Latest PECL Releases:

• gRPC 1.85.0RC1
  - gRPC Core 1.85.0 update

• zephir_parser 2.9.1
  ### Fixed - Fixed a union-typed property failing to parse with `{ get, set }` shortcuts or an all-caps name ([zephir-lang/zephir#2761](https://github.com/zephir-lang/zephir/issues/2761))
• zephir_parser 2.9.0
  ### Added - Support `a instanceof static` (late static binding). The right operand is a variable named `static`, the shape `instanceof self` and `instanceof parent` already have, and `a instanceof static::m()` still parses as before ([zephir-lang/zephir#2714](https://github.com/zephir-lang/zephir/issues/2714))
• Judy 2.8.0
  - SECURITY FIX: appending to a string-keyed array ($j[] = ...) no longer crashes; the append guard now enumerates all seven string-keyed types, including Judy::STRING_TO_ENTRY (#217). - SECURITY FIX: forEach()/filter()/map() on Judy::STRING_TO_ENTRY read each value through the entry accessor instead of reinterpreting a cache-entry struct as a zval (out-of-bounds read / crash); equals() gained a matching ENTRY branch (#217). - SECURITY FIX: set() rejects keys longer than the 64 KB key buffer before taking a slot, closing a heap overflow reachable through an oversized key; deleteRange() on string-keyed ENTRY arrays now frees the cache-entry struct and its value reference instead of leaking both (#217). - FIX: expired STRING_TO_ENTRY values are hidden from reads and traversals (iterator, get, keys/values/toArray) while count()/size() stay raw-counter O(1) until pruneExpired(). mergeWith() copies TTL and flags verbatim, and get_gc() collects stored ENTRY values so value cycles are collectable (#217). - FIX: wrong-category range bounds now throw TypeError instead of silently coercing to a wrong-range read: int-keyed keys()/values()/toArray()/size()/ slice() reject non-numeric string bounds, and string-keyed deleteRange() rejects integer bounds (#217). - FIX: __unserialize() validates the serialized type, payload shape and optimizeIteration flag strictly before touching the object, so a malformed payload throws without destroying or corrupting an already-populated array, and an out-of-range type throws instead of emitting an E_WARNING (#225).
• mongodb 1.21.11
  ## What's Changed ### Other Changes * Exclude OCSP tasks from PR checks by @kevinAlbs in https://github.com/mongodb/mongo-php-driver/pull/2125 * PHPC-2774: Pin all GitHub Actions to exact release tags by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2121 * Align the v1.21 CI configuration with v2.1 and v2.5, and pin all GitHub Actions by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2129 * Upgrade libmongoc by @paulinevos in https://github.com/mongodb/mongo-php-driver/pull/2148

  Full Changelog: https://github.com/mongodb/mongo-php-driver/compare/1.21.10...1.21.11

• mongodb 2.1.11
  ## What's Changed ### Other Changes * Exclude OCSP tasks from PR checks by @kevinAlbs in https://github.com/mongodb/mongo-php-driver/pull/2125 * PHPC-2774: Pin all GitHub Actions to exact release tags by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2121 * Align the v1.21 CI configuration with v2.1 and v2.5, and pin all GitHub Actions by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2129 * Upgrade libmongoc by @paulinevos in https://github.com/mongodb/mongo-php-driver/pull/2148 * remove stray build files by @kevinAlbs in https://github.com/mongodb/mongo-php-driver/pull/2151

  Full Changelog: https://github.com/mongodb/mongo-php-driver/compare/2.1.10...2.1.11

• mongodb 2.5.4
  <!-- Release notes generated using configuration in .github/release.yml at 2.5.4 -->

  What's Changed

  Fixed

  • PHPC-2505: Fix foreach after GC invocation by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/1982

  Minor

  • PHPC-2682: Replace zend_hash_destroy + FREE_HASHTABLE with zend_hash_release by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2138

  Other Changes

  • Exclude OCSP tasks from PR checks by @kevinAlbs in https://github.com/mongodb/mongo-php-driver/pull/2125
  • PHPC-2774: Pin all GitHub Actions to exact release tags by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2121
  • Align the v1.21 CI configuration with v2.1 and v2.5, and pin all GitHub Actions by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2129
  • Upgrade libmongoc by @paulinevos in https://github.com/mongodb/mongo-php-driver/pull/2148
  • remove stray build files by @kevinAlbs in https://github.com/mongodb/mongo-php-driver/pull/2151

  Full Changelog: https://github.com/mongodb/mongo-php-driver/compare/2.5.3...2.5.4

• datadog_trace 1.26.0
  ## All products ### Changed - Write sidecar logs when it runs in thread mode #4235 - `datadog-setup.php` now reports that macOS is not supported #4284 (thank you @staabm for the report!)

