Repository navigation
Expand file tree
/
Copy pathNEWS
More file actions
1473 lines (1265 loc) · 63.6 KB
/
Copy pathNEWS
File metadata and controls
1473 lines (1265 loc) · 63.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
21 Oct 2026, PHP 8.6.0RC4
- Core:
. Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
ndossche, Nicolas Grekas)
. Fixed bug GH-24184 (System ID not being reinitialized after an Apache
graceful restart, potentially causing incompatible OPcache file cache
entries to be reused). (Levi Morrison)
. Fixed memory leak when an exception already contains the pending exception
in its previous chain. (Edmond)
. Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an
enclosing function). (ndossche)
. Fixed memory manager keeping a block reallocated to exactly the size of
the next smaller bin in its larger bin, which efree_size() then freed
into the wrong one. (Marc Bennewitz)
. Fix throwing behaviour with recursive arrays in VM. (ndossche)
. Fixed skipped catch block when switching fibers during exception unwinding
(Nicolas Grekas)
. Fix escape analysis for objects implementing ArrayAccess. (ndossche, Arnaud)
. Fixed array_map() optimization not resolving the class name of a static
first-class callable. (Claudio Dekker)
- Date:
. Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property
hash construction). (heathdutton)
. Fixed bug GH-24350 (MINIT reads a stale external tz database after an
in-process module restart). (Lazizbek Ergashev)
- Fileinfo:
. Fixed bug GH-24289 (finfo::file() reports the wrong argument number for
an invalid $filename). (Lazizbek Ergashev)
- FPM:
. Fixed bug GH-24229 (fcgi_close() passes shutdown() a literal 1, which is
SHUT_RD in WASI). (Ryosuke Ishibashi)
- FTP:
. Fix double free in ext/ftp data_accept() on accept failure. (alepacheco)
- MBString:
. Fixed bug GH-23958 (truncated encoding names resolving to full names). (Kamil Tekiela)
- MySQLnd:
. Fixed bug GH-24293 (Segfault on connect with an empty password to a
MariaDB PAM account). (lazerg)
- Opcache:
. Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a
root trace at the opcache.jit_max_root_traces limit, causing spurious
"Too few arguments" errors and crashes). (RV7PR)
. Fix type inference of ADD_ARRAY_UNPACK with integer keys. (ndossche)
. Fix too wide type inference for ASSIGN_DIM_OP. (ndossche)
. Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche)
. Fix exception checks due to NAN warnings and object empty()'s. (ndossche)
. Fixed bug GH-24270 (JIT loses the called scope of self:: and parent:: calls
in closures). (RV7PR)
. Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string
property). (Lazizbek Ergashev)
. Fixed bug GH-24185 (Windows ZTS: random access violations with OPcache JIT
in multi-process setups). (Arnaud, ndossche)
. Fix SIGFPE on LONG_MIN % -1 with a constant divisor. (waroad)
. Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side
exits). (Lazizbek Ergashev)
. Fixed bug GH-24391 (JIT switch on constant null takes default instead of
case 0). (ndossche)
. Fixed bug GH-24206 (Tracing JIT loses loop-carried CV when its loop PHI
is reloaded from memory). (ndossche)
. Fixed bug GH-24386 (JIT: register operand must be loaded before the typed
reference check). (ndossche)
. Fixed bug GH-24437 (JIT: Fix OP_DATA read from an unwritten slot in
zend_jit_assign_dim_op()). (waroad)
- PDO:
. Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
(Ilia Alshanetsky)
. Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a
persistent connection. (Ilia Alshanetsky)
. Fixed constructor option errors naming argument #3 ($password) instead
of argument #4 ($options). (Ilia Alshanetsky)
- Phpdbg:
. Fix wrong command names. (ndossche, Weilin Du)
- Phar:
. Fixed GH-24166 (Double-free in Phar::webPhar() in CGI without PATH_INFO).
(RigelYoung, Jakub Zelenka)
- POSIX:
. Fixed posix_setrlimit() rejecting POSIX_RLIMIT_INFINITY on Solaris.
(Jorg Sowa)
- Readline:
. Fixed a crash in readline_info() when completion_append_character
contains a non-ASCII byte. (Weilin Du)
- Session:
. Fixed session_write_close() keeping the save handler open when the
session data cannot be encoded. (Ilia Alshanetsky)
. Fixed session data loss in the files save handler when writing the session
file fails after it was already truncated. (Ilia Alshanetsky)
- SOAP:
. Fixed bug GH-23686 (SoapClient only strips `Authorization: Basic` when a
WSDL imports from another host). (DanielEScherzer)
- Standard:
. Fixed chown() and lchown() failing to resolve user names in ZTS builds
when getpwnam_r() needs a larger buffer. (Ilia Alshanetsky)
. Fixed password_get_info() and password_needs_rehash() accepting malformed
bcrypt costs. (Ilia Alshanetsky)
. Fixed proc_open() null descriptor not being inheritable on Windows.
(Jorg Sowa)
. Don't share the unserialize() context with enum autoloaders.
