Commit 58f680c81e4 for php

commit 58f680c81e490bf45cbfb6dd42a17ed430cf8f41
Merge: 38e40bb3fda 81a83bb33a6
Author: David Carlier <devnexen@gmail.com>
Date:   Thu Oct 1 19:13:18 2026 +0100

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      ext/soap: to_xml_array() heap use-after-free with illegal iterator keys.

diff --cc NEWS
index 47044f8d3e0,1cc0c1891fe..0277ee871e2
--- a/NEWS
+++ b/NEWS
@@@ -97,102 -146,9 +97,106 @@@ PH
      and lastInsertId() are now reported instead of being dropped.
      (Ilia Alshanetsky)

 -- PDO_Firebird:
 -  . Fixed bug GH-23758 (PDO_Firebird returns null for non-null empty BLOBs).
 -    (Lazizbek Ergashev)
 +- PDO_PGSQL:
 +  . Fixed crash when a persistent connection fails. (KentarouTakeda)
 +
 +- Reflection:
 +  . Fixed bug GH-23842 (ReflectionProperty::skipLazyInitialization() copies
 +    invalid constant defaults with OPcache). (DirkTrunkstar, Lazizbek Ergashev)
 +
 +- SimpleXML:
 +  . Fixed reconstructing a SimpleXMLElement freeing a child element that
 +    another variable still references. (Ilia Alshanetsky)
 +
++- SOAP:
++  . Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with
++    an illegal key). (David Carlier)
++
 +- Tidy:
 +  . Fixed a use-after-free when a tidyNode is used after its document is
 +    reparsed. (Ilia Alshanetsky)
 +
 +- Zip:
 +  . Fixed bug GH-23899 (Assertion failure when a cancel callback returns an
 +    invalid type during shutdown). (Weilin Du)
 +
 +24 Sep 2026, PHP 8.6.0RC2
 +
 +- Core:
 +  . Fixed incorrect internal pointer and foreach iterator positions when
 +    compacting arrays with holes. (Weilin Du)
 +  . Fix handling of references to typed properties during unserialization
 +    of various internal classes. (ndossche, timwolla)
 +  . Fixed OSS-Fuzz 532353396 (assertion	failure	with static type). (Girgias)
 +  . Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
 +  . Fixed bug GH-23752 (Use scoped diagnostic suppression for the global
 +    register declarations so the caller's -Wvolatile-register-var state is
 +    restored). (yqtian-se)
 +  . Fixed OSS-Fuzz #538730793 (Assertion failure when returning by-ref from
 +    closure invoke). (ndossche)
 +  . Fixed OSS-Fuzz #540904105 (ASSERT: ast->attr == T_CLASS_C). (ndossche)
 +
 +- CLI
 +  . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
 +    request activation). (matyhtf)
 +  . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD
 +    request for a static file). (jakubskopal)
 +
 +- Date:
 +  . Fix unserialization of Time\Duration. (timwolla)
 +  . Add comparison handler for Time\Duration. (timwolla)
 +
 +- DOM:
 +  . Fixed use-after-free when re-constructing a DOMXPath whose php:function
 +    registrations are freed while still reachable from the cycle collector.
 +    (Ilia Alshanetsky)
 +  . Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and
 +    MathML elements. (Ilia Alshanetsky)
 +  . Fixed Dom\HTMLDocument giving attributes the namespace of their element
 +    when a fragment is parsed with an xlink, xml or xmlns context element.
 +    (Ilia Alshanetsky)
 +
 +- Fileinfo:
 +  . Upgrade to file 5.48. (Weilin Du)
 +
 +- Intl:
 +  . Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state
 +    such as dateType, timeType, calendar and the message pattern.
 +    (Ilia Alshanetsky)
 +  . Fixed a crash when converting with a cloned UConverter that uses
 +    toUCallback/fromUCallback. (Ilia Alshanetsky)
 +  . Fixed Collator attribute and strength methods not rejecting an
 +    unconstructed Collator. (Ilia Alshanetsky)
 +
 +- Lexbor:
 +  . Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a
 +    heap buffer overflow in :lexbor-contains() parsing and buffer overflows
 +    in malformed decode replay. (alexandre-daubois)
 +
 +- MBString:
 +  . Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
 +    a truncated UTF-8 sequence). (Lazizbek Ergashev)
 +  . Updated Unicode data tables to Unicode 18.0 (Yuya Hamada)
 +  . Fixed mbstring functions emitting surrogates in UTF-8 output and flagging
 +    it as valid UTF-8. (Nicolas Grekas)
 +
 +- MySQLi:
 +  . Fix GH-22854: Fixed failed assertion when accessing mysqli property after
 +    failed reconnection. (Kamil Tekiela)
 +
 +- Opcache:
 +  . Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a
 +    loop-invariant addition). (Ilia Alshanetsky)
 +  . Fixed OSS-Fuzz #545352966 (default value AST of an SHM-persisted partial).
 +    (ndossche)
 +
 +- PDO:
 +  . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
 +    column index. (Ilia Alshanetsky)
 +  . Fixed PDOStatement::bindColumn() registering a binding for a column name
 +    that is not in the result set. (Ilia Alshanetsky)
 +  . Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a
 +    transaction still in use by another instance). (Lazizbek Ergashev)

  - PGSQL:
    . Fixed pg_lo_write() rejecting data containing null bytes. (Ilia Alshanetsky)