Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:129682 X-Original-To: internals@lists.php.net Delivered-To: internals@lists.php.net Received: from php-smtp4.php.net (php-smtp4.php.net [45.112.84.5]) by lists.php.net (Postfix) with ESMTPS id 6FCFC1A00BC for ; Tue, 23 Dec 2025 13:53:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=php.net; s=mail; t=1766498044; bh=NhypUFLZyawFdY29aWElTvrmrEmNiGdPn0+1lRoFN9s=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=BzrFDrDlkJYBMsfTJNhddLkoLrYG+Uq/vTNUODCUeIhofmTT1I4IF7zcI/oD6UrU2 6zX/9wMSUUuSOZixmPQoN39TwjNxtCd3IXx58ZTAfkNdNQDSDF7WdqgxrbWB0aGcjt fBGaTBFgduA5S5Idj2ydqsCgVUN1VRLgiMivTE77/pnWVEj1Cv1JHRa7vXY0/F/yHr DMuR9h6PDTTqrh4KTvp4+Hp4MBd+N+SlohOsJnDJRQz2KuhvIhMlYxPGeQ8Lwv8tqY YizIu2CbxDlE+82Zbnp3mMsnaBOYOhXAwJAT56VO9Ate3l26iGlwa3TM7BDQGm0p1r 2kSOjTu5F87IA== Received: from php-smtp4.php.net (localhost [127.0.0.1]) by php-smtp4.php.net (Postfix) with ESMTP id AEE82180084 for ; Tue, 23 Dec 2025 13:54:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on php-smtp4.php.net X-Spam-Level: X-Spam-Status: No, score=0.6 required=5.0 tests=BAYES_50,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,DMARC_MISSING,HTML_MESSAGE, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=4.0.1 X-Spam-Virus: No X-Envelope-From: Received: from venus.thgnet.it (venus.thgnet.it [159.69.22.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by php-smtp4.php.net (Postfix) with ESMTPS for ; Tue, 23 Dec 2025 13:54:01 +0000 (UTC) Received: from mail-lj1-f179.google.com (mail-lj1-f179.google.com [209.85.208.179]) by venus.thgnet.it (Postfix) with ESMTPSA id 3BF763EFA4 for ; Tue, 23 Dec 2025 14:53:55 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=giacobbi.net; s=venus; t=1766498035; bh=aqHVZHehbdcVSM71I3bMQ8IvumVsgf9NpEzqYRNnwQY=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=pEk2pT1mYG2ScSVkQvYPYRL8TxwlNi8pIzmnKoAq1oNqdOpT70c1b2/r8AIlCGTHw zsMKTym5YrRK0bHwk/yODeefNiunHxMpi50xE2o2+pCqXuYh7Z5y5jKlxF9+q3tWpP kL+3XfqBSM0v9nljgCNJa9byGdVyKUtew+3HPAZE= Received: by mail-lj1-f179.google.com with SMTP id 38308e7fff4ca-37b983fbd45so38784191fa.3 for ; Tue, 23 Dec 2025 05:53:55 -0800 (PST) X-Gm-Message-State: AOJu0Yw0iEuGm1yaOmB2GIAlqrGQHFTV7bxXkNA234lgyrz0Zl29QQ3K wPme8902HryLDLY8vWLpN5a+widClqPesGKPc7cWrHVjiywsegTdiSZgNyj5qD2ncMvSVh0fPe5 HSckPOru1S5ylhH/x6CB7W4k0WhsAMqk= X-Google-Smtp-Source: AGHT+IEUgfOxIvRPiJJ2NO8lFBhA+9Be5vUm8obG5RQxSE7txHS4pMdcajHU5ljdAuq1tjIkOz+e0brr8/wWozOUKyA= X-Received: by 2002:a2e:ac13:0:b0:37f:cb34:211b with SMTP id 38308e7fff4ca-381215ab664mr37644801fa.18.1766498034723; Tue, 23 Dec 2025 05:53:54 -0800 (PST) Precedence: list list-help: list-unsubscribe: list-post: List-Id: x-ms-reactions: disallow MIME-Version: 1.0 References: <3E423B92-A598-4A25-9A32-D3CA7D787501@php.net> In-Reply-To: <3E423B92-A598-4A25-9A32-D3CA7D787501@php.net> Date: Tue, 23 Dec 2025 14:53:42 +0100 X-Gmail-Original-Message-ID: X-Gm-Features: AQt7F2pEDh5PICRXYMtiwGrdaIuqoD1YcshXY2MVTPIVBlNS-CXmY1zrgeWH2kc Message-ID: Subject: Re: [PHP-DEV] PHP 8.4.16 Released! To: Saki Takamachi Cc: internals@lists.php.net Content-Type: multipart/alternative; boundary="000000000000db3aed06469edff3" From: giovanni@giacobbi.net (Giovanni Giacobbi) --000000000000db3aed06469edff3 Content-Type: text/plain; charset="UTF-8" On Fri, 19 Dec 2025 at 01:07, Saki Takamachi wrote: > The PHP development team announces the immediate availability of PHP > 8.4.16. This is a security release. > > In the git repository, there are some oddities with the patch-level branch `PHP-8.4.16` used for the corresponding release: It contains a cherry-picked commit `cbb854f0260` that **did not** make into the actual release (tag `php-8.4.16`), and consequently, the release tag does not contain the patch-level branch, which normally does (or should). * | | | 51f4450b47d Merge branch 'PHP-8.3' into PHP-8.4 |\ \ \ \ | |/ / / | * | | ff51ac161d6 Fix GH-20603 issue on windows 32 bits. * | | | baf193fc0de Merge branch 'PHP-8.3' into PHP-8.4 |\ \ \ \ | |/ / / | * | | 0106134bb92 Merge branch 'PHP-8.2' into PHP-8.3 | |\ \ \ | | |/ / | | * | fe070fcc756 Fix yet another xml deprecation * | | | 2ec8c29fda7 PHP-8.4 is now for PHP 8.4.17-dev | | | | * 2890cbbc494 (tag: php-8.4.16) Update versions for PHP 8.4.16 | | | | * 769a8807d99 Update NEWS with info about security issues | | | | * 7ac9c40f67e Fix GHSA-www2-q4fc-65wf | | | | * e6d7d34c1ae Fix GHSA-h96m-rvf9-jgm2 | | | | * d521259e442 Fix GHSA-8xr5-qppj-gvwj: PDO quoting result null deref | |_|_|/ |/| | | | | | | * cbb854f0260 (upstream/PHP-8.4.16) Fix GH-20603 issue on windows 32 bits. <<--- | |_|_|/ |/| | | * | | | 78e3d05d7de Merge branch 'PHP-8.3' into PHP-8.4 <<--- I believe the `PHP-8.4.16` branch should be force-pushed to `78e3d05d7de`, which is the most common ancestor with `PHP-8.4`, or to `7ac9c40f67e` if you wish to include the security patches, but definitely not to `cbb854f0260` as that commit is not in the released tarballs! (this caused some oddities in my setup as I usually merge the patch branch with the tag in my local repository). --000000000000db3aed06469edff3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, 19 Dec 2025 at 01:07, Saki Takama= chi <saki@php.net> wrote:
The PHP development team announces the immediate = availability of PHP
8.4.16. This is a security release.