(Nicolas Grekas)
. Fixed bug GH-24399 (usleep() and time_nanosleep() ignore queued APCs on
Windows). (Nicolas Grekas)
. Fixed glob() not negating bracket expressions that start with "^".
(Nicolas Grekas)
- Tidy:
. Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and
tidy::repairFile() rejecting null for $encoding. (lacatoire)
- Zip:
. Fixed use-after-free when re-entering ZipArchive during destruction or
a close warning, and rejected opening streams while closing. (jvoisin)
. Fixed a use-after-free when a ZipArchive method that modifies the archive
is called from a progress or cancel callback during close().
(Ilia Alshanetsky)
- Zlib:
. Fixed use-after-free when an error handler removes a failing zlib.inflate
filter (GH-24176). (Edmond)
08 Oct 2026, PHP 8.6.0RC3
- BCMath:
. Fixed BcMath\Number results that truncate to zero keeping a negative sign
and comparing less than zero. (Ilia Alshanetsky)
- BZ2:
. Fixed double close of the descriptor and use-after-free of the inner
stream when bzopen() is given a stream resource. (Jakub Zelenka)
- CLI
. Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
request activation). (matyhtf)
. Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD
request for a static file). (jakubskopal)
. Fixed crash in the built-in server when a client is reset before being
accepted. (David Carlier)
. Fixed the built-in server truncating an error page and leaking its
unsent part after a partial socket write. (Ilia Alshanetsky)
- Core
. Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison
unfolded, crashing the VM in zval_undefined_cv). (ndossche)
. Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias)
. Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
. Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object
comparison. (Arnaud)
. Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
(ndossche)
. Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy
proxy objects instead of forwarding to the real instance). (lisachenko)
. Fixed bug GH-23882 (array_map() optimization is incorrect for
strict_types=1). (timwolla)
. Fixed OSS-Fuzz #565486253 (coerced arg with '...' on non-variadic
function). (ndossche)
. Fixed AVX being reported as supported when the OS has not enabled AVX
state. (Ilia Alshanetsky)
. Fixed OSS-Fuzz #552682112 (assertion failure wrt
zp_arg_must_be_sent_by_ref()). (ndossche)
. Fixed GH-23921 (Fibers start with error_reporting = 0 when the
error_reporting INI directive is not set). (Girgias)
. Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). (ndossche)
. Deprecated using "let" or "is" as the name of a class, function, or
constant, and as an alias in class_alias() and use declarations. (Girgias)
. Deprecated using "_" as a constant name and as an alias for a class or
constant in use declarations. (Girgias)
. Switch the POSIX high resolution timer back to CLOCK_MONOTONIC from
CLOCK_MONOTONIC_RAW. (nicolas-grekas)
. Fixed array_map optimization with non-literal function or non-literal args.
(Arnaud)
. Fixed memory leak in array_map() foreach optimization when a constant
non-array string argument is passed. (Alexander Danilov)
. Fixed use-after-free when a dl()-loaded extension declares a frameless
function and a later request calls it. (Ilia Alshanetsky)
. Fixed System V shared memory emulation for Windows attaching segments past
the end of their mapping. (Ilia Alshanetsky)
. Fixed exception thrown by destructor during GC in a Fiber not being rethrown
into the frame that triggered the GC. (Nicolas Grekas)
- DOM:
. Fixed DOMXPath and Dom\XPath losing the context node and in-scope
namespaces of an evaluation after a php:function() callback evaluated
another expression on the same object. (Ilia Alshanetsky)
- FFI:
. Fixed crashes with FFI callbacks created from __call() trampolines
and array callables whose object is released. (Ilia Alshanetsky)
- Intl:
. Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings
when supplementary characters precede the match. (Weilin Du)
. Fixed grapheme_strstr() and grapheme_strpos() missing canonically
equivalent matches, and grapheme searches reporting ICU errors for empty
haystacks. (Weilin Du)
. Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches
when using a negative offset. (Weilin Du)
. Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar()
treating the offset as UTF-16 code units instead of bytes.
(Ilia Alshanetsky)
- Lexbor:
. Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a,
lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff,
lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6, lexbor/lexbor@917742f and
lexbor/lexbor@e89c258, fixing dropped usernames containing an at sign,
uninitialized memory in IDNA buffer growth, the encoding of a space
before a query or fragment in an opaque path, a query or fragment lost
after a dot segment in a path, replacement file drive paths, the output
encoding used for percent-encoding, the URLSearchParams tail pointer and
fragment serialization without a query. (alexandre-daubois)
- MySQLnd:
. Fixed field_count not resetting on OK packet. (Kamil Tekiela)
. Fixed memory leak when closing a prepared statement after its connection
was killed. (Kamil Tekiela)
- Opcache:
. Fix zend_analyze_calls() call_stack buffer overrun. (Mrmaxmeier)
. Fixed bug GH-23679 (Tracing JIT writes a parent private property into a
child's shadowing public property). (Ilia Alshanetsky)
. Fix multiple incorrect DCE due to unsound escape analysis. (ndossche,
arnaud-lb)
. Fixed bug GH-24063 (OPcache optimizer folds `$cond ? -0.0 : 0.0` into a
single `-0.0` constant). (lazerg)
. Fixed crash when a file cache is reused with a different set of
extensions declaring frameless functions. (Ilia Alshanetsky)
. Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).