  Fixed

  • Stop spawning a new sidecar while a PHP worker shuts down, which left orphaned sidecar processes #4164
  • Correctly handle a thread-mode sidecar that takes over as the new master process #4270
  • Fix sidecar telemetry lock inversions, premature sidecar idle shutdown and a hang on Windows when the sidecar pipe is full #4219
  • Avoid a race between the SSI loader's background dlclose() and process exit #4229
  • Crash reports now respect proxy environment variables, and the agent host/port takes priority over a UDS socket for error tracking uploads DataDog/libdatadog#2462, DataDog/libdatadog#2633
  • Authenticate sidecar connections and shared memory (peer credential checks, trusted shared memory directory), fixing https://github.com/DataDog/dd-trace-php/security/advisories/GHSA-j3g8-6962-2xqq and https://github.com/DataDog/dd-trace-php/security/advisories/GHSA-fmrj-jm6v-j549 DataDog/libdatadog#2551

  Internal

  • Update Rust dependencies to fix RustSec advisories; building from source now requires Rust 1.91.1 #4188
  • Publish the OTel process context during MINIT #4213

  Tracer

  Added

  • Support OTel sampling (ot.th/ot.rv tracestate) in distributed tracing #4177

  Changed

  • Update the default query string obfuscation regex, fixing a security vulnerability, as described in https://github.com/DataDog/dd-trace-php/security/advisories/GHSA-49fg-59cp-2hqj #4282
  • Improve stability of the tracer on macOS #4187
  • Client-side stats obfuscation now follows the agent's full SQL obfuscation config DataDog/libdatadog#2535

  Fixed

  • Fix crashes at shutdown: on PHP 7.0/7.1 ZTS #4185, in atexit after ddtrace was unloaded #4197, in the zend extension shutdown #4218, and in remote config shutdown #4220
  • Fix rare use-after-frees in the in-process background sender, during request processing #4189 and at shutdown when the writer thread gets detached #4278 (thank you @alexandre-daubois!)
  • Make the flush on SIGTERM/SIGINT safe against crashes in the allocator #4222
  • Fix a crash when walking the stack after a generator was destroyed during an aborted call #4272
  • Fix JIT blacklisting on PHP 8.5+ and for generator memory #4226, #4236
  • Fix multi-hooking with dynamic payloads and a crash when subclassing HookData #4236
  • Do not start the background writer when the tracer is disabled during MINIT #4233
  • Avoid starvation of synchronous flushes with the in-process background sender #4224
  • Fix sidecar connection from threads impersonating another user under Windows #4280
  • Make Windows remote config notifications safe against unloading ddtrace #4219
  • Evaluate the sampling decision once per trace chunk during serialization #4219
  • Set peer.service sources in the Predis and PDO connect integrations #4285, #4286 (thank you @redpanda for the reports!)
  • Report http.status_code for Guzzle requests that throw on non-2xx responses, and fix DD_TRACE_HTTP_CLIENT_ERROR_STATUSES handling #4287 (thank you @fbaumann-ph for the report!)
  • Fix client-side stats: http.endpoint takes precedence over http.route again, and deeply nested SQL can no longer exhaust the stack during obfuscation DataDog/libdatadog#2582, DataDog/libdatadog#2441
  • Fix a possible divide-by-zero panic in the shared rate limiter #4259

  Internal

  • Add the _dd.sdk.otlp_export marker to trace chunks #4240

  Profiling

  Changed

  • Speed up sample processing, reducing dropped samples under load #4194

  Fixed

  • Fix several I/O profiling issues: poll readiness, fread/fwrite byte counts, RELRO protection after GOT patching, and loader bounds checks #4156
  • Fix a wall-time crash after ext-grpc runs PHP code on a native thread; I/O profiling is disabled when ext-grpc is loaded #4198
  • Report allocator-rounded allocation sizes and fix upscaling of samples with varying allocation sizes #4230
  • Block signals before spawning profiler helper threads #4224

  AppSec

  Changed

  • Update libddwaf to 2.1.0 and build it from source for PECL packages, fixing offline builds #4203 (thank you @remicollet for the report!)
  • Update vendored libxml2 to 2.15.4 #4224

