Latest PECL Releases:

• gRPC 1.84.0
  - gRPC Core 1.84.0 update

• opentelemetry 1.4.1
  See https://github.com/open-telemetry/opentelemetry-php-instrumentation/releases/tag/1.4.1
• maxminddb 1.14.0
  * Bounded the resources that the pure PHP decoder spends on a single lookup. A crafted database could nest data-section pointers to shared targets so that decoding one record cost exponential time and memory, or point many times at one large value so that the decoder copied far more data than the file holds. The decoder now follows the Reader Resource Limits section of the MaxMind DB specification. Each lookup is limited to 65,536 values, 512 levels of nesting, and 2 MiB of string and bytes payload. * Exceeding a limit throws an `InvalidDatabaseException`. * Opening a database whose metadata exceeds a limit throws the same exception. * A scalar that declares more than 16 bytes, the width of the widest fixed-width type, is rejected as invalid data. * The bundled libmaxminddb used by `--with-maxminddb-bundled` builds of the extension now applies the same decoder limits. The extension throws an `InvalidDatabaseException` when a lookup exceeds them. * The pure PHP reader is about 40% faster on City lookups. It no longer seeks before a read that continues where the last one ended, and it checks read lengths with `strlen()` instead of `ftell()`. * The Windows build configuration now accepts either `libmaxminddb.lib` or `maxminddb.lib` when building the extension. The `lib` prefix was removed in libmaxminddb 1.6.0, but the libmaxminddb that PHP publishes for Windows builds is still 1.5.0, which uses the prefixed name. Pull request by Jean-Baptiste Nahan. GitHub #231. * Replaced `XtOffsetOf()` with `offsetof()`. The `XtOffsetOf()` alias has been removed in PHP 8.6. Pull request by Remi Collet. GitHub #252. * The extension can now be built from a bundled copy of libmaxminddb, on both Unix-like systems and Windows, by passing `--with-maxminddb-bundled` to `configure` (or to `configure.bat` on Windows). This produces an extension that does not depend on a system libmaxminddb, which is a prerequisite for distributing precompiled builds; on Windows it also replaces the 1.5.0 import library that PHP publishes for Windows builds. The default is unchanged: without the flag, the extension links against a system libmaxminddb as before. GitHub #265. * The `conflict` constraint on `ext-maxminddb` in `composer.json` is again updated when a release is cut. The substitution that maintains it stopped matching in April 2024, when the constraint's separator changed from a comma to `||`, so the constraint has read `<1.11.1` through four releases. Users of the C extension should note the effect of reviving it: `ext-maxminddb` is a Composer platform package, so this release conflicts with an older compiled extension and `composer update` will require upgrading the two together. GitHub #266.
• zephir_parser 2.8.0
  ### Added - Support PHP attribute syntax on every declaration PHP allows for a class member: `#[Attr]`, `#[Attr(1, "s", key: "v")]` and `#[A, B(2)]` on a class, interface, trait, function, property, class constant, method and parameter (including closure and interface-method parameters). The host node gains an `attributes` key, appended last and omitted entirely when the declaration carries none, so every node that parsed before keeps its exact shape. `#[A] #[B]` and `#[A, B]` produce the same flat list, since the grouping carries no meaning in PHP either. Arguments reuse the call-argument non-terminal, so a named argument (`key: expr`) needs no special form and the grammar accepts more than a constant expression, leaving the compiler to name the sub-expression it cannot fold. The canonical order is docblock then attributes; the reverse is tolerated ([zephir-lang/zephir#2466](https://github.com/zephir-lang/zephir/issues/2466)).

  Changed

  • #[ is a new token. A bare # remains a scanner error, and #[ inside a string, a comment, a docblock or a %{ ... }% cblock is still part of that literal.
  • An attribute named after one of Zephir's case-insensitive keywords is accepted for the eleven that are plausible attribute names (Deprecated, Final, Internal, Readonly, Static, Default, Case, Empty, Void, Reverse, Inline) and normalized to that canonical spelling. A keyword whose terminal matches two spellings, such as float, has no such rule and must be written qualified.
• yac 2.4.2
  - String values are decoded straight into the zend_string handed back to PHP, no second copy per read - Copying a value and checksumming it are a single pass on writes as well as reads - The next probe slot is prefetched while the current one's lock, load and compare are in flight - Faster argument parsing for add/set/get/delete/dump - dump() builds its result array in bulk instead of one insert per entry - Overwriting an entry whose value outgrew its block skips the checksum of the block being replaced - CRC-32C picks its implementation by probing the CPU at runtime, so a binary built with -msse4.2 still runs on older hardware - Fixed get() crashing under concurrency: find() bumped the hit count and access time without holding the slot, overwriting the type flag a concurrent write had just published - flush() now takes every slot before clearing the table; it could previously land mid-publish and leave a slot permanently unusable - dump() returns an empty result while a flush() is in progress instead of reporting half-cleared slots - Fixed a wild-pointer read in the block-value guard of find() - Fixed dump() on PHP older than 7.4 - Fixed the packaged tarball missing storage/crc, which made it fail to build
• datadog_trace 1.25.1
  ## All products ### Fixed - Fix SSI MSHUTDOWN on PHP 7.3 with opcache #4169

  Tracer

  Fixed

  • Set ZEND_ENABLE_STATIC_TSRMLS_CACHE=1 on windows as well for windows ZTS builds #4172
  • Fix #4163: broken frankenphp shutdown signal on musl #4167

  Internal

  • Remove any dependency on aws-lc-sys #4170

  Profiling

  Fixed

  • Fix IO/allocation sampling intervals #4159

  AppSec

  Fixed

  • Use MetricType::Distribution for RASP_RULE_DURATION_DIST #4093
  • Do not panic when WAF arrays exceed 2^16-1 elements DataDog/libddwaf-rust#28