php-src/UPGRADING

PHP 8.5 UPGRADE NOTES

1. Backward Incompatible Changes
2. New Features
3. Changes in SAPI modules
4. Deprecated Functionality
5. Changed Functions
6. New Functions
7. New Classes and Interfaces
8. Removed Extensions and SAPIs
9. Other Changes to Extensions
10. New Global Constants
11. Changes to INI File Handling
12. Windows Support
13. Other Changes
14. Performance Improvements

========================================
1. Backward Incompatible Changes
========================================

- BZ2:
  . bzcompress() now throws a ValueError when $block_size is not between
    1 and 9.
  . bzcompress() now throws a ValueError when $work_factor is not between
    0 and 250.

- Core:
  . It is no longer possible to use "array" and "callable" as class alias names
    in class_alias().
  . Loosely comparing uncomparable objects (e.g. enums, \CurlHandle and other
    internal classes) to booleans was previously inconsistent. If compared to a
    boolean literal $object == true, it would behave the same way as (bool)
    $object. If compared to a statically unknown value $object == $true, it
    would always return false. This behavior was consolidated to always follow
    the behavior of (bool) $object.
  . The return value of gc_collect_cycles() no longer includes strings and
    resources that were indirectly collected through cycles.
  . It is now allowed to substitute static with self or the concrete class name
    in final subclasses.
  . The tick handlers are now deactivated after all shutdown functions, destructors
    have run and the output handlers have been cleaned up.
    This is a consequence of fixing GH-18033.
  . Traits are now bound before the parent class. This is a subtle behavioral
    change, but should more closely match user expectations, demonstrated by
    GH-15753 and GH-16198.
  . Errors emitted during compilation and class linking are now always delayed
    and handled after compilation or class linking. Fatal errors emitted during
    compilation or class linking cause any delayed errors to be handled
    immediately, without calling user-defined error handlers.
  . Exceptions thrown by user-defined error handlers when handling class linking
    errors are not promoted to fatal errors anymore and do not prevent linking.
  . Applying #[\Attribute] to an abstract class, enum, interface, or trait triggers
    an error during compilation. Previously, the attribute could be added, but when
    ReflectionAttribute::newInstance() was called an error would be thrown.

- DOM:
  . Cloning a DOMNamedNodeMap, DOMNodeList, Dom\NamedNodeMap, Dom\NodeList,
    Dom\HTMLCollection, and Dom\DtdNamedNodeMap now fails.
    This never actually resulted in a working object,
    so the impact should actually be zero.

- FileInfo:
  . finfo_file() and finfo::file() now throws a ValueError instead of a
    TypeError when $filename contains nul bytes.
    This aligns the type of Error thrown to be consistent with the rest of
    the language.

- Intl:
  . The extension now requires at least ICU 57.1.
  . The behaviour of Collator::SORT_REGULAR with respect to handling numeric
    strings is now aligned with the behaviour of SORT_REGULAR in ext/standard.
    This is a consequence of fixing bug GH-18566.

- LDAP:
  . ldap_get_option() and ldap_set_option() now throw a ValueError when
    passing an invalid option.

- MySQLi:
  . Calling the mysqli constructor on an already-constructed object
    is now no longer possible and throws an Error.

- ODBC:
  . ODBC now assumes that at least ODBC 3.5 functionality is available. The
    ODBCVER definition and build system flags to control it have been removed.

- Opcache:
  . The Opcache extension is now always built into the PHP binary and is always
    loaded. The INI directives opcache.enable and opcache.enable_cli are still
    honored.
    The --enable-opcache/--disable-opcache configure flags have been removed,
    and the build does not produce opcache.so or php_opcache.dll objects
    anymore.
    Using zend_extension=opcache.so or zend_extension=php_opcache.dll INI
    directives will emit a warning.

- PCNTL:
  . pcntl_exec() now throws ValueErrors when entries of the $args parameter
    contain null bytes.
  . pcntl_exec() now throws ValueErrors when entries or keys of the
    $env_vars parameter contain null bytes.