(ndossche)
. Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.
(ndossche)
- OpenSSL:
. Fixed stream_socket_enable_crypto() leaving the socket non-blocking
after a handshake timeout. (Ilia Alshanetsky)
. Fix memory leak by doing early salt validation. (adapik)
. Fixed openssl_sign() using the maximum RSA-PSS salt length by default
instead of the OpenSSL default. (adapik)
. Fixed feof() on a TLS stream staying false after a close_notify on Windows.
(Jakub Zelenka)
- PCNTL:
. Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while
an exception is pending. (nicolas-grekas)
. Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler
that throws. (nicolas-grekas)
. Fixed bug GH-23986 (/proc/self paths resolve to the parent process after
pcntl_fork()). (Lazizbek Ergashev)
- PDO:
. Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class
whose constructor arguments it rejects. (Ilia Alshanetsky)
. Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting
"array given" regardless of the value passed. (Ilia Alshanetsky)
. Fixed PDOStatement::bindParam() and bindColumn() leaking the driver
options value. (Ilia Alshanetsky)
. Fixed PDOStatement not reporting its bound parameters and columns to the
cycle collector. (Ilia Alshanetsky)
. Fixed PDOStatement::setFetchMode() not applying changes atomically.
(Ilia Alshanetsky)
. Fixed PDOStatement::execute() leaving the previous result available
after a failed execution. (Ilia Alshanetsky)
. Fixed a use-after-free when bindValue()/execute()/closeCursor() is called
from a bound parameter's __toString() during execute(). (Ilia Alshanetsky)
- PDO_DBLIB:
. Fixed bug GH-23741 (segfault after a failed query inside a PDO
transaction). Errors raised by beginTransaction(), commit(), rollBack()
and lastInsertId() are now reported instead of being dropped.
(Ilia Alshanetsky)
- PDO_PGSQL:
. Fixed crash when a persistent connection fails. (KentarouTakeda)
- Reflection:
. Fixed bug GH-23842 (ReflectionProperty::skipLazyInitialization() copies
invalid constant defaults with OPcache). (DirkTrunkstar, Lazizbek Ergashev)
- SimpleXML:
. Fixed reconstructing a SimpleXMLElement freeing a child element that
another variable still references. (Ilia Alshanetsky)
- SOAP:
. Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with
an illegal key). (David Carlier)
. Fixed memory leak when load_wsdl_ex() failed to load. (DanielEScherzer)
- Standard:
. Fixed sha1_file() returning a digest for incomplete data after a stream
read failure. (Ilia Alshanetsky)
. Fixed iptcembed() corrupting JPEG headers when called recursively from an
output handler. (Ilia Alshanetsky)
. Fixed proc_open() leaking descriptor zero when descriptor setup fails.
(Ilia Alshanetsky)
. Fixed StreamPollHandle changing unread_bytes of a TLS stream when it is
added to an Io\Poll\Context. (Jakub Zelenka)
. Fix wordwrap() ignoring an existing break at the end of the string
(Nicolas Grekas)
. Fixed convert.quoted-printable-decode decoding lowercase hex digits to
the wrong byte. (Ilia Alshanetsky)
- Tidy:
. Fixed a use-after-free when a tidyNode is used after its document is
reparsed. (Ilia Alshanetsky)
- Zip:
. Fixed bug GH-23899 (Assertion failure when a cancel callback returns an
invalid type during shutdown). (Weilin Du)
24 Sep 2026, PHP 8.6.0RC2
- Core:
. Fixed incorrect internal pointer and foreach iterator positions when
compacting arrays with holes. (Weilin Du)
. Fix handling of references to typed properties during unserialization
of various internal classes. (ndossche, timwolla)
. Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias)
. Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
. Fixed bug GH-23752 (Use scoped diagnostic suppression for the global
register declarations so the caller's -Wvolatile-register-var state is
restored). (yqtian-se)
. Fixed OSS-Fuzz #538730793 (Assertion failure when returning by-ref from
closure invoke). (ndossche)
. Fixed OSS-Fuzz #540904105 (ASSERT: ast->attr == T_CLASS_C). (ndossche)
- CLI
. Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
request activation). (matyhtf)
. Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD
request for a static file). (jakubskopal)
- Date:
. Fix unserialization of Time\Duration. (timwolla)
. Add comparison handler for Time\Duration. (timwolla)
- DOM:
. Fixed use-after-free when re-constructing a DOMXPath whose php:function
registrations are freed while still reachable from the cycle collector.
(Ilia Alshanetsky)
. Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and
MathML elements. (Ilia Alshanetsky)
. Fixed Dom\HTMLDocument giving attributes the namespace of their element
when a fragment is parsed with an xlink, xml or xmlns context element.
(Ilia Alshanetsky)
- Fileinfo:
. Upgrade to file 5.48. (Weilin Du)
- Intl:
. Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state
such as dateType, timeType, calendar and the message pattern.
