Ergashev)
 -
 -- Fileinfo:
 -  . Fixed bug GH-24289 (finfo::file() reports the wrong argument number for
 -    an invalid $filename). (Lazizbek Ergashev)
 -
 -- FPM:
 -  . Fixed bug GH-24229 (fcgi_close() passes shutdown() a literal 1, which is
 -    SHUT_RD in WASI). (Ryosuke Ishibashi)
 -
 -- FTP:
 -  . Fix double free in ext/ftp data_accept() on accept failure. (alepacheco)
 -
 -- MBString:
 -  . Fixed bug GH-23958 (truncated encoding names resolving to full names). (Kamil Tekiela)
 -  . Fixed out-of-bounds read in php_mb_rfc1867_getword() on a multibyte lead
 -    byte at the end of a multipart field name. (Jorg Sowa)
 -
 -- MySQLnd:
 -  . Fixed bug GH-24293 (Segfault on connect with an empty password to a
 -    MariaDB PAM account). (lazerg)
 -
 -- Opcache:
 -  . Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a
 -    root trace at the opcache.jit_max_root_traces limit, causing spurious
 -    "Too few arguments" errors and crashes). (RV7PR)
 -  . Fix type inference of ADD_ARRAY_UNPACK with integer keys. (ndossche)
 -  . Fix too wide type inference for ASSIGN_DIM_OP. (ndossche)
 -  . Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche)
 -  . Fix exception checks due to NAN warnings and object empty()'s. (ndossche)
 -  . Fixed bug GH-24270 (JIT loses the called scope of self:: and parent:: calls
 -    in closures). (RV7PR)
 -  . Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string
 -    property). (Lazizbek Ergashev)
 -  . Fixed bug GH-24185 (Windows ZTS: random access violations with OPcache JIT
 -    in multi-process setups). (Arnaud, ndossche)
 -  . Fix SIGFPE on LONG_MIN % -1 with a constant divisor. (waroad)
 -  . Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side
 -    exits). (Lazizbek Ergashev)
 -  . Fixed bug GH-24391 (JIT switch on constant null takes default instead of
 -    case 0). (ndossche)
 -  . Fixed bug GH-24206 (Tracing JIT loses loop-carried CV when its loop PHI
 -    is reloaded from memory). (ndossche)
 -  . Fixed bug GH-24386 (JIT: register operand must be loaded before the typed
 -    reference check). (ndossche)
 -  . Fixed bug GH-24437 (JIT: Fix OP_DATA read from an unwritten slot in
 -    zend_jit_assign_dim_op()). (waroad)
 -  . Fixed bug GH-24398 (JIT: minimal JIT segfault when a hooked property is
 -    passed to a run-time-resolved function). (waroad)
 -  . Fixed bug GH-24389 (Tracing JIT: type guard on entry of an inlined call
 -    exits with an uninitialized opline). (waroad)
 -
 -- PDO:
 -  . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
 -    (Ilia Alshanetsky)
 -  . Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a
 -    persistent connection. (Ilia Alshanetsky)
 -  . Fixed constructor option errors naming argument #3 ($password) instead
 -    of argument #4 ($options). (Ilia Alshanetsky)
 -
 -- Phpdbg:
 -  . Fix wrong command names. (ndossche, Weilin Du)
 -
 -- Phar:
 -  . Fixed GH-24166 (Double-free in Phar::webPhar() in CGI without PATH_INFO).
 -    (RigelYoung, Jakub Zelenka)
 -
 -- POSIX:
 -  . Fixed posix_setrlimit() rejecting POSIX_RLIMIT_INFINITY on Solaris.
 -    (Jorg Sowa)
 -
 -- Readline:
 -  . Fixed a crash in readline_info() when completion_append_character
 -    contains a non-ASCII byte. (Weilin Du)
 -
 -- Session:
 -  . Fixed session_write_close() keeping the save handler open when the
 -    session data cannot be encoded. (Ilia Alshanetsky)
 -  . Fixed session data loss in the files save handler when writing the session
 -    file fails after it was already truncated. (Ilia Alshanetsky)
 -
 -- SOAP:
 -  . Fixed bug GH-23686 (SoapClient only strips `Authorization: Basic` when a
 -    WSDL imports from another host). (DanielEScherzer)
 -
 -- Standard:
 -  . Fixed chown() and lchown() failing to resolve user names in ZTS builds
 -    when getpwnam_r() needs a larger buffer. (Ilia Alshanetsky)
 -  . Fixed password_get_info() and password_needs_rehash() accepting malformed
 -    bcrypt costs. (Ilia Alshanetsky)
 -  . Fixed proc_open() null descriptor not being inheritable on Windows.
 -    (Jorg Sowa)
 -  . Don't share the unserialize() context with enum autoloaders.
 -    (Nicolas Grekas)
 -  . Fixed bug GH-24399 (usleep() and time_nanosleep() ignore queued APCs on
 -    Windows). (Nicolas Grekas)
 -  . Fixed glob() not negating bracket expressions that start with "^".
 -    (Nicolas Grekas)
 -  . Fixed bug GH-24605 (var_export() crashes on deeply nested arrays and
 -    objects). (Labish Bardiya)
 -
 -- Tidy:
 -  . Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and
 -    tidy::repairFile() rejecting null for $encoding. (lacatoire)
 -
 -- Zip:
 -  . Fixed use-after-free when re-entering ZipArchive during destruction or
 -    a close warning, and rejected opening streams while closing. (jvoisin)
 -  . Fixed a use-after-free when a ZipArchive method that modifies the archive
 -    is called from a progress or cancel callback during close().