  Fixed

  • Fix loading AppSec on musl ZTS builds (e.g. Alpine, FrankenPHP), and a crash on ZTS thread exit #4180
  • Fix protocol failures caused by empty AppSec data #4216
• rpminfo 1.2.2
  - Update PHP License from version 3 to version 4 (BSD-3-Clause) - Compatibility with PHP 8.6
• Bitset 3.2.1
  - Compatibility with PHP 8.6

Latest PECL Releases:

• phalcon 5.22.1
  Full changelog can be found at: https://github.com/phalcon/cphalcon/blob/master/CHANGELOG-5.0.md

• uv 0.3.1
  0.3.1 release
• timezonedb 2026.5
  Updated to version 2026.5 (2026e)

Latest PECL Releases:

• Tensor 3.1.0
  - Implemented the singular value decomposition (SVD) in the pure-PHP library
  • Implemented the Moore-Penrose pseudoinverse in the pure-PHP library via SVD
  • Implemented the eigendecomposition in the pure-PHP library
• Tensor 3.0.11
  - Update to Zephir 1.5.0 - Fixed RREF/REF pivot float tolerance - RREF now zeroes the tail if below EPSILON - `rank()`, `fullRank()`, and `inverse()` are now consistent - Matrix::inverse() now throws a RuntimeException on singular input - Matrix::inverse() now throws an InvalidArgumentException on non-square input - Fix Poisson distribution when lambda is zero - Added square check to inverse() - Cholesky decompose() now throws a RuntimeException on non-positive-definite input - Added the SingularMatrix exception - The extension now reduces singular matrices to REF and RREF instead of throwing
• phalcon 5.21.0
  Full changelog can be found at: https://github.com/phalcon/cphalcon/blob/master/CHANGELOG-5.0.md
• Tensor 3.0.10
  - Update to Zephir 0.23, adds support for PHP 8.5 - Fixed Matrix and Vector build() validation - Fixed bug in Matrix row variance - Fixed LU decomposition pivot selection, singular matrices now throw a RuntimeException - Fixed undefined array key in Vector and Matrix quantile at q=1.0 or with a single element - Fix extension rank() operation - Fixed reduce() callback argument order inconsistency between Matrix and Vector - Fix covariance() summation axis - Fixed Vector notEqualMatrix throwing InvalidArgumentException instead of DimensionalityMismatch - Fixed memory leak in the extension on the failure path of inverse, pseudoinverse
• protobuf 5.36.2
  * See github.com/protocolbuffers/protobuf/releases/tag/v36.2 for release notes.
• ice 1.12.0
  - PHP 8.0, drop support - PHP 8.5, add support - Update zephir parser to 2.8.0 - Update mongodb/mongodb to ~2 - SleetParser, fix template parsing and array literal syntax - Di, Arr, fix magic get/set returning null for registered services - FastRouter, fix routes with no explicit handler not matching - Url, fix double leading slash in generated URLs - FilterCss, fix comment stripping - HttpResponse, fix byte range for non-resumable downloads - Fix various Zephir compile errors and conditional-initialization warnings - Tests, convert @dataProvider annotations to PHP 8 attributes for PHPUnit 11+
• timezonedb 2026.4
  Updated to version 2026.4 (2026d)
• swoole 6.1.10
  - Fixed an issue in SWOOLE_THREAD mode where the program could not start if the set() method was not called. - Fixed a NULL pointer dereference that occurred when querying port attributes while shutting down the server, caused by the ListenPort pointer being NULL. - Fixed an issue where a hooked TLS stream completes the handshake in Socket::connect(). When this call fails or is canceled, the stream transport layer should return failure directly instead of attempting to enable encryption again. - Fixed an issue where the coroutine HTTP server still returned success when the protocol setting was rejected or accept failed. - Fixed an issue where HTTP compression used the wrong data format when returning deflate encoding. - Fixed an issue where, when native hook was not enabled, destroying a native CurlHandle did not hand the object release work back to ext-curl, resulting in incorrect release logic. - Fixed an issue in cURL multi under the CURL_POLL_INOUT state where the event mask for "readable and writable at the same time" was not correctly restored, causing HTTP/2 duplex transmission to be repeatedly woken up when blocked by flow control, forming a busy loop. - Fixed the lack of timeout support for atomic wait/wakeup on the Windows platform. - Fixed an issue where, after enabling send_yield, the peer closing the connection prevented the coroutine from being woken up, resulting in a coroutine leak.

