Commit a422c5500f7 for php

commit a422c5500f78b8ce337b50df4570b52023512847
Merge: a3fc68a05f4 95882fa2962
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Sun Oct 4 11:42:54 2026 -0400

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      ext/standard: Close owned proc_open descriptors on setup failure

diff --cc NEWS
index 9c885b9e9a4,c83136c84e8..d9d65d5527a
--- a/NEWS
+++ b/NEWS
@@@ -128,121 -196,8 +128,123 @@@ PH
      read failure. (Ilia Alshanetsky)
    . Fixed iptcembed() corrupting JPEG headers when called recursively from an
      output handler. (Ilia Alshanetsky)
+   . Fixed proc_open() leaking descriptor zero when descriptor setup fails.
+     (Ilia Alshanetsky)
 +
 +- Tidy:
 +  . Fixed a use-after-free when a tidyNode is used after its document is
 +    reparsed. (Ilia Alshanetsky)
 +
 +- Zip:
 +  . Fixed bug GH-23899 (Assertion failure when a cancel callback returns an
 +    invalid type during shutdown). (Weilin Du)
 +
 +24 Sep 2026, PHP 8.6.0RC2
 +
 +- Core:
 +  . Fixed incorrect internal pointer and foreach iterator positions when
 +    compacting arrays with holes. (Weilin Du)
 +  . Fix handling of references to typed properties during unserialization
 +    of various internal classes. (ndossche, timwolla)
 +  . Fixed OSS-Fuzz 532353396 (assertion	failure	with static type). (Girgias)
 +  . Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
 +  . Fixed bug GH-23752 (Use scoped diagnostic suppression for the global
 +    register declarations so the caller's -Wvolatile-register-var state is
 +    restored). (yqtian-se)
 +  . Fixed OSS-Fuzz #538730793 (Assertion failure when returning by-ref from
 +    closure invoke). (ndossche)
 +  . Fixed OSS-Fuzz #540904105 (ASSERT: ast->attr == T_CLASS_C). (ndossche)
 +
 +- CLI
 +  . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
 +    request activation). (matyhtf)
 +  . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD
 +    request for a static file). (jakubskopal)
 +
 +- Date:
 +  . Fix unserialization of Time\Duration. (timwolla)
 +  . Add comparison handler for Time\Duration. (timwolla)
 +
 +- DOM:
 +  . Fixed use-after-free when re-constructing a DOMXPath whose php:function
 +    registrations are freed while still reachable from the cycle collector.
 +    (Ilia Alshanetsky)
 +  . Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and
 +    MathML elements. (Ilia Alshanetsky)
 +  . Fixed Dom\HTMLDocument giving attributes the namespace of their element
 +    when a fragment is parsed with an xlink, xml or xmlns context element.
 +    (Ilia Alshanetsky)
 +
 +- Fileinfo:
 +  . Upgrade to file 5.48. (Weilin Du)
 +
 +- Intl:
 +  . Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state
 +    such as dateType, timeType, calendar and the message pattern.
 +    (Ilia Alshanetsky)
 +  . Fixed a crash when converting with a cloned UConverter that uses
 +    toUCallback/fromUCallback. (Ilia Alshanetsky)
 +  . Fixed Collator attribute and strength methods not rejecting an
 +    unconstructed Collator. (Ilia Alshanetsky)
 +
 +- Lexbor:
 +  . Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a
 +    heap buffer overflow in :lexbor-contains() parsing and buffer overflows
 +    in malformed decode replay. (alexandre-daubois)
 +
 +- MBString:
 +  . Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
 +    a truncated UTF-8 sequence). (Lazizbek Ergashev)
 +  . Updated Unicode data tables to Unicode 18.0 (Yuya Hamada)
 +  . Fixed mbstring functions emitting surrogates in UTF-8 output and flagging
 +    it as valid UTF-8. (Nicolas Grekas)
 +
 +- MySQLi:
 +  . Fix GH-22854: Fixed failed assertion when accessing mysqli property after
 +    failed reconnection. (Kamil Tekiela)
 +
 +- Opcache:
 +  . Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a
 +    loop-invariant addition). (Ilia Alshanetsky)
 +  . Fixed OSS-Fuzz #545352966 (default value AST of an SHM-persisted partial).
 +    (ndossche)
 +
 +- PDO:
 +  . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
 +    column index. (Ilia Alshanetsky)
 +  . Fixed PDOStatement::bindColumn() registering a binding for a column name
 +    that is not in the result set. (Ilia Alshanetsky)
 +  . Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a
 +    transaction still in use by another instance). (Lazizbek Ergashev)
 +
 +- PGSQL:
 +  . Fixed pg_lo_write() rejecting data containing null bytes. (Ilia Alshanetsky)
 +
 +- Posix:
 +  . Reverted the validity check on the flags argument of posix_access().
 +    (David Carlier)
 +
 +- Readline:
 +  . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
 +    set to an empty string. (Ilia Alshanetsky)
 +
 +- Session:
 +  . Fixed session_start() continuing after a failed create_sid() when
 +    session.use_strict_mode rejects the supplied ID. (Ilia Alshanetsky)
 +  . Fixed exceptions from user-defined create_sid() handlers being replaced
 +    by return-value validation errors. (Ilia Alshanetsky)
 +
 +- SPL:
 +  . Fixed bug GH-23385 (SplDoublyLinkedList::serialize() use-after-free when
 +    __serialize() removes an element). (David Carlier)
 +
 +- SQLite:
 +  . Fixed a crash when SQLite3::close() is called from a userland callback.
 +    (Ilia Alshanetsky)
 +
 +- Standard:
 +  . Fixed bug #60110 (fclose(), file_put_contents(), copy() do not return false
 +    properly). (Jakub Zelenka, Ilija Tovilo)
    . Fixed three Windows-only proc_open() defects: an uninitialized
      PROCESS_INFORMATION, an indeterminate comspec pointer after a failed
      lookup, and an unchecked CreateFileA() failure. (Ilia Alshanetsky)