- PCRE:
  . The extension is compiled without semi-deprecated
    PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK compile option.
    https://github.com/PCRE2Project/pcre2/issues/736#issuecomment-2754024651

- PDO:
  . The constructor arguments set in conjunction with PDO::FETCH_CLASS now
    follow the usual CUFA (call_user_func_array) semantics.
    This means string keys will act like a named argument.
    Moreover, automatic wrapping for by-value arguments passed to a by-ref
    parameter has been removed, and the usual E_WARNING about this is now
    emitted.
    To pass a variable by-ref to a constructor argument use the general
    array value reference assignment: $ctor_args = [&$valByRef]
  . Attempting to call PDOStatement::setFetchMode during a call to PDO::fetch(),
    PDO::fetchObject(), PDO::fetchAll(),
    for example using tricks such as passing the statement object as a constructor
    argument when fetching into an object, will now throw an Error.
  . The value of the constants PDO::FETCH_GROUP, PDO::FETCH_UNIQUE,
    PDO::FETCH_CLASSTYPE, PDO::FETCH_PROPS_LATE, and PDO::FETCH_SERIALIZE
    have changed.
  . A ValueError is now thrown if PDO::FETCH_PROPS_LATE is used with a fetch
    mode different than PDO::FETCH_CLASS, consistent with other fetch flags.
  . A ValueError is now thrown if PDO::FETCH_INTO is used as a fetch mode in
    PDO::fetchAll(), similar to PDO::FETCH_LAZY.

- PDO_FIREBIRD:
  . A ValueError is now thrown when trying to set a cursor name that is too
    long on a PDOStatement resulting from the Firebird driver.

- Session:
  . Attempting to write session data where $_SESSION has a key containing
    the pipe character will now emit a warning instead of silently failing.

- SimpleXML:
  . Passing an XPath expression that returns something other than a node set
    to SimpleXMLElement::xpath() will now emit a warning and return false,
    instead of silently failing and returning an empty array.

- SPL:
  . ArrayObject no longer accepts enums, as modifying the $name or $value
    properties can break engine assumptions.
  . SplFileObject::fwrite's parameter $length is now nullable. The default
    value changed from 0 to null.

- Standard:
  . Using a printf-family function with a formatter that did not specify the
    precision previously incorrectly reset the precision instead of treating
    it as a precision of 0. See GH-18897.

========================================
2. New Features
========================================

- Core:
  . Closure is now a proper subtype of callable
  . Added support for Closures and first class callables in constant
    expressions.
    RFC: https://wiki.php.net/rfc/closures_in_const_expr
    RFC: https://wiki.php.net/rfc/fcc_in_const_expr
  . Fatal Errors (such as an exceeded maximum execution time) now include a
    backtrace.
    RFC: https://wiki.php.net/rfc/error_backtraces_v2
  . Added the #[\NoDiscard] attribute to indicate that a function's return
    value is important and should be consumed.
    RFC: https://wiki.php.net/rfc/marking_return_value_as_important
  . Added the (void) cast to indicate that not using a value is intentional.
    The (void) cast has no effect on the program's execution by itself, but
    it can be used to suppress warnings emitted by #[\NoDiscard] and possibly
    also diagnostics emitted by external IDEs or static analysis tools.
    RFC: https://wiki.php.net/rfc/marking_return_value_as_important
  . Added asymmetric visibility support for static properties.
    RFC: https://wiki.php.net/rfc/static-aviz
  . Added support for casts in constant expressions.
  . Added support for attributes on compile-time non-class constants.
    RFC: https://wiki.php.net/rfc/attributes-on-constants
  . The #[\Deprecated] attribute can now be used on constants.
    RFC: https://wiki.php.net/rfc/attributes-on-constants
  . Added the pipe (|>) operator.
    RFC: https://wiki.php.net/rfc/pipe-operator-v3
  . Constructor property promotion can now be used for final properties.
    RFC: https://wiki.php.net/rfc/final_promotion
  . #[\Override] can now be applied to properties.
    RFC: https://wiki.php.net/rfc/override_properties