Latest PECL Releases:

• gRPC 1.84.0
  - gRPC Core 1.84.0 update

• opentelemetry 1.4.1
  See https://github.com/open-telemetry/opentelemetry-php-instrumentation/releases/tag/1.4.1
• maxminddb 1.14.0
  * Bounded the resources that the pure PHP decoder spends on a single lookup. A crafted database could nest data-section pointers to shared targets so that decoding one record cost exponential time and memory, or point many times at one large value so that the decoder copied far more data than the file holds. The decoder now follows the Reader Resource Limits section of the MaxMind DB specification. Each lookup is limited to 65,536 values, 512 levels of nesting, and 2 MiB of string and bytes payload. * Exceeding a limit throws an `InvalidDatabaseException`. * Opening a database whose metadata exceeds a limit throws the same exception. * A scalar that declares more than 16 bytes, the width of the widest fixed-width type, is rejected as invalid data. * The bundled libmaxminddb used by `--with-maxminddb-bundled` builds of the extension now applies the same decoder limits. The extension throws an `InvalidDatabaseException` when a lookup exceeds them. * The pure PHP reader is about 40% faster on City lookups. It no longer seeks before a read that continues where the last one ended, and it checks read lengths with `strlen()` instead of `ftell()`. * The Windows build configuration now accepts either `libmaxminddb.lib` or `maxminddb.lib` when building the extension. The `lib` prefix was removed in libmaxminddb 1.6.0, but the libmaxminddb that PHP publishes for Windows builds is still 1.5.0, which uses the prefixed name. Pull request by Jean-Baptiste Nahan. GitHub #231. * Replaced `XtOffsetOf()` with `offsetof()`. The `XtOffsetOf()` alias has been removed in PHP 8.6. Pull request by Remi Collet. GitHub #252. * The extension can now be built from a bundled copy of libmaxminddb, on both Unix-like systems and Windows, by passing `--with-maxminddb-bundled` to `configure` (or to `configure.bat` on Windows). This produces an extension that does not depend on a system libmaxminddb, which is a prerequisite for distributing precompiled builds; on Windows it also replaces the 1.5.0 import library that PHP publishes for Windows builds. The default is unchanged: without the flag, the extension links against a system libmaxminddb as before. GitHub #265. * The `conflict` constraint on `ext-maxminddb` in `composer.json` is again updated when a release is cut. The substitution that maintains it stopped matching in April 2024, when the constraint's separator changed from a comma to `||`, so the constraint has read `<1.11.1` through four releases. Users of the C extension should note the effect of reviving it: `ext-maxminddb` is a Composer platform package, so this release conflicts with an older compiled extension and `composer update` will require upgrading the two together. GitHub #266.
• zephir_parser 2.8.0
  ### Added - Support PHP attribute syntax on every declaration PHP allows for a class member: `#[Attr]`, `#[Attr(1, "s", key: "v")]` and `#[A, B(2)]` on a class, interface, trait, function, property, class constant, method and parameter (including closure and interface-method parameters). The host node gains an `attributes` key, appended last and omitted entirely when the declaration carries none, so every node that parsed before keeps its exact shape. `#[A] #[B]` and `#[A, B]` produce the same flat list, since the grouping carries no meaning in PHP either. Arguments reuse the call-argument non-terminal, so a named argument (`key: expr`) needs no special form and the grammar accepts more than a constant expression, leaving the compiler to name the sub-expression it cannot fold. The canonical order is docblock then attributes; the reverse is tolerated ([zephir-lang/zephir#2466](https://github.com/zephir-lang/zephir/issues/2466)).

  Changed

  • #[ is a new token. A bare # remains a scanner error, and #[ inside a string, a comment, a docblock or a %{ ... }% cblock is still part of that literal.
  • An attribute named after one of Zephir's case-insensitive keywords is accepted for the eleven that are plausible attribute names (Deprecated, Final, Internal, Readonly, Static, Default, Case, Empty, Void, Reverse, Inline) and normalized to that canonical spelling. A keyword whose terminal matches two spellings, such as float, has no such rule and must be written qualified.
• yac 2.4.2
  - String values are decoded straight into the zend_string handed back to PHP, no second copy per read - Copying a value and checksumming it are a single pass on writes as well as reads - The next probe slot is prefetched while the current one's lock, load and compare are in flight - Faster argument parsing for add/set/get/delete/dump - dump() builds its result array in bulk instead of one insert per entry - Overwriting an entry whose value outgrew its block skips the checksum of the block being replaced - CRC-32C picks its implementation by probing the CPU at runtime, so a binary built with -msse4.2 still runs on older hardware - Fixed get() crashing under concurrency: find() bumped the hit count and access time without holding the slot, overwriting the type flag a concurrent write had just published - flush() now takes every slot before clearing the table; it could previously land mid-publish and leave a slot permanently unusable - dump() returns an empty result while a flush() is in progress instead of reporting half-cleared slots - Fixed a wild-pointer read in the block-value guard of find() - Fixed dump() on PHP older than 7.4 - Fixed the packaged tarball missing storage/crc, which made it fail to build
• datadog_trace 1.25.1
  ## All products ### Fixed - Fix SSI MSHUTDOWN on PHP 7.3 with opcache #4169

