Latest PECL Releases:

• protobuf 5.36.0RC2
  * See github.com/protocolbuffers/protobuf/releases/tag/v36.0-rc2 for release notes.

• sqlsrv 5.13.2
  Added - The drivers can now be installed with PIE (the PHP Installer for Extensions), the official replacement for the now-deprecated PECL: `pie install microsoft/sqlsrv` and `pie install microsoft/pdo_sqlsrv`.

  Security

  • Fixed SQL injection in PDO::lastInsertId($name) (CWE-89). The sequence-name lookup previously interpolated the caller-supplied name directly into the query text, allowing injection of arbitrary Transact-SQL. The name is now passed to a parameterized query and bound with the connection encoding, so it is always treated as a literal value. This also fixes lookups for sequence names containing non-ASCII characters (PR #1673)
  • Fixed silent truncation of binary parameters containing embedded NUL (0x00) bytes when using PDO emulated prepares with PDO::SQLSRV_ENCODING_BINARY (CWE-626). All bytes are now encoded (PR #1675)

  Fixed

  • Fixed a Windows thread-safe (ZTS) shared build link failure (unresolved external symbol LNK2001 on _tsrm_ls_cache) when building the extensions as shared DLLs (PR #1674)
  • Fixed stale unixODBC INI caching on Linux and macOS by clearing the unixODBC INI cache at module shutdown (PR #1667)
  • Fixed an AddressSanitizer One Definition Rule (ODR) violation reported when both the sqlsrv and pdo_sqlsrv extensions are loaded together (PR #1659)
  • Addressed CodeQL static-analysis findings (PR #1615)

  Limitations

  • No support for inout / output params when using sql_variant type
  • No support for inout / output params when formatting decimal values
  • In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
  • Always Encrypted requires MS ODBC Driver 17+
    • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
    • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
    • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
    • Always Encrypted limitations

  Known Issues

  • Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
  • When pooling is enabled in Linux or macOS
    • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
    • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here
• pdo_sqlsrv 5.13.2
  Added - The drivers can now be installed with PIE (the PHP Installer for Extensions), the official replacement for the now-deprecated PECL: `pie install microsoft/sqlsrv` and `pie install microsoft/pdo_sqlsrv`.

  Security

  • Fixed SQL injection in PDO::lastInsertId($name) (CWE-89). The sequence-name lookup previously interpolated the caller-supplied name directly into the query text, allowing injection of arbitrary Transact-SQL. The name is now passed to a parameterized query and bound with the connection encoding, so it is always treated as a literal value. This also fixes lookups for sequence names containing non-ASCII characters (PR #1673)
  • Fixed silent truncation of binary parameters containing embedded NUL (0x00) bytes when using PDO emulated prepares with PDO::SQLSRV_ENCODING_BINARY (CWE-626). All bytes are now encoded (PR #1675)

  Fixed

  • Fixed a Windows thread-safe (ZTS) shared build link failure (unresolved external symbol LNK2001 on _tsrm_ls_cache) when building the extensions as shared DLLs (PR #1674)
  • Fixed stale unixODBC INI caching on Linux and macOS by clearing the unixODBC INI cache at module shutdown (PR #1667)
  • Fixed an AddressSanitizer One Definition Rule (ODR) violation reported when both the sqlsrv and pdo_sqlsrv extensions are loaded together (PR #1659)
  • Addressed CodeQL static-analysis findings (PR #1615)

  Limitations

  • No support for inout / output params when using sql_variant type
  • No support for inout / output params when formatting decimal values
  • In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
  • Always Encrypted requires MS ODBC Driver 17+
    • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
    • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
    • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
    • Always Encrypted limitations

  Known Issues

  • Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
  • When pooling is enabled in Linux or macOS
    • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
    • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here
• phalcon 5.18.0
  Full changelog can be found at: https://github.com/phalcon/cphalcon/blob/master/CHANGELOG-5.0.md
• datadog_trace 1.23.3
  ## Profiler ### Fixed - Restore OPcache restart hook on shutdown (#4076)
• datadog_trace 1.23.2
  ## Tracer ### Fixed - Prevent application error handlers from replacing successful OpenFeature evaluation values with code defaults #4071