- Curl:
  . Added support for share handles that are persisted across multiple PHP
    requests, safely allowing for more effective connection reuse.
    RFC: https://wiki.php.net/rfc/curl_share_persistence_improvement
  . Added support for CURLINFO_USED_PROXY (libcurl >= 8.7.0),
    CURLINFO_HTTPAUTH_USED, and CURLINFO_PROXYAUTH_USED
    (libcurl >= 8.12.0) to the curl_getinfo() function.
    When curl_getinfo() returns an array, the same information
    is available as "used_proxy", "httpauth_used", and "proxyauth_used"
    keys.
    CURLINFO_USED_PROXY gets zero set if no proxy was used in the
    previous transfer or a non-zero value if a proxy was used.
    CURLINFO_HTTPAUTH_USED and CURLINFO_PROXYAUTH_USED get bitmasks
    indicating the HTTP and proxy authentication methods that were
    used in the previous request. See CURLAUTH_* constants for
    possible values.
  . Added CURLOPT_INFILESIZE_LARGE Curl option, which is a safe
    replacement for CURLOPT_INFILESIZE. On certain systems,
    CURLOPT_INFILESIZE only accepts a 32-bit signed integer as the file
    size (2.0 GiB) even on 64-bit systems. CURLOPT_INFILESIZE_LARGE
    accepts the largest integer value the system can handle.
  . Added CURLFOLLOW_OBEYCODE, CURLFOLLOW_FIRSTONLY and CURLFOLLOW_ALL values for
    CURLOPT_FOLLOWLOCATION curl_easy_setopt option.
    CURLFOLLOW_OBEYCODE to follow more strictly in regard to redirect
    if they are allowed. CURLFOLLOW_FIRSTONLY to follow only the
    first redirect thus if there is any follow up redirect, it won't go
    any further. CURLFOLLOW_ALL is equivalent to setting CURLOPT_FOLLOWLOCATION
    to true.
  . Added support for CURLINFO_CONN_ID (libcurl >= 8.2.0) to the curl_getinfo()
    function. This constant allows retrieving the unique ID of the connection
    used by a cURL transfer. It is primarily useful when connection reuse or
    connection pooling logic is needed in PHP-level applications. When
    curl_getinfo() returns an array, this value is available as the "conn_id" key.
  . Added support for CURLINFO_QUEUE_TIME_T (libcurl >= 8.6.0) to the curl_getinfo()
    function. This constant allows retrieving the time (in microseconds) that the
    request spent in libcurl’s connection queue before it was sent.
    This value can also be retrieved by passing CURLINFO_QUEUE_TIME_T to the
    curl_getinfo() $option parameter.
  . Added support for CURLOPT_SSL_SIGNATURE_ALGORITHMS to specify the signature
    algorithms to use for TLS.

- DOM:
  . Added Dom\Element::$outerHTML.
  . Added $children property to Dom\ParentNode implementations.

- EXIF:
  . Add OffsetTime* Exif tags.

- Intl:
  . Added class constants NumberFormatter::CURRENCY_ISO,
    NumberFormatter::CURRENCY_PLURAL, NumberFormatter::CASH_CURRENCY,
    and NumberFormatter::CURRENCY_STANDARD for various currency-related
    number formats.
  . Added Locale::addLikelySubtags and Locale::minimizeSubtags to
    handle likely tags on a given locale.
  . Added IntlListFormatter class to format, order, and punctuate
    a list of items with a given locale, IntlListFormatter::TYPE_AND,
    IntlListFormatter::TYPE_OR, IntlListFormatter::TYPE_UNITS operands and
    IntlListFormatter::WIDTH_WIDE, IntlListFormatter::WIDTH_SHORT and
    IntlListFormatter::WIDTH_NARROW widths.
    It is supported from icu 67.

- PDO_Sqlite:
  . Added class constant Pdo_Sqlite::ATTR_BUSY_STATEMENT.
  . Added class constants Pdo_Sqlite::ATTR_EXPLAIN_STATEMENT,
    Pdo_Sqlite::EXPLAIN_MODE_PREPARED, Pdo_Sqlite::EXPLAIN_MODE_EXPLAIN,
    Pdo_Sqlite::EXPLAIN_MODE_EXPLAIN_QUERY_PLAN.

- SOAP:
  . Enumeration cases are now dumped in __getTypes().
  . Implemented request #61105:
    support for Soap 1.2 Reason Text xml:lang attribute.
    The signature of SoapFault::__construct() and SoapServer::fault() therefore
    now have an optional $lang parameter.
    This support solves compatibility with .NET SOAP clients.

- Sqlite:
  . Added class constants Sqlite3Stmt::EXPLAIN_MODE_PREPARED,
    Sqlite3Stmt::EXPLAIN_MODE_EXPLAIN and
    Sqlite3Stmt::EXPLAIN_MODE_EXPLAIN_QUERY_PLAN.