In t= he git repository, there are some oddities with the patch-level branch `PHP= -8.4.16` used for the corresponding release: It contains a cherry-picked co= mmit `cbb854f0260` that **did not** make into the actual release (tag `php-= 8.4.16`), and consequently, the release tag does not contain the patch-leve= l branch, which normally does (or should).

= * | | | =C2=A0 51f4450b47d Merge branch 'PHP-8.3' into PHP-8.4
|= \ \ \ \ =C2=A0
| |/ / / =C2=A0
| * | | ff51ac161d6 Fix GH-20603 issue= on windows 32 bits.
* | | | =C2=A0 baf193fc0de Merge branch 'PHP-8.= 3' into PHP-8.4
|\ \ \ \ =C2=A0
| |/ / / =C2=A0
| * | | =C2=A0= 0106134bb92 Merge branch 'PHP-8.2' into PHP-8.3
| |\ \ \ =C2=A0=
| | |/ / =C2=A0
| | * | fe070fcc756 Fix yet another xml deprecation<= br>* | | | 2ec8c29fda7 PHP-8.4 is now for PHP 8.4.17-dev
| | | | * 2890c= bbc494 (tag: php-8.4.16) Update versions for PHP 8.4.16
| | | | * 769a88= 07d99 Update NEWS with info about security issues
| | | | * 7ac9c40f67e = Fix GHSA-www2-q4fc-65wf
| | | | * e6d7d34c1ae Fix GHSA-h96m-rvf9-jgm2| | | | * d521259e442 Fix GHSA-8xr5-qppj-gvwj: PDO quoting result null der= ef
| |_|_|/ =C2=A0
|/| | | =C2=A0
| | | | * cbb854f0260 (upstream= /PHP-8.4.16) Fix GH-20603 issue on windows 32 bits.=C2=A0 =C2=A0<<---=
| |_|_|/ =C2=A0
|/| | | =C2=A0
* | | | =C2=A0 78e3d05d7de Merge = branch 'PHP-8.3' into PHP-8.4=C2=A0 =C2=A0<<---
I believe the `PHP-8.4.16` branch should be force-pushed to `78e3d05d7de`,= which is the most common ancestor with `PHP-8.4`, or to `7ac9c40f67e` if y= ou wish to include the security patches, but definitely not to `cbb854f0260= ` as that commit is not in the released tarballs! (this caused some odditie= s in my setup as I usually merge the patch branch with the tag in my local = repository).

--000000000000db3aed06469edff3--