(Ilia Alshanetsky)
. Fixed a crash when converting with a cloned UConverter that uses
toUCallback/fromUCallback. (Ilia Alshanetsky)
. Fixed Collator attribute and strength methods not rejecting an
unconstructed Collator. (Ilia Alshanetsky)
- Lexbor:
. Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a
heap buffer overflow in :lexbor-contains() parsing and buffer overflows
in malformed decode replay. (alexandre-daubois)
- MBString:
. Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
a truncated UTF-8 sequence). (Lazizbek Ergashev)
. Updated Unicode data tables to Unicode 18.0 (Yuya Hamada)
. Fixed mbstring functions emitting surrogates in UTF-8 output and flagging
it as valid UTF-8. (Nicolas Grekas)
- MySQLi:
. Fix GH-22854: Fixed failed assertion when accessing mysqli property after
failed reconnection. (Kamil Tekiela)
- Opcache:
. Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a
loop-invariant addition). (Ilia Alshanetsky)
. Fixed OSS-Fuzz #545352966 (default value AST of an SHM-persisted partial).
(ndossche)
- PDO:
. Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
column index. (Ilia Alshanetsky)
. Fixed PDOStatement::bindColumn() registering a binding for a column name
that is not in the result set. (Ilia Alshanetsky)
. Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a
transaction still in use by another instance). (Lazizbek Ergashev)
- PGSQL:
. Fixed pg_lo_write() rejecting data containing null bytes. (Ilia Alshanetsky)
- Posix:
. Reverted the validity check on the flags argument of posix_access().
(David Carlier)
- Readline:
. Fixed a heap over-read in the interactive shell prompt when cli.prompt is
set to an empty string. (Ilia Alshanetsky)
- Session:
. Fixed session_start() continuing after a failed create_sid() when
session.use_strict_mode rejects the supplied ID. (Ilia Alshanetsky)
. Fixed exceptions from user-defined create_sid() handlers being replaced
by return-value validation errors. (Ilia Alshanetsky)
- SPL:
. Fixed bug GH-23385 (SplDoublyLinkedList::serialize() use-after-free when
__serialize() removes an element). (David Carlier)
- SQLite:
. Fixed a crash when SQLite3::close() is called from a userland callback.
(Ilia Alshanetsky)
- Standard:
. Fixed bug #60110 (fclose(), file_put_contents(), copy() do not return false
properly). (Jakub Zelenka, Ilija Tovilo)
. Fixed three Windows-only proc_open() defects: an uninitialized
PROCESS_INFORMATION, an indeterminate comspec pointer after a failed
lookup, and an unchecked CreateFileA() failure. (Ilia Alshanetsky)
. Fix persistent stream context lifetime during shutdown (Levi Morrison)
. Fixed bug GH-23780 (unserialize('') fails silently). (timwolla)
- URI:
. Fix casing of enum cases in UriHostType and UrlHostType to match the RFC
and PHP’s naming policy. (timwolla)
- Zlib:
. Fixed inflate_init() dropping the preset dictionary for raw streams with
a non-default window. (Ilia Alshanetsky)
10 Sep 2026, PHP 8.6.0beta3
- BCMath:
. Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds
n_scale. (Ilia Alshanetsky)
- Core:
. Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection.
(Yudai Takada)
. Calling is_a() or is_subclass_of() with a string as the first argument
when $allow_string is false is now deprecated. (Daniel Scherzer)
. Fixed bug GH-23232 (lone namespace separator asks the autoloader for an
empty class name). (spawnia)
. Enabled the TAILCALL VM (--disable-gcc-global-regs) when building with GCC >= 16.
(henderkes)
- CLI:
. Fixed bug GH-23242 (PHP development server does not support Expect
100-continue flow control). (Sjoerd Langkemper)
- Calendar:
. Fixed *tojd() functions and cal_to_jd() truncating arguments outside the
int range instead of rejecting them. (lacatoire)
- DOM:
. Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching
the null namespace in spec-following mode. (Ilia Alshanetsky)
. Fixed stale getElementsByClassName() and other node list caches after
className/classList writes and attribute removals. (Ilia Alshanetsky)
. Fixed reference cycles through DOMXPath and XSLTProcessor php:function
callback arguments and return values not being collectable.
(Ilia Alshanetsky)
- Hash:
. Fixed hash_file() reporting argument #1 ($algo) instead of argument #2
($filename) when the filename contains null bytes. (lacatoire)
- Intl:
. Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle
returning UTF-16 offsets instead of grapheme offsets. (Ilia Alshanetsky)
. Fixed a memory leak when dumping IntlCalendar instances. (Ilia Alshanetsky)
. Fixed Collator::sortWithSortKeys() allocating fixed 2MiB buffers
regardless of array size. (Ilia Alshanetsky)
. Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator()
results. (iliaal)
. Fixed a leak in Locale::getKeywords() when a keyword value cannot be
read. (iliaal)
. Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed
from compiled rules. (iliaal)
. Fixed Spoofchecker methods not recording the ICU error code when an ICU
call fails. (Ilia Alshanetsky)
. Fixed idn_to_ascii() and idn_to_utf8() reporting argument #2 ($flags)
instead of argument #3 ($variant) for an invalid IDNA variant, and the
domain length error message printing a literal "d" instead of the limit.