- Standard:
  . mail() now returns the actual sendmail error and detects if the sendmail
    process was terminated unexpectedly. In such cases, a warning is emitted
    and the function returns false. Previously, these errors were silently
    ignored. This change affects only the sendmail transport.
  . getimagesize() now supports HEIF/HEIC images.
  . getimagesize() now supports SVG images when ext-libxml is also loaded.
    Similarly, image_type_to_extension() and image_type_to_mime_type()
    now also handle IMAGETYPE_SVG.
  . The array returned by getimagesize() now has two additional entries:
    "width_unit" and "height_unit" to indicate in which units the dimensions
    are expressed. These units are px by default. They are not necessarily
    the same (just to give one example: one may be cm and the other may be px).

- XSL:
  . The $namespace argument of XSLTProcessor::getParameter(),
    XSLTProcessor::setParameter() and XSLTProcessor::removeParameter()
    now actually works instead of being treated as empty.
    This only works if the $name argument does not use Clark notation
    and is not a QName because in those cases the namespace is taken
    from the namespace href or prefix respectively.

- Zlib:
  . flock() is now supported on zlib streams. Previously, this always
    failed to perform any locking action.

========================================
3. Changes in SAPI modules
========================================

- CLI:
  . Trying to set a process title that is too long with cli_set_process_title()
    will now fail instead of silently truncating the given title.
  . Added a new --ini=diff option to print INI settings changed from the builtin
    default.

- FPM:
  . FPM with httpd ProxyPass decodes the full script path. Added
    fastcgi.script_path_encoded INI setting to prevent this new behavior.
  . FPM access log limit now respects log_limit value.

========================================
4. Deprecated Functionality
========================================

- Core:
  . Returning a non-string from a user output handler is deprecated. The
    deprecation warning will bypass the handler with the bad return to ensure
    it is visible; if there are nested output handlers the next one will still
    be used.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_4
  . Trying to produce output (e.g. with `echo`) within a user output handler
    is deprecated. The deprecation warning will bypass the handler producing the
    output to ensure it is visible; if there are nested output handlers the next
    one will still be used. If a user output handler returns a non-string and
    produces output, the warning about producing an output is emitted first.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_4
  . Non-canonical cast names (boolean), (integer), (double), and (binary) have
    been deprecated, use (bool), (int), (float), and (string) respectively.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_non-standard_cast_names
  . The $exclude_disabled parameter of the get_defined_functions() function has
    been deprecated, as it no longer has any effect since PHP 8.0.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_the_exclude_disabled_parameter_of_get_defined_functions
  . Terminating case statements with a semicolon instead of a colon has
    been deprecated.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_semicolon_after_case_in_switch_statement
  . The backtick operator as an alias for shell_exec() has been deprecated.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_backticks_as_an_alias_for_shell_exec
  . Returning null from __debugInfo() has been deprecated.
    Return an empty array instead.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_debuginfo_returning_null

- Curl:
  . The curl_close() function has been deprecated, as CurlHandle objects are
    freed automatically.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_curl_close
  . The curl_share_close() function has been deprecated, as CurlShareHandle
    objects are freed automatically.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_curl_share_close

- Date:
  . The DATE_RFC7231 and DateTimeInterface::RFC7231 constants have been
    deprecated. This is because the associated timezone is ignored and always
    uses GMT.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_date_rfc7231_and_datetimeinterfacerfc7231

- FileInfo:
  . The finfo_close() function has been deprecated.
    As finfo objects are freed automatically.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_finfo_close
  . The $context parameter of the finfo_buffer() function has been deprecated
    as it is ignored.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_the_context_parameter_for_finfo_buffer

- GD:
  . The imagedestroy() function has been deprecated, as GdImage objects are
    freed automatically.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_imagedestroy

- Hash:
  . The MHASH_* constants have been deprecated.  These have been overlooked
    when the mhash*() function family has been deprecated per
    https://wiki.php.net/rfc/deprecations_php_8_1#mhash_function_family

- Intl:
  . The intl.error_level INI setting has been deprecated.
    Errors should either be checked manually or exceptions should be enabled
    by using the intl.use_exceptions INI setting.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_intlerror_level_ini_setting

- MySQLi:
  . The mysqli_execute() alias function has been deprecated.
    Use mysqli_stmt_execute() instead.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#formally_deprecate_mysqli_execute

- OpenSSL:
  . The $key_length parameter for openssl_pkey_derive() has been deprecated.
    This is because it is either ignored, or truncates the key, which can be
    a vulnerability.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_key_length_parameter_of_openssl_pkey_derive

- PDO:
  . The "uri:" DSN scheme has been deprecated due to security concerns with
    DSNs coming from remote URIs.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_pdo_s_urischeme