  Tracer

  Fixed

  • Set ZEND_ENABLE_STATIC_TSRMLS_CACHE=1 on windows as well for windows ZTS builds #4172
  • Fix #4163: broken frankenphp shutdown signal on musl #4167

  Internal

  • Remove any dependency on aws-lc-sys #4170

  Profiling

  Fixed

  • Fix IO/allocation sampling intervals #4159

  AppSec

  Fixed

  • Use MetricType::Distribution for RASP_RULE_DURATION_DIST #4093
  • Do not panic when WAF arrays exceed 2^16-1 elements DataDog/libddwaf-rust#28

Latest PECL Releases:

• gRPC 1.84.0RC1
  - gRPC Core 1.84.0 update

• datadog_trace 1.25.0
  ## All products ### Added - Support the stable OpenTelemetry `deployment.environment.name` resource attribute, mapped to `DD_ENV` (in addition to the legacy `deployment.environment`) #4148

  Internal

  • Exclude DD_API_KEY and OTLP exporter header values from configuration telemetry #3961

  Tracer

  Changed

  • Add a 1 MB size limit to Dynamic Instrumentation capture snapshots #4126

  Fixed

  • Fix missing/mis-tagged drupal.theme.render spans on Drupal >= 11.3 and under early-returning renders #4145
  • Fix sidecar reconnection error handling DataDog/libdatadog#2463
  • Fix a sidecar listening-socket leak across forks DataDog/libdatadog#2447

  Internal

  • Reduce reconnect overhead for periodic background HTTP requests in the sidecar (telemetry/trace flushes) DataDog/libdatadog#2440
  • Reduce the number of HTTP requests sent for shutdown telemetry DataDog/libdatadog#2435
  • Feature Flag Evaluation: support arbitrary semver version formats and add serial-id tracking to exposure events DataDog/libdatadog#2413, DataDog/libdatadog#2402
  • Improve crash-report accuracy by filtering stack frames above the faulting frame DataDog/libdatadog#2428
  • Fix -flto -ffat-lto-objects builds DataDog/libdatadog#2460

  Profiling

  Changed

  • Improve profiler throughput by ~1% by gating debug-only runtime cache stats behind a build feature #4130

  Fixed

  • Restore I/O GOT hooks on module shutdown #4154

  Internal

  • Align zstd compression behavior across targets in the profiler's uploader DataDog/libdatadog#2400

  AppSec

  Internal

  • Move appsec communication onto the sidecar; the appsec helper is now built into the sidecar instead of as a separate binary, and the legacy C++ helper is removed #3725
• mongodb 1.21.9
  **Full Changelog**: https://github.com/mongodb/mongo-php-driver/compare/1.21.8...1.21.9
• mongodb 2.5.2
  <!-- Release notes generated using configuration in .github/release.yml at 2.5.2 -->

  Full Changelog: https://github.com/mongodb/mongo-php-driver/compare/2.5.1...2.5.2

• mongodb 1.21.8
  ## What's Changed * Fix release workflow failing on root-owned git objects by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2066 * Document `phpize --clean` in build instructions by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2074 * Upgrade libmongoc to 1.30.9 by @paulinevos in https://github.com/mongodb/mongo-php-driver/pull/2077 * PHPC-2744 Fix dependency issue by @paulinevos in https://github.com/mongodb/mongo-php-driver/pull/2081

  Full Changelog: https://github.com/mongodb/mongo-php-driver/compare/1.21.7...1.21.8

• mongodb 2.5.0
  <!-- Release notes generated using configuration in .github/release.yml at 2.5.0 -->