(lacatoire)
- MBString:
. Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the
replacement when a \k<name> backref has no closing delimiter.
(Ilia Alshanetsky)
- ODBC:
. Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type()
returning uninitialized memory when SQLColAttribute fails.
(Ilia Alshanetsky)
. odbc_error() and odbc_errormsg() now also report SQLColAttribute
failures. (Ilia Alshanetsky)
- PCNTL:
. Fixed the declared signature of pcntl_signal(), whose $restart_syscalls
argument accepts null and defaults to it. (lacatoire)
- PDO_PGSQL:
. Added Pdo\Pgsql::ATTR_CHUNK_SIZE to fetch a result set in chunks of the
given number of rows. (KentarouTakeda)
- PGSQL:
. Fixed the pg_insert(), pg_update() and pg_delete() flag error messages,
which did not name the set of flags actually accepted. (lacatoire)
- Phar:
. Fixed bug GH-23418 (Use-after-free when looking up mounted directories).
(Weilin Du)
. Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).
(Weilin Du)
- Sockets:
. Fixed socket_set_option() with SO_ATTACH_REUSEPORT_CBPF and a zero value,
which detached the classic BPF filter instead of the reuseport program.
(David Carlier)
- SOAP:
. Fixed WSDL cache corruption when a soap:header defines headerfaults.
(Ilia Alshanetsky)
. Fixed stack overflow when parsing a WSDL with self-referential schema
groups or attributeGroups. (Ilia Alshanetsky)
- Sodium:
. Added support for the libsodium 1.0.22 KEM APIs (X-Wing and ML-KEM768).
(Zachary DuBois)
- Standard:
. Fixed a segfault when a stream filter callback unsets StreamBucket::$data
before re-attaching the bucket. (iliaal)
. Fixed an out-of-bounds read when following a redirect response with an
empty Location header. (iliaal)
. Fixed read buffer compaction in php_stream_filter_flush(). (crystarm)
. Io\Poll\Context::wait() now rejects a $maxEvents value greater than
INT_MAX instead of truncating it. (marc-mabe)
. Fixed GH-23338 (fsockopen()/pfsockopen() ValueError reported wrong
argument number for $timeout). (lacatoire)
. Fixed bug GH-23576 (Next index for array returned from array_keys() is
wrong). (Lazizbek Ergashev)
- SimpleXML:
. Fixed writing to a dimension of the object returned by attributes() not
creating the attribute. (Ilia Alshanetsky)
. Fixed child elements of the element returned by
SimpleXMLElement::addChild() not being accessible by property name when
namespaces are involved. (Ilia Alshanetsky)
- Streams:
. Added so_rcvbuf and so_sndbuf stream socket context options, setting the
socket receive and send buffer sizes in bytes. (David Carlier)
27 Aug 2026, PHP 8.6.0beta2
- Core:
. Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or
next() call on the inner generator). (iliaal)
. Fixed GH-10497 (Allow direct mutation of objects stored in constants or
class constants via OBJ->prop = $val). (Khaled Alam)
. Reverted GH-22833, which attempted to fix bug GH-18985. (ilutov)
. Using the return statement in a finally block is now deprecated.
(aldemeery)
- Curl:
. Set content length using CURLOPT_POSTFIELDSIZE_LARGE instead of
CURLOPT_POSTFIELDSIZE. This makes it possible to post strings larger than
2GB on some platforms, e.g. Windows. (Sjoerd Langkemper)
- DOM:
. Fixed a typo in the DOMException message for INUSE_ATTRIBUTE_ERR.
(Weilin Du)
. Fixed bug GH-22624 (use-after-free via DOMNameSpaceNode after
DOMDocument::xinclude()). (David Carlier)
. Fixed a use-after-free when cloning a DOMNameSpaceNode after
DOMDocument::xinclude(). (iliaal)
. Fixed a crash in DOMXPath when a php:function callback receives a nodeset
and a later callback returns a node from another document. (iliaal)
. Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children
that still have a live wrapper). (iliaal)
. Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the
value of an attribute whose child still has a live wrapper. (iliaal)
- GD:
. Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the
wrong argument in error messages. (Weilin Du)
. Fixed imageaffinematrixget() to enforce the documented array|float type
for the $options parameter. (Weilin Du)
- Intl:
. Fixed grapheme_strrev() treating UBRK_DONE as a byte index and leaving
the result without a terminating NUL. (iliaal)
. Fixed a double-free when IntlGregorianCalendar construction fails after
the ICU constructor adopts the TimeZone. (iliaal)
. Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions
for UTF-8 strings). (ColumbusLabs)
. Fixed Locale::parseLocale() reading past a trailing '-' or '_'.
(iliaal, Xuyang Zhang)
. Fixed grapheme_str_split() treating UBRK_DONE as a byte index. (iliaal)
- Opcache:
. Fixed a tracing JIT crash when compiling a side trace for a method of a
class that could not be stored in the inheritance cache. (GH-21710)
(Arnaud, iliaal)
- PDO:
. Fixed a leak when a persistent connection failed a liveness check
with no other live PDO handle. (iliaal)
- PDO_PGSQL:
. Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite
loop when cleaning up a fetch left in a COPY, a use-after-free when a
statement with emulated or disabled prepares is destroyed, a connection
left busy for the next fetch, and rows delivered from a result another
statement took over. (KentarouTakeda)
- PGSQL:
. Fixed the class name casing of pg_close_stmt()'s connection parameter.