- Reflection:
  . The setAccessible() methods of various Reflection objects have been
    deprecated, as those no longer have an effect.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_reflectionsetaccessible
  . Calling ReflectionClass::getConstant() for constants that do not exist has
    been deprecated.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_reflectionclassgetconstant_for_missing_constants
  . Calling ReflectionProperty::getDefaultValue() for properties without default
    values has been deprecated.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_reflectionpropertygetdefaultvalue_for_properties_without_default_values

- SPL:
  . Unregistering all autoloaders by passing the spl_autoload_call() function
    as a callback argument to spl_autoload_unregister() has been deprecated.
    Instead if this is needed, one should iterate over the return value of
    spl_autoload_functions() and call spl_autoload_unregister() on each value.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_passing_spl_autoload_call_to_spl_autoload_unregister
  . The SplObjectStorage::contains(), SplObjectStorage::attach(), and
    SplObjectStorage::detach() methods have been deprecated in favour of
    SplObjectStorage::offsetExists(), SplObjectStorage::offsetSet(), and
    SplObjectStorage::offsetUnset() respectively.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_splobjectstoragecontains_splobjectstorageattach_and_splobjectstoragedetach

- Standard:
  . The socket_set_timeout() alias function has been deprecated.
    Use stream_set_timeout() instead.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#formally_deprecate_socket_set_timeout
  . Passing null to to readdir(), rewinddir(), and closedir() to use the last
    opened directory has been deprecated. Provide the last opened directory
    explicitly instead.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_passing_null_to_readdir_rewinddir_and_closedir
  . Passing integers outside the interval [0, 255] to chr() is now deprecated.
    This is because a byte can only hold a value within this interval.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_passing_integers_outside_the_interval_0_255_to_chr

- XML:
  . The xml_parser_free() function has been deprecated, as XMLParser objects
    are freed automatically.
    RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_xml_parser_free

========================================
5. Changed Functions
========================================

- Intl:
  . IntlDateFormatter::setTimeZone()/datefmt_set_timezone()
    throws an IntlException on uninitialised classes/clone failures.
  . grapheme_extract() properly assigns $next value when skipping over
    invalid starting bytes. Previously there were cases where it would
    point to the start of the grapheme boundary instead of the end.
  . Locale:: methods throw a ValueError when locale inputs contain null
    bytes.
  . transliterator_get_error_code(), transliterator_get_error_message()
    TransLiterator::getErrorCode(), and TransLiterator::getErrorMessage()
    have dropped the false from the return type union. Returning false
    was actually never possible.

- LDAP:
  . ldap_get_option() now accepts a NULL connection, as ldap_set_option(),
    to allow retrieval of global options.

- libxml:
  . libxml_set_external_entity_loader() now has a formal return type of true.

- OpenSSL:
  . openssl_public_encrypt() and openssl_private_decrypt() have new parameter
    $digest_algo that allows specifying hash digest algorithm for OEAP padding.
  . openssl_sign() and openssl_verify() have new parameter $padding to allow
    using more secure RSA PSS padding.
  . openssl_cms_encrypt() $cipher_algo parameter can be a string with the
    cipher name. That allows to use more algorithms including AES GCM cipher
    algorithms for auth enveloped data.

- PCNTL:
  . pcntl_exec() now has a formal return type of false.
  . pcntl_waitid() takes an additional resource_usage argument to
    gather various platform specific metrics about the child process.

- PDO_PGSQL:
  . PDO::pgsqlCopyFromArray also supports inputs as Iterable.
  . Pdo\Pgsql::setAttribute and Pdo\Pgsql::prepare supports
    PDO::ATTR_PREFETCH sets to 0 which set to lazy fetch mode.
    In this mode, statements cannot be run in parallel.

- PDO_SQLITE:
  . SQLite PDO::quote() will now throw an exception or emit a warning,
    depending on the error mode, if the string contains a null byte.
  . PDO::sqliteCreateCollation will now throw an exception
    if the callback has the wrong return type, making it more
    in line with Pdo_Sqlite::createCollation behavior.

- PGSQL:
  . pg_copy_from also supports inputs as Iterable.
  . pg_connect checks if the connection_string argument contains
    any null byte.
  . pg_close_stmt checks if the statement_name argument contains
    any null byte.

