Commit 92e3c068c56 for php

commit 92e3c068c56447057f6ac50ac54acf3eb42baaf8
Merge: 6f77d690dce 0fd5614ccab
Author: Weilin Du <weilindu@php.net>
Date:   Mon Oct 26 00:33:44 2026 +0800

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      Merge branch 'PHP-8.4' into PHP-8.5
      ext/zip: Reject broken libzip versions on Windows (#24371)

diff --cc NEWS
index 25d63d6a6d5,b4cbb913c92..d323a17a824
--- a/NEWS
+++ b/NEWS
@@@ -1,70 -1,8 +1,72 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? ????, PHP 8.5.13
 +?? ??? ????, PHP 8.6.0RC5

  - Core:
 +  . Fix function and constant imports in compile_to_ast and add support
 +    for grouping. (Klaas Skelte van der Werf)
 +
 +- DBA:
 +  . Fixed bug GH-24641 (ndbm backend never checks dbm_open() return value,
 +    NULL deref on first use after a failed open). (Girgias)
 +
 +- DOM:
 +  . Fix error paths in dom_xml_serializing_a_document_node(). (ndossche)
 +
 +- Hash:
 +  . Fix GOST and Snefru digests of 512 MiB or more. (Martin Mirchev)
 +
 +- Opcache:
 +  . Fixed tracing JIT returning a wrapped integer instead of a float on
 +    integer overflow after an integer was compared with a float or
 +    numeric-string literal. (Ilia Alshanetsky)
 +  . Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an
 +    empty array element. (jorgsowa)
 +  . Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding"
 +    with chained Pi nodes). (ndossche)
 +  . Fixed JIT treating an array as packed after a string key write turned it
 +    into a hash. (jorgsowa)
 +
 +- PDO_PGSQL:
 +  . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops
 +    PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)
 +
 +- SAPI:
 +  . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
 +    (Martin Mirchev)
 +
 +- SPL:
 +  . Fixed bug GH-24264 (Unwind/GracefulExit discarded in spl_iterators.c).
 +    (Lazizbek Ergashev)
 +
 +- Standard:
 +  . Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog
 +    was not opened by PHP). (lazerg)
 +
 +- Streams:
 +  . Fixed bug GH-24506 (stream_select() leaks a stream-error operation level
 +    on its FD_SETSIZE failure path). (azjezz)
 +  . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header
 +    parsing fails after Transfer-Encoding). (bercedev)
 +  . Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty
 +    Location header). (bercedev)
 +
 +- Zip:
++  . Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows
++    configuration. (Weilin Du)
 +  . Excluded libzip 1.12.0 due to a regression preventing additions and
 +    replacements in torrentzip archives. (Weilin Du)
 +
 +- Zlib:
 +  . Fixed bug GH-24533 (zlib.lib could not be found because zlib 1.3.2
 +    CMake build does not emit it). (Lazizbek Ergashev)
 +
 +21 Oct 2026, PHP 8.6.0RC4
 +
 +- Core:
 +  . Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
 +    bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
 +    ndossche, Nicolas Grekas)
    . Fixed bug GH-24184 (System ID not being reinitialized after an Apache
      graceful restart, potentially causing incompatible OPcache file cache
      entries to be reused). (Levi Morrison)
diff --cc ext/zip/config.w32
index 44e3628270c,b8e12b530b4..8b8c7ed8f2c
--- a/ext/zip/config.w32
+++ b/ext/zip/config.w32
@@@ -3,12 -3,20 +3,20 @@@
  ARG_ENABLE("zip", "ZIP support", "yes,shared");

  if (PHP_ZIP != "no") {
+ 	var zipconf_dir;
 -	if (CHECK_HEADER_ADD_INCLUDE("zip.h", "CFLAGS_ZIP", PHP_PHP_BUILD + "\\include;" + PHP_EXTRA_INCLUDES) &&
 -		(zipconf_dir = CHECK_HEADER_ADD_INCLUDE("zipconf.h", "CFLAGS_ZIP", PHP_PHP_BUILD + "\\lib\\libzip\\include;" + PHP_EXTRA_LIBS + "\\libzip\\include;" + PHP_ZIP)) &&
 +	if (CHECK_HEADER("zip.h", "CFLAGS_ZIP", PHP_PHP_BUILD + "\\include;" + PHP_EXTRA_INCLUDES) &&
- 		CHECK_HEADER("zipconf.h", "CFLAGS_ZIP", PHP_PHP_BUILD + "\\lib\\libzip\\include;" + PHP_EXTRA_LIBS + "\\libzip\\include;" + PHP_ZIP) &&
++		(zipconf_dir = CHECK_HEADER("zipconf.h", "CFLAGS_ZIP", PHP_PHP_BUILD + "\\lib\\libzip\\include;" + PHP_EXTRA_LIBS + "\\libzip\\include;" + PHP_ZIP)) &&
  		(PHP_ZIP_SHARED && CHECK_LIB("libzip.lib", "zip", PHP_ZIP) ||
  		 CHECK_LIB("libzip_a.lib", "zip", PHP_ZIP) && CHECK_LIB("libbz2_a.lib", "zip", PHP_ZIP) && CHECK_LIB("zlib_a.lib;zs.lib", "zip", PHP_ZIP) && CHECK_LIB("liblzma_a.lib", "zip", PHP_ZIP))
  	) {
+ 		if (zipconf_dir === true) {
+ 			zipconf_dir = search_paths("zipconf.h", WshShell.Environment("Process").Item("INCLUDE"), null);
+ 		}
+ 		if (GREP_HEADER("zipconf.h", /^\s*#\s*define\s+LIBZIP_VERSION\s+"(?:1\.3\.1|1\.7\.0|1\.12(?:\.0)?)"/m, zipconf_dir)) {
+ 			ERROR("libzip 1.3.1, 1.7.0 and 1.12.0 are not supported. Please use another version.");
+ 		}
+
 -		EXTENSION('zip', 'php_zip.c zip_stream.c');
 +		EXTENSION('zip', 'php_zip.c zip_source.c zip_stream.c');
  		ADD_EXTENSION_DEP('zip', 'pcre');

  		if (get_define("LIBS_ZIP").match("libzip_a(?:_debug)?\.lib")) {