(lacatoire)
- Phar:
. Fixed Phar archives being automatically detected when ".phar" only occurs
in a directory name or is not a filename extension in an included file's
path. (Weilin Du)
- Readline:
. Fixed class constant completion in the interactive shell. (Weilin Du)
- Zip:
. Fixed bug GH-23276 (ZipArchive subclass storing its own stream cannot be
garbage collected). (Weilin Du, ndossche)
- SAPI:
. Fixed fuzzer targets failing to build in isolation. (Mrmaxmeier)
. Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo)
- Session:
. Fixed bug GH-23056 (missing handler name in session write warning).
(lazerg)
. SessionHandler::validateId() is now implemented, so
session.use_strict_mode applies to the built-in handler. (Girgias)
. It is now deprecated to pass an object that does not implement the
create_sid() and validateId() methods. (Girgias)
. A deprecation is now emitted when implementing SessionHandlerInterface on a
class which doesn't define the create_sid() or validateId() methods, as
those will be moved from SessionUpdateTimestampHandlerInterface and
SessionIdInterface to SessionHandlerInterface. (Girgias)
- SNMP:
. It is now possible to use the AES192, AES192C, AES256, and AES256C as
SNMPv3 security protocols if the underlying library supports them.
(eskyuu)
. It is now possible to reset the MIB tree using the new snmp_init_mib()
function. (eskyuu)
. Additional MIB parsing and output control functionality has been exposed
via the snmp_set_mib_option(), snmp_set_output_option(),
snmp_set_string_output_format() functions, the $numeric_index,
$numeric_timeticks, $extended_index, $dont_print_units, $escape_quotes,
$print_hex_text SNMP properties, and the SNMP::setOidOutputFormat(),
SNMP::setStringOutputFormat() methods. (eskyuu)
- Sodium:
. Fixed incorrect parameter name in sodium_add(), sodium_memcmp(), and
sodium_compare() length-mismatch error messages. (lacatoire)
- SPL:
. The following SplFileObject methods have been deprecated
SplFileObject::fgetcsv(), SplFileObject::fputcsv(),
SplFileObject::setCsvControl(), and SplFileObject::getCsvControl().
(Girgias)
- Standard:
. Fixed incorrect parameter name in convert_uudecode() warning. (lacatoire)
. Added support for the "<" and ">" endianness modifiers in pack() and
unpack() format codes. (alexandre-daubois)
- Zip:
. Fixed bug GH-17787 (ZipArchive stream stops reading early when the archive
is freed while the stream is still open). (Eyüp Can Akman)
- Zlib:
. Fixed bug GH-22142 (Assertion failure in deflate_init() when an option
object has uninitialised typed properties). (David Carlier)
13 Aug 2026, PHP 8.6.0beta1
- Core:
. Deprecated "namespace" as a class constant name. (NickSdot)
. Changed run-tests.php to run in parallel by default, using up to 10
automatically detected workers. Pass -j1 for sequential execution.
(NickSdot)
. Allowed readonly properties to declare default values. (NickSdot)
. Changed run-tests.php to run test subprocesses without a shell where
possible. (NickSdot)
. Fixed GH-23083 (SEGV build_trace_args in zend_exceptions.c with
-d error_include_args=On). (David Carlier)
. Fixed GH-23121 (is_callable() wrongly accepts objects with no get_closure
handler). (David Carlier)
. Passing a 3rd argument to define() is now deprecated. (Girgias)
. Naming a function readonly is now deprecated. (Girgias)
. Added stateless closure cache. (ilutov)
- BZ2:
. Passing an object for the Bzip2 {de}compression stream filter is now
deprecated. Use get_object_vars() on the object instead. (Girgias)
- Curl:
. Improved cURL option validation errors to include the option name.
(Sjoerd Langkemper)
. Raise a value error when the callback registered with CURLOPT_READFUNCTION
returns an unexpected long. (Sjoerd Langkemper)
. Fix bug GH-16513 (curl: exceptions in callbacks do not abort the request).
(Sjoerd Langkemper)
- Date:
. Update timelib to 2026.02. (Derick, timwolla)
. Added Time\Duration. (timwolla, Derick)
- DOM:
. Fixed bug GH-23116 (Stack overflow when normalizing a deeply nested
DOMDocument). (Lazizbek Ergashev)
. Fixed bug GH-23117 (Stack overflow when normalizing a deeply nested
Dom\XMLDocument). (Lazizbek Ergashev)
- Exif:
. Fixed exif_read_data() allocating a HEIF meta box larger than the file
it came from. (iliaal)
- GMP:
. Added optional $definitely_prime output parameter to gmp_prevprime().