- POSIX:
  . posix_ttyname sets last_error to EBADF when encountering
    an invalid file descriptor.
  . posix_isatty raises an E_WARNING message when encountering
    an invalid file descriptor.
  . posix_fpathconf checks invalid file descriptors and sets
    last_error to EBADF and raises an E_WARNING message.
  . posix_kill throws a ValueError when the process_id argument is lower
    or greater than what supports the platform (signed integer or long
    range), posix_setpgid throws a ValueError when the process_id or
    the process_group_id is lower than zero or greater than
    what supports the platform.
  . posix_setrlimit throws a ValueError when the hard_limit of soft_limit
    argument are lower than -1 or if soft_limit is greater than hard_limit.

- Reflection:
  . The output of ReflectionClass::__toString() for enums has changed to
    better indicate that the class is an enum, and that the enum cases
    are enum cases rather than normal class constants.
  . The output of ReflectionProperty::__toString() for properties with
    hooks has changed to indicate what hooks the property has, whether those
    hooks are final, and whether the property is virtual. This also affects
    the output of ReflectionClass::__toString() when a class contains hooked
    properties.

- Session:
  . session_start is stricter in regard to the option argument.
    It throws a ValueError if the whole is not a hashmap or
    a TypeError if read_and_close value is not a valid type
    compatible with int.

- SNMP:
  . snmpget, snmpset, snmp_get2, snmp_set2, snmp_get3, snmp_set3
    and SNMP::__construct() throw a ValueError when the hostname
    is too large, contains any null byte or if the port is given
    when negative or greater than 65535, timeout and retries values
    are lower than -1 or too large.

- Sockets:
  . socket_create_listen, socket_bind and socket_sendto throw a
    ValueError if the port is lower than 0 or greater than 65535,
    and also if any of the hints array entries are indexed numerically.
  . socket_addrinfo_lookup throws a TypeError if any of the hints
    values cannot be cast to int and can throw a ValueError if
    any of these values overflow.
  . socket_set_option with MCAST_LEAVE_GROUP/MCAST_LEAVE_SOURCE_GROUP
    options will throw an exception if the value isn't a valid object
    or array.
  . socket_create/socket_bind can create AF_PACKET family sockets.
  . socket_getsockname gets the interface index and its string
    representation with AF_PACKET socket.
  . socket_set_option with multicast context throws a ValueError
    when the created socket is not of AF_INET/AF_INET6 family.

- Tidy:
  . tidy::__construct/parseFile/parseString now throws a ValueError
    if the configuration contains an invalid or set a read-only
    internal entry, a TypeError contains, at least, one element
    when the key is not a string.

- Zlib:
  . The "use_include_path" argument for the
    gzfile, gzopen and readgzfile functions had been changed
    from int to boolean.
  . gzfile, gzopen and readgzfile functions now respect the default
    stream context.

========================================
6. New Functions
========================================

- Core:
  . get_error_handler() allows retrieving the current user-defined error handler
    function.
    RFC: https://wiki.php.net/rfc/get-error-exception-handler
  . get_exception_handler() allows retrieving the current user-defined exception
    handler function.
    RFC: https://wiki.php.net/rfc/get-error-exception-handler
  . The clone language construct is now a function and supports reassigning
    (readonly) properties during cloning via the new $withProperties parameter.
    RFC: https://wiki.php.net/rfc/clone_with_v2
  . Added Closure::getCurrent() to receive currently executing closure.

- Curl:
  . curl_multi_get_handles() allows retrieving all CurlHandles current
    attached to a CurlMultiHandle. This includes both handles added using
    curl_multi_add_handle() and handles accepted by CURLMOPT_PUSHFUNCTION.
  . curl_share_init_persistent() allows creating a share handle that is
    persisted across multiple PHP requests.
    RFC: https://wiki.php.net/rfc/curl_share_persistence_improvement

- DOM:
  . Added Dom\Element::getElementsByClassName().
  . Added Dom\Element::insertAdjacentHTML().

- Enchant:
  . Added enchant_dict_remove_from_session() to remove a word added to the
    spellcheck session via enchant_dict_add_to_session().
  . Added enchant_dict_remove() to put a word on the exclusion list and
    remove it from the session dictionary.

- Intl:
  . Added locale_is_right_to_left/Locale::isRightToLeft, returns true if
    the locale is written right to left (after its enrichment with likely subtags).
  . Added grapheme_levenshtein() function.
    RFC: https://wiki.php.net/rfc/grapheme_levenshtein

- Opcache:
  . Added opcache_is_script_cached_in_file_cache().