 -    (Ilia Alshanetsky)
 -
 -- Zlib:
 -  . Fixed use-after-free when an error handler removes a failing zlib.inflate
 -    filter (GH-24176). (Edmond)
 -
 -08 Oct 2026, PHP 8.6.0RC3
 -
 -- BCMath:
 -  . Fixed BcMath\Number results that truncate to zero keeping a negative sign
 -    and comparing less than zero. (Ilia Alshanetsky)
 -
 -- BZ2:
 -  . Fixed double close of the descriptor and use-after-free of the inner
 -    stream when bzopen() is given a stream resource. (Jakub Zelenka)
 -
 -- CLI
 -  . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
 -    request activation). (matyhtf)
 -  . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD
 -    request for a static file). (jakubskopal)
 -  . Fixed crash in the built-in server when a client is reset before being
 -    accepted. (David Carlier)
 -  . Fixed the built-in server truncating an error page and leaking its
 -    unsent part after a partial socket write. (Ilia Alshanetsky)
 -
 -- Core
 -  . Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison
 -    unfolded, crashing the VM in zval_undefined_cv). (ndossche)
 -  . Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias)
 -  . Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
 -  . Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object
 -    comparison. (Arnaud)
 -  . Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
 -    (ndossche)
 -  . Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy
 -    proxy objects instead of forwarding to the real instance). (lisachenko)
 -  . Fixed bug GH-23882 (array_map() optimization is incorrect for
 -    strict_types=1). (timwolla)
 -  . Fixed OSS-Fuzz #565486253 (coerced arg with '...' on non-variadic
 -    function). (ndossche)
 -  . Fixed AVX being reported as supported when the OS has not enabled AVX
 -    state. (Ilia Alshanetsky)
 -  . Fixed OSS-Fuzz #552682112 (assertion failure wrt
 -    zp_arg_must_be_sent_by_ref()). (ndossche)
 -  . Fixed GH-23921 (Fibers start with error_reporting = 0 when the
 -    error_reporting INI directive is not set). (Girgias)
 -  . Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). (ndossche)
 -  . Deprecated using "let" or "is" as the name of a class, function, or
 -    constant, and as an alias in class_alias() and use declarations. (Girgias)
 -  . Deprecated using "_" as a constant name and as an alias for a class or
 -    constant in use declarations. (Girgias)
 -  . Switch the POSIX high resolution timer back to CLOCK_MONOTONIC from
 -    CLOCK_MONOTONIC_RAW. (nicolas-grekas)
 -  . Fixed array_map optimization with non-literal function or non-literal args.
 -    (Arnaud)
 -  . Fixed memory leak in array_map() foreach optimization when a constant
 -    non-array string argument is passed. (Alexander Danilov)
 -  . Fixed use-after-free when a dl()-loaded extension declares a frameless
 -    function and a later request calls it. (Ilia Alshanetsky)
 -  . Fixed System V shared memory emulation for Windows attaching segments past
 -    the end of their mapping. (Ilia Alshanetsky)
 -  . Fixed exception thrown by destructor during GC in a Fiber not being rethrown
 -    into the frame that triggered the GC. (Nicolas Grekas)
 -
 -- DOM:
 -  . Fixed DOMXPath and Dom\XPath losing the context node and in-scope
 -    namespaces of an evaluation after a php:function() callback evaluated
 -    another expression on the same object. (Ilia Alshanetsky)
 -
 -- FFI:
 -  . Fixed crashes with FFI callbacks created from __call() trampolines
 -    and array callables whose object is released. (Ilia Alshanetsky)
 +  . Fixed mhash_keygen_s2k() truncating a $length above INT_MAX instead of
 +    throwing a ValueError. (Marc Bennewitz)

  - Intl:
 -  . Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings
 -    when supplementary characters precede the match. (Weilin Du)
 -  . Fixed grapheme_strstr() and grapheme_strpos() missing canonically
 -    equivalent matches, and grapheme searches reporting ICU errors for empty
 -    haystacks. (Weilin Du)
 -  . Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches
 -    when using a negative offset. (Weilin Du)
 -  . Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar()
 -    treating the offset as UTF-16 code units instead of bytes.
 +  . Added IntlRelativeDateTimeFormatter for locale-aware relative date and time
 +    formatting, with enums for styles, capitalization contexts, and units.
 +    (Weilin Du)
 +  . Added Transliterator::toRules() and transliterator_to_rules().
 +    (Weilin Du, David Carlier)
 +  . Fixed Collator attribute and strength methods not rejecting an
 +    unconstructed Collator. (Ilia Alshanetsky)
 +  . Added optional $availableLocales argument to Locale::acceptFromHttp()
 +    (GH-24074). (David Carlier)
 +  . Fixed a double-free when Calendar::createInstance() or
 +    IntlCalendar::fromDateTime() fails after adopting a TimeZone.
      (Ilia Alshanetsky)
 +  . Added IntlNumberFormatter::createFromSkeleton() (GH-24165). (David Carlier)

  - Lexbor:
 +  . Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a
 +    heap buffer overflow in :lexbor-contains() parsing and buffer overflows
 +    in malformed decode replay. (alexandre-daubois)
    . Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a,
      lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff,
      lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6, lexbor/lexbor@917742f and