(Weilin Du)
. Added gmp_powm_sec(). (Weilin Du)
- Intl:
. Added static methods IntlDatePatternGenerator::getSkeleton() and
IntlDatePatternGenerator::getBaseSkeleton(). (Weilin Du)
. Fixed Collator::sort(), collator_sort(), Collator::asort(), and
collator_asort() to report UTF-8/UTF-16 conversion errors through the intl
error handler instead of emitting a warning and continuing with an empty
string. (Weilin Du)
. Fixed IntlListFormatter::__construct() leaving stale global error state
after successful calls. (Weilin Du)
. Fixed IntlNumberRangeFormatter leaving stale global error state after
successful createFromSkeleton() and format() calls. (Weilin Du)
. Implemented GH-20255 (Add a predefined calendar constant in
IntlDateFormatter for the proleptic gregorian calendar). (David Carlier)
. Added SpoofChecker::areBidiConfusable(). (David Carlier)
. Added SpoofChecker::getBidiSkeleton(). (Weilin Du)
. Added SpoofChecker::getSkeleton(). (David Carlier)
. Fixed IntlNumberRangeFormatter::format() crash when the formatting fails.
(David Carlier)
- MbString:
. Passing objects to mb_convert_variables() is now deprecated. (Girgias)
- MySQLi:
. The mysqli_get_charset() function and mysqli::get_charset() method are now deprecated. (Kamil Tekiela)
. The mysqli_stmt_init() function and mysqli::stmt_init() method are now deprecated. (Kamil Tekiela)
. Instantiation of mysqli_stmt without providing the $query parameter is now deprecated. (Kamil Tekiela)
- PDO:
. Fixed pdo_raise_impl_error() emitting a warning under ERRMODE_SILENT.
(iliaal)
- PDO_ODBC:
. Fixed bug GH-23016 (NULL values in long columns come back as garbage
binary strings). (Calvin Buckley, iliaal)
- Readline:
. Fixed the interactive shell not waiting for the pager process to exit.
(Weilin Du)
- Reflection:
. Added ReflectionAttribute::inNamespace(),
ReflectionAttribute::getNamespaceName(), and
ReflectionAttribute::getShortName(). (Girgias)
. Fixed bug GH-22905 (Reflection exception messages truncate on null bytes).
(DanielEScherzer)
. Fixed ReflectionProperty::isLazy() and skipLazyInitialization() using the
parent slot when a child class hooks an inherited property. (iliaal)
. Fixed segfault in ReflectionMethod::createFromMethodName() on an
uninstantiable subclass. (iliaal)
- SimpleXML:
. Fixed integer element offsets that cannot resolve aliasing an existing
element. (iliaal)
. SimpleXMLElement::__construct() now raises a ValueError when the $data
argument contains NUL bytes. (iliaal)
. Fixed segfault when comparing uninitialized SimpleXMLElement
instances. (iliaal)
- SPL:
. The spl_classes() function is now deprecated, use
ReflectionExtension::getClassNames() instead. (Girgias)
. The spl_object_hash() function is now deprecated, use spl_object_id()
instead. (Girgias)
. The following ArrayIterator methods are now deprecated:
* ArrayIterator::getFlags()
* ArrayIterator::setFlags()
* ArrayIterator::asort()
* ArrayIterator::ksort()
* ArrayIterator::uasort()
* ArrayIterator::uksort()
* ArrayIterator::natsort()
* ArrayIterator::natcasesort()
* ArrayIterator::unserialize()
* ArrayIterator::serialize()
(Girgias)
- Standard:
. Passing an object as the $data argument to http_build_query() is now
deprecated. The interpretation of object values within $data as arrays
is also deprecated. Convert objects to arrays with get_object_vars()
before calling the function. (Girgias)
. Added the "filter.max_filter_count" stream context option for php://filter
URLs. Using more than 16 filters without configuring this option is now
deprecated. (Sjoerd Langkemper)
. The metaphone() function is now deprecated, use a userland phonetic
matching library instead. (Weilin Du)
. Improved performance of array_intersect(). (mehmetcansahin)
. Fixed bug GH-23006 (phpcredits() full-page HTML title says phpinfo()).
(Weilin Du)
. The following functions now raise a ValueError when the $filename argument
contains NUL bytes: fileperms(), fileinode(), filesize(), fileowner(),
filegroup(), fileatime(), filemtime(), filectime(), filetype(),
is_writable(), is_readable(), is_executable(), is_file(), is_dir(),
is_link(), file_exists(), lstat(), stat(). (Girgias)
. Fixed bug GH-22818 (stream_filter_register() orphaned user_filter_map on
shutdown re-registration). (David Carlier)
. Io\Poll\Context::wait() now takes a Time\Duration object as a timeout.
(timwolla)
. Passing an object to array_walk{_recursive} is now deprecated. Use
get_object_vars() on the object instead. (Girgias)
. The is_double() function is now deprecated, use is_float() instead.
(Girgias)
. The is_long() and is_integer() functions are now deprecated, use is_int()
instead. (Girgias)
. The doubleval() function is now deprecated, use floatval() instead.
(Girgias)
. The strcoll() function is now deprecated, use Collator::compare() instead.