- Pdo\Sqlite:
  . Added support for Pdo\Sqlite::setAuthorizer(), which is the equivalent of
    SQLite3::setAuthorizer(). The only interface difference is that the
    pdo version returns void.

- PGSQL:
  . pg_close_stmt offers an alternative way to close a prepared
    statement from the DEALLOCATE sql command in that we can reuse
    its name afterwards.
  . pg_service returns the ongoing service name of the connection.

- Reflection:
  . ReflectionConstant::getFileName() was introduced.
  . ReflectionConstant::getExtension() and
    ReflectionConstant::getExtensionName() were introduced.
  . ReflectionConstant::getAttributes() was introduced.
    RFC: https://wiki.php.net/rfc/attributes-on-constants
  . ReflectionProperty::getMangledName() was introduced.

- Sqlite:
  . Sqlite3Stmt::busy to check if a statement had been fetched
    but not completely.

- Standard:
  . Added array_first() and array_last().
    RFC: https://wiki.php.net/rfc/array_first_last

========================================
7. New Classes and Interfaces
========================================

- Curl:
  . CurlSharePersistentHandle representing a share handle that is persisted
    across multiple PHP requests.
    RFC: https://wiki.php.net/rfc/curl_share_persistence_improvement

- URI:
  . Uri\UriException, Uri\InvalidUriException, Uri\UriComparisonMode,
    Uri\Rfc3986\Uri, Uri\WhatWg\InvalidUrlException,
    Uri\WhatWg\UrlValidationErrorType, Uri\WhatWg\UrlValidationError,
    and Uri\WhatWg\Url are added.
    RFC: https://wiki.php.net/rfc/url_parsing_api

========================================
8. Removed Extensions and SAPIs
========================================

========================================
9. Other Changes to Extensions
========================================

- Curl:
  . curl_easy_setopt with CURLOPT_FOLLOWLOCATION option's value no longer
    is treated as boolean but integer to handle CURLFOLLOW_OBEYCODE and
    CURLFOLLOW_FIRSTONLY.

- Fileinfo:
  . Upgraded file from 5.45 to 5.46.
  . The return type of finfo_close() has been changed to true, rather
    than bool.

- Intl:
  . Intl's internal error mechanism has been modernized so that it
    indicates more accurately which call site caused what error.
    Moreover, some ext/date exceptions have been wrapped inside a
    IntlException now.

- Lexbor:
  . An always enabled lexbor extension is added. It contains the lexbor
    library that was separated from ext/dom for being reused among other
    extensions. The new extension is not directly exposed to userland.

- Opcache:
  . The Opcache extension is now always built into the PHP binary and is always
    loaded. The INI directives opcache.enable and opcache.enable_cli are still
    honored.

- URI:
  . An always enabled uri extension is added that can be used for handling
    URIs and URLs according to RFC 3986 and WHATWG URL.
    RFC: https://wiki.php.net/rfc/url_parsing_api

- PCRE:
  . Upgraded pcre2lib from 10.44 to 10.45.

- PDO_Sqlite:
  . Increased minimum release version support from 3.7.7 to 3.7.17.

- Readline:
  . The return types of readline_add_history(), readline_clear_history(), and
    readline_callback_handler_install() have been changed to true, rather
    than bool.

========================================
10. New Global Constants
========================================

- Core:
  . PHP_BUILD_DATE.
  . PHP_BUILD_PROVIDER.

- Curl:
  . CURLINFO_USED_PROXY.
  . CURLINFO_HTTPAUTH_USED.
  . CURLINFO_PROXYAUTH_USED.
  . CURLINFO_CONN_ID.
  . CURLINFO_QUEUE_TIME_T.
  . CURLOPT_INFILESIZE_LARGE.
  . CURLFOLLOW_ALL.
  . CURLFOLLOW_OBEYCODE.
  . CURLFOLLOW_FIRSTONLY.

- Intl:
  . DECIMAL_COMPACT_SHORT.
  . DECIMAL_COMPACT_LONG.

- OpenSSL:
  . OPENSSL_PKCS1_PSS_PADDING
  . PKCS7_NOSMIMECAP
  . PKCS7_CRLFEOL
  . PKCS7_NOCRL
  . PKCS7_NO_DUAL_CONTENT

- POSIX:
  . POSIX_SC_OPEN_MAX.

