Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:123116
Precedence: bulk
MIME-Version: 1.0
References: <7051f9b8-6b03-4820-bc26-d3f12949c418@php.net> <ZhgH9GzNH8EMl0m_@castor>
 <0dd463e0-1cd6-4ad9-8a63-bf6bb02a9b17@php.net>
In-Reply-To: <0dd463e0-1cd6-4ad9-8a63-bf6bb02a9b17@php.net>
Date: Thu, 11 Apr 2024 22:02:51 +0100
Message-ID: <CAEKnhAGf3Rtj5O=RkSXtYow-841Bb4Uc4G6vJ=0GjGTrbDFU9g@mail.gmail.com>
Subject: Re: [PHP-DEV] PHP 8.3.6 Released
To: ericmann@php.net
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary="000000000000192ca20615d87b7e"
From: bukka@php.net (Jakub Zelenka)

--000000000000192ca20615d87b7e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Apr 11, 2024 at 5:10=E2=80=AFPM <ericmann@php.net> wrote:

> On 4/11/24 08:55, Athos Ribeiro wrote:
>
> On Thu, Apr 11, 2024 at 08:03:31AM -0700, ericmann@php.net wrote:
>
> The PHP development team announces the immediate availability of PHP
> 8.3.6. This is a security release that addresses CVE-2024-1874,
> CVE-2024-2756, CVE-2024-3096, and CVE-2024-2757.
>
>
> Thank you!!!
>
> May I ask what happened to 8.3.5 and why it was never released?
>
> --
> 8.3.5 was frozen at the RC1 stage and we elected to include the fixes for
> the aforementioned CVEs in this release, bumping things instead to 8.3.6 =
to
> avoid any confusion as to why someting was in a stable release that
> *wasn't* included in the RC. This is rare but does happen.
>

Just to add bit more details here. There was a regression in one of the fix
that caused failure for the Windows build. This was missed in time because
CI is not currently running on PR's in private forks for security fixes. We
are looking into setting up private repo that would run CI instead of using
GitHub private forks created in the advisories. That should hopefully
prevent those skips.

Regards

Jakub

--000000000000192ca20615d87b7e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Thu, Apr 11, 2024 at 5:10=E2=80=AFPM &=
lt;<a href=3D"mailto:ericmann@php.net">ericmann@php.net</a>&gt; wrote:<br><=
/div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"=
margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-lef=
t:1ex"><u></u>

 =20
   =20
 =20
  <div>
    <div>On 4/11/24 08:55, Athos Ribeiro wrote:<br>
    </div>
    <blockquote type=3D"cite">On Thu,
      Apr 11, 2024 at 08:03:31AM -0700, <a href=3D"mailto:ericmann@php.net"=
 target=3D"_blank">ericmann@php.net</a> wrote:
      <br>
      <blockquote type=3D"cite">The PHP development team announces the
        immediate availability of PHP 8.3.6. This is a security release
        that addresses CVE-2024-1874,
        <br>
        CVE-2024-2756, CVE-2024-3096, and CVE-2024-2757.
        <br>
      </blockquote>
      <br>
      Thank you!!!
      <br>
      <br>
      May I ask what happened to 8.3.5 and why it was never released?
      <br>
      <br>
    </blockquote>
    <div>-- <br>
      8.3.5 was frozen at the RC1 stage and we elected to include the
      fixes for the aforementioned CVEs in this release, bumping things
      instead to 8.3.6 to avoid any confusion as to why someting was in
      a stable release that <i>wasn&#39;t</i> included in the RC. This is
      rare but does happen.<br></div></div></blockquote><div><br></div><div=
>Just to add bit more details here. There was a regression in one of the fi=
x that caused failure for the Windows build. This was missed in time becaus=
e CI is not currently running on PR&#39;s in private forks for security fix=
es. We are looking into setting up private repo that would run CI instead o=
f using GitHub private forks created in the advisories. That should hopeful=
ly prevent those skips.</div><div><br></div><div>Regards</div><div><br></di=
v><div>Jakub</div></div></div>

--000000000000192ca20615d87b7e--