  What's Changed

  • PHPC-2753 Add link to ECR log-in by @kevinAlbs in https://github.com/mongodb/mongo-php-driver/pull/2055
  • Merge v2.4 into v2.x by @mongodb-drivers-pr-bot[bot] in https://github.com/mongodb/mongo-php-driver/pull/2058
  • PHPC-2751: Upgrade libmongoc to 2.5.0 by @paulinevos in https://github.com/mongodb/mongo-php-driver/pull/2054
  • Bump tests/drivers-evergreen-tools from e86753e to c70d29e by @dependabot[bot] in https://github.com/mongodb/mongo-php-driver/pull/2053
  • Merge v2.4 into v2.x by @mongodb-drivers-pr-bot[bot] in https://github.com/mongodb/mongo-php-driver/pull/2065
  • Update package.xml maintainers list by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2067
  • Fix release workflow failing on root-owned git objects by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2066
  • Merge v2.4 into v2.x by @mongodb-drivers-pr-bot[bot] in https://github.com/mongodb/mongo-php-driver/pull/2071
  • PHPC-2754: Update libmongocrypt to 1.20.3 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2072
  • Merge v2.4 into v2.x by @mongodb-drivers-pr-bot[bot] in https://github.com/mongodb/mongo-php-driver/pull/2073
  • PHPC-2756: Upgrade libmongoc to 2.5.1 by @paulinevos in https://github.com/mongodb/mongo-php-driver/pull/2075

  New Contributors

  • @kevinAlbs made their first contribution in https://github.com/mongodb/mongo-php-driver/pull/2055

  Full Changelog: https://github.com/mongodb/mongo-php-driver/compare/2.4.1...2.5.0

• yac 2.4.1
  - Integrity-check every value with CRC-32C on read: three interleaved hardware chains for values over 1KB on x86-64/ARM64, sliced-by-8 software table elsewhere - Eviction rework: separate expired sweep, victims picked by remaining ttl (ties fall to least hit), corrupt blocks tombstoned on find - A single MurmurHash64A drives home slot and probe stride (two hashes before) - hits/miss accumulated per process and folded once at request end, off the shared-counter hot path - Default memory raised: keys 4M to 8M, values 32M to 64M; compression on by default at 4K - Fixed a refcount leak on the multi-get $default - Entries failing to decompress are now invalidated instead of being evicted over and over - Fixed crc sampling and the decompression check - Fixed spurious kicks - Fixed the JSON serializer decoding from an unterminated buffer - Fixed info() folding miss counts into the hits counter

Latest PECL Releases:

• protobuf 5.36.1
  * See github.com/protocolbuffers/protobuf/releases/tag/v36.1 for release notes.

• gRPC 1.83.1
  - gRPC Core 1.83.1 update
• gRPC 1.82.2
  - gRPC Core 1.82.2 update
• mongodb 1.21.7
  ## What's Changed * Update package.xml maintainers list by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2067

  Full Changelog: https://github.com/mongodb/mongo-php-driver/compare/1.21.6...1.21.7

• mongodb 2.4.1
  <!-- Release notes generated using configuration in .github/release.yml at 2.4.1 -->

  What's Changed

  • PHPC-2742: Bump libmongocrypt to 1.20.2 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2051
  • PHPC-2755: Fix test suite failures with PHP 8.6 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2056
  • PHPC-2745: Reject null bytes in namespaces and periods in database names [v2.4] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2060
  • PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2059
  • Bump drivers-github-tools action to v3 in release workflows by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2063
  • Merge v2.4 into v2.x by @mongodb-drivers-pr-bot[bot] in https://github.com/mongodb/mongo-php-driver/pull/2061

  Full Changelog: https://github.com/mongodb/mongo-php-driver/compare/2.4.0...2.4.1

• yac 2.4.0
  - Embed small scalars directly in the hash slot, avoiding value allocations for tiny entries - Switch compression from FastLZ to LZ4 (better ratio and speed) - get() accepts an optional $default argument (returned on miss instead of NULL) - dump() gains an $offset parameter and reports hits, atime, embedded and c_len per entry - Per-entry hit counters and start_time exposed in info()/dump() - Multi-get omits missing keys (filled with $default when given) instead of false placeholders - Field-by-field slot commits and spinlock backoff (pause/yield) reduce contention overhead - Fixed a startup hang when values_memory_size is below the 4M segment minimum - Fixed Windows shared memory cleanup (view unmapped exactly once) - Fixed valgrind-reported leaks and uninitialized reads (MINFO output, compression error paths)
• phalcon 5.20.3
  Full changelog can be found at: https://github.com/phalcon/cphalcon/blob/master/CHANGELOG-5.0.md
• phalcon 5.20.2
  Full changelog can be found at: https://github.com/phalcon/cphalcon/blob/master/CHANGELOG-5.0.md

Latest PECL Releases:

• taint 3.0.0
  - Support PHP 8.0 up to 8.5
  • Dropped PHP 7 support (use taint 2.1.x for PHP 7.x)
  • Propagate the taint mark through the frameless call fast paths (PHP 8.4+)
  • Extended sink coverage (see README for the full list)
• sqlsrv 5.13.3
  Added - Windows support for installing the drivers with PIE (the PHP Installer for Extensions). PIE-based installation, introduced for Linux and macOS in 5.13.2, is now also available on Windows: `pie install microsoft/sqlsrv` and `pie install microsoft/pdo_sqlsrv`.