(Girgias)
. The SORT_LOCALE_STRING constant for the family of sort functions is now
deprecated, use one of the following functions instead:
* Collator::asort()
* Collator::sort()
* Collator::sortWithSortKeys()
(Girgias)
- Streams:
. Fixed file_put_contents() LOCK_EX early return leaking stream error
operation depth. (iliaal)
- XSL:
. Fixed use-after-free when a DOMDocument subclass __clone() retains the
stylesheet copy made by XSLTProcessor::importStylesheet(). (iliaal)
- Zlib
. Passing an object for the zlib deflate and inflate stream filter is now
deprecated. Use get_object_vars() on the object instead. (Girgias)
. Passing an object to the $option argument to deflate_init and inflate_init
is now deprecated. Use get_object_vars() on the object instead. (Girgias)
30 Jul 2026, PHP 8.6.0alpha3
- Core:
. Implemented partial function application RFC. (Arnaud)
. Fixed bug GH-22263 (reset typed property default on every unserialize
failure path). (David Carlier)
. Fixed bug GH-18985 (Wrong line numbers for match with constant arms).
(ilutov)
. Fixed bug GH-18847 (SEGV in zend_fetch_debug_backtrace() when the memory
limit is reached while the tracing JIT enters a call frame). (Arnaud,
iliaal)
- DOM:
. Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD
declares a default value for the attribute). (iliaal)
. Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes
with DOMNode::isEqualNode()). (Weilin Du)
- Embed:
. Made php-cli functionality available in embed builds. (henderkes)
- GMP:
. Added gmp_prevprime(). (Weilin Du, David Carlier)
. Fixed GMP power and shift operators to reject GMP right operands outside
the unsigned long range instead of silently truncating them. (Weilin Du)
. Fixed GMP integer string parsing to reject strings containing NUL bytes
instead of silently truncating them. (Weilin Du)
. Fixed GMP error messages that referenced outdated parameter names.
(Weilin Du)
- Intl:
. Fixed grammatical issues in Normalizer invalid form and IntlCalendar time
zone offset error messages. (Weilin Du)
. Removed the dependency on the ICU IO library. (Weilin Du)
- ODBC:
. Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the
driver-reported display size). (iliaal)
- Opcache:
. Re-enable JIT for ZTS builds on Apple Silicon. (realFlowControl)
- PDO_ODBC:
. Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the
driver-reported display size). (iliaal)
. Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is
longer than the declared maxlen). (iliaal)
. Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a
diagnostic message length beyond the error buffer). (iliaal)
- Phar:
. Fixed grammatical issues and outdated terminology in Phar error messages.
(Weilin Du)
- Reflection:
. Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
(DanielEScherzer)
- SOAP:
. Fixed header injection through the Content-Type context option, the
soapaction and the cookie names and values. (David Carlier)
. Fixed the SoapClient and SoapServer "classmap" option to reject arrays
containing integer keys, and made SoapClient throw TypeError/ValueError
for invalid "classmap" options. (Weilin Du, David Carlier)
- MBString:
. Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative
offset in a non-UTF-8 encoding). (Eyüp Can Akman)
. Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi()
invalidates the regex cache). (Matthias Goergens)
- PCRE:
. Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is
now forbidden. (Arnaud)
- Sockets:
. Fixed socket_set_option() validation error messages for UDP_SEGMENT and
TCP_USER_TIMEOUT, and SO_LINGER options. (Weilin Du)
. Fixed various memory related issues in ext/sockets. (David Carlier)
- Standard:
. Fixed setlocale() to reject locale names containing NUL bytes instead of
silently truncating them, and to reject arrays passed after the $locales
argument or additional arguments passed after an array $locales argument.
(Weilin Du)
- Streams:
. Added a new IO copy API used by php_stream_copy_to_stream_ex() that
leverages platform primitives (sendfile, splice, copy_file_range,
TransmitFile) for faster stream copying. (Jakub Zelenka, David Carlier)
. Fixed bug GH-22841 (php_stream_copy_to_stream_ex() drops progress
notifications when using the copy fast path). (David Carlier)
. Fixed bug GH-15836 (Use-after-free when a user stream filter accesses
$this->stream during the close flush). (iliaal)
16 Jul 2026, PHP 8.6.0alpha2
- Core:
. Sync Boost.Context assembly with 1.91.0. (kn1g78)
. Fixed bug GH-22387 (AST pretty-printing drops meaningful parentheses around
RHS of instanceof). (timwolla)
. Fixed bug GH-15672 and GH-15911 (Stack overflow when an internal function
recurses through zend_call_function, such as a self-attached SPL
iterator). (iliaal)
. Lock unmodified readonly properties for modification after clone-with.
(NickSdot)
. abort() instead of exit() on hard OOM. (realFlowControl)
. perf: ZTS: move AG and SCNG into native __thread storage. (henderkes)
- Calendar:
. Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
INT_MAX year). (arshidkv12)
- Curl:
. Added CURLOPT_SEEKFUNCTION and the CURL_SEEKFUNC_OK, CURL_SEEKFUNC_FAIL
and CURL_SEEKFUNC_CANTSEEK constants, letting libcurl rewind a streamed
request body to resend it on a redirect, multi-pass authentication or a
retried reused connection. (GrahamCampbell)