  Limitations

  • No support for inout / output params when using sql_variant type
  • No support for inout / output params when formatting decimal values
  • In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
  • Always Encrypted requires MS ODBC Driver 17+
    • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
    • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
    • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
    • Always Encrypted limitations

  Known Issues

  • Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
  • When pooling is enabled in Linux or macOS
    • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
    • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here
• pdo_sqlsrv 5.13.3
  Added - Windows support for installing the drivers with PIE (the PHP Installer for Extensions). PIE-based installation, introduced for Linux and macOS in 5.13.2, is now also available on Windows: `pie install microsoft/sqlsrv` and `pie install microsoft/pdo_sqlsrv`.

  Limitations

  • No support for inout / output params when using sql_variant type
  • No support for inout / output params when formatting decimal values
  • In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
  • Always Encrypted requires MS ODBC Driver 17+
    • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
    • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
    • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
    • Always Encrypted limitations

  Known Issues

  • Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
  • When pooling is enabled in Linux or macOS
    • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
    • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here
• yaconf 1.1.3
  - Fixed memory leak with PHP 8.1 - Fixed garbage value being returned when an INI file is unreadable - Fixed Yaconf::get() with paths deeper than a scalar value - Fixed section inheritance from numeric section names - Fixed fatal error and a memory leak in the startup scan
• yar 2.4.0
  - Added yar.ssl_verify to make TLS certificate verification configurable - Kept persistent curl connections in the persistent resource list - Rejected non-public methods in the server dispatcher - Fixed use-after-free (dangling offset) in REALLOC_BUF_IF_EXCEED - Fixed size_t underflow when request body is shorter than the protocol header - Hardened protocol parsing: body length clamping, bounds checks, payload type checks - Fixed YAR_OPT_PROXY passing the connect timeout to CURLOPT_PROXY - Fixed issue #175 where Yar_Server::Info returns garbled output.

Latest PECL Releases:

• protobuf 5.36.0RC2
  * See github.com/protocolbuffers/protobuf/releases/tag/v36.0-rc2 for release notes.

• sqlsrv 5.13.2
  Added - The drivers can now be installed with PIE (the PHP Installer for Extensions), the official replacement for the now-deprecated PECL: `pie install microsoft/sqlsrv` and `pie install microsoft/pdo_sqlsrv`.

  Security

  • Fixed SQL injection in PDO::lastInsertId($name) (CWE-89). The sequence-name lookup previously interpolated the caller-supplied name directly into the query text, allowing injection of arbitrary Transact-SQL. The name is now passed to a parameterized query and bound with the connection encoding, so it is always treated as a literal value. This also fixes lookups for sequence names containing non-ASCII characters (PR #1673)
  • Fixed silent truncation of binary parameters containing embedded NUL (0x00) bytes when using PDO emulated prepares with PDO::SQLSRV_ENCODING_BINARY (CWE-626). All bytes are now encoded (PR #1675)

  Fixed

  • Fixed a Windows thread-safe (ZTS) shared build link failure (unresolved external symbol LNK2001 on _tsrm_ls_cache) when building the extensions as shared DLLs (PR #1674)
  • Fixed stale unixODBC INI caching on Linux and macOS by clearing the unixODBC INI cache at module shutdown (PR #1667)
  • Fixed an AddressSanitizer One Definition Rule (ODR) violation reported when both the sqlsrv and pdo_sqlsrv extensions are loaded together (PR #1659)
  • Addressed CodeQL static-analysis findings (PR #1615)

  Limitations

  • No support for inout / output params when using sql_variant type
  • No support for inout / output params when formatting decimal values
  • In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
  • Always Encrypted requires MS ODBC Driver 17+
    • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
    • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
    • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
    • Always Encrypted limitations

  Known Issues

  • Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
  • When pooling is enabled in Linux or macOS
    • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
    • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here
• pdo_sqlsrv 5.13.2
  Added - The drivers can now be installed with PIE (the PHP Installer for Extensions), the official replacement for the now-deprecated PECL: `pie install microsoft/sqlsrv` and `pie install microsoft/pdo_sqlsrv`.

  Security

  • Fixed SQL injection in PDO::lastInsertId($name) (CWE-89). The sequence-name lookup previously interpolated the caller-supplied name directly into the query text, allowing injection of arbitrary Transact-SQL. The name is now passed to a parameterized query and bound with the connection encoding, so it is always treated as a literal value. This also fixes lookups for sequence names containing non-ASCII characters (PR #1673)
  • Fixed silent truncation of binary parameters containing embedded NUL (0x00) bytes when using PDO emulated prepares with PDO::SQLSRV_ENCODING_BINARY (CWE-626). All bytes are now encoded (PR #1675)

  Fixed

  • Fixed a Windows thread-safe (ZTS) shared build link failure (unresolved external symbol LNK2001 on _tsrm_ls_cache) when building the extensions as shared DLLs (PR #1674)
  • Fixed stale unixODBC INI caching on Linux and macOS by clearing the unixODBC INI cache at module shutdown (PR #1667)
  • Fixed an AddressSanitizer One Definition Rule (ODR) violation reported when both the sqlsrv and pdo_sqlsrv extensions are loaded together (PR #1659)
  • Addressed CodeQL static-analysis findings (PR #1615)

  Limitations

  • No support for inout / output params when using sql_variant type
  • No support for inout / output params when formatting decimal values
  • In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
  • Always Encrypted requires MS ODBC Driver 17+
    • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
    • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
    • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
    • Always Encrypted limitations

  Known Issues

  • Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
  • When pooling is enabled in Linux or macOS
    • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
    • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here
• phalcon 5.18.0
  Full changelog can be found at: https://github.com/phalcon/cphalcon/blob/master/CHANGELOG-5.0.md
• datadog_trace 1.23.3
  ## Profiler ### Fixed - Restore OPcache restart hook on shutdown (#4076)
• datadog_trace 1.23.2
  ## Tracer ### Fixed - Prevent application error handlers from replacing successful OpenFeature evaluation values with code defaults #4071

Latest PECL Releases:

• gRPC 1.83.0
  - gRPC Core 1.83.0 update

Latest PECL Releases:

• zephir_parser 2.5.0
  ### Added
  • Support the readonly modifier on class and trait properties: readonly is a property modifier keyword that appears in the property visibility list (e.g. public readonly int x), independent of position relative to public/protected/private and combining with every property type prefix (builtin, ?type, <Class> cast and union). The parser only records the modifier; the typed / no-default / no-static rules are enforced by the compiler (zephir-lang/zephir#2614).

  Changed

  • readonly is now a reserved keyword; identifiers named readonly are a syntax error.
• phalcon 5.17.0
  Full changelog can be found at: https://github.com/phalcon/cphalcon/blob/master/CHANGELOG-5.0.md
• zephir_parser 2.4.0
  ### Added - Support union types on parameters and class/trait properties: a `type | type | ...` prefix (builtin scalars, `null`/`false`, and `<Class>` casts) is emitted as an ordered `data-types` member list. Parameters additionally carry `data-type: "variable"`; the single-type and single-cast forms are unchanged. Mirrors the union return-type syntax already accepted after `->` ([zephir-lang/zephir#2613](https://github.com/zephir-lang/zephir/issues/2613)).
• zephir_parser 2.3.0
  ### Added - Support typed class and trait properties: a property may now carry a builtin type (`public array items`, `private int count`), a class type (`public <Response> response`), and an optional nullable marker (`protected ?string name`). The type prefix is emitted on the property node as a `data-type` string or a `<Class>` `cast` node, plus a `nullable` flag for `?type`, mirroring how parameters encode their types. Type prefixes combine with existing default values, `{ get, set }` shortcuts, docblocks and all-caps names ([zephir-lang/zephir#2608](https://github.com/zephir-lang/zephir/issues/2608)).
• zephir_parser 2.2.0
  ### Added - Support the `::class` magic constant: `self::class`, `parent::class`, `static::class` and `ClassName::class` now parse into a `static-constant-access` node whose member value is `class`, which the compiler resolves to the fully-qualified class name ([zephir-lang/zephir#2527](https://github.com/zephir-lang/zephir/issues/2527)).
• event 3.1.6
  Fix PHP 8.6.0alpha2 build (patch by Remi Collet)