- Sockets:
  . IPPROTO_ICMP/IPPROTO_ICMPV6.
  . TCP_FUNCTION_BLK (FreeBSD only).
  . TCP_FUNCTION_ALIAS (FreeBSD only).
  . TCP_REUSPORT_LB_NUMA (FreeBSD only).
  . TCP_REUSPORT_LB_NUMA_NODOM (FreeBSD only).
  . TCP_REUSPORT_LB_NUMA_CURDOM (FreeBSD only).
  . TCP_BBR_ALGORITHM (FreeBSD only).
  . AF_PACKET (Linux only).
  . IP_BINDANY (FreeBSD/NetBSD/OpenBSD only).
  . SO_BUSY_POLL (Linux only).
  . UDP_SEGMENT (Linux only).
  - SHUT_RD.
  - SHUT_WR.
  - SHUT_RDWR.

- Tokenizer:
  . T_VOID_CAST.
  . T_PIPE.

- Standard:
  . IMAGETYPE_SVG when libxml is loaded.

========================================
11. Changes to INI File Handling
========================================

- Core:
  . Added fatal_error_backtraces to control whether fatal errors should include
    a backtrace.
    RFC: https://wiki.php.net/rfc/error_backtraces_v2
  . Added startup-only max_memory_limit INI setting to control the maximum
    memory_limit that may be configured at startup or runtime. Exceeding this
    value emits a warning, unless set to -1, and sets memory_limit to the
    current max_memory_limit instead.
    ML discussion: https://externals.io/message/127108

- Opcache:
  . Added opcache.file_cache_read_only to support a read-only
    opcache.file_cache directory, for use with read-only file systems
    (e.g. read-only Docker containers).
    Best used with opcache.validate_timestamps=0,
    opcache.enable_file_override=1,
    and opcache.file_cache_consistency_checks=0.
    Note: A cache generated with a different build of PHP, a different file
    path, or different settings (including which extensions are loaded), may be
    ignored.
  . The default value of opcache.jit_hot_loop is now 61 (a prime) to prevent it
    from being a multiple of loop iteration counts.
    It is recommended that this parameter is set to a prime number.
  . Changing opcache.memory_consumption when OPcache SHM is already set up
    will now correctly report a failure instead of silently doing nothing and
    showing misleading values in PHPInfo.

- OpenSSL:
  . Added openssl.libctx to select the OpenSSL library context type. Either
    custom libctx for each thread can be used or a single global (default)
    libctx is used.

========================================
12. Windows Support
========================================

* The configuration variables PHP_VERSION, PHP_MINOR_VERSION, and
  PHP_RELEASE_VERSION are now always numbers.  Previously, they have been
  strings for buildconf builds.

* phpize builds now reflect the source tree in the build dir (like that already
  worked for in-tree builds); some extension builds (especially when using
  Makefile.frag.w32) may need adjustments.

* --enable-sanitizer is now supported for MSVC builds.  This enables ASan and
  debug assertions, and is supported as of MSVC 16.10 and Windows 10.

* The --with-uncritical-warn-choke configuration option for clang builds is
  no longer supported.  Select warnings to suppress via CFLAGS instead.

* COM:
  . The extension is now build shared by default; previously it defaulted to a
    static extension, although the official Windows binaries built a shared
    extension.

* FFI:
  . It is no longer necessary to specify the library when using FFI::cdef()
    and FFI::load(). However, this convenience feature should not be used in
    production.

* Streams:
  . If only pipe streams are contained in the $read array, and the $write and
    $except arrays are empty, stream_select() now behaves similar to POSIX
    systems, i.e. the function only returns if at least one pipe is ready to be
    read, or after the timeout expires.  Previously, stream_select() returned
    immediately, reporting all streams as ready to read.

========================================
13. Other Changes
========================================

- Core:
  . The high resolution timer (`hrtime()`) on macOS now uses the recommended
    `clock_gettime_nsec_np(CLOCK_UPTIME_RAW)` API instead of
    `mach_absolute_time()`.

- CLI/CGI:
  . The `-z` or `--zend-extension` option has been removed as it was
    non-functional. Use `-d zend_extension=<path>` instead.

- PDO_ODBC
  . The fetch behaviour for larger columns has been changed. Rather than
    fetching 256 byte blocks, PDO_ODBC will try to fetch a larger block size;
    currently, this is the page size minus string overhead. Drivers that
    return SQL_NO_TOTAL in SQLGetData are also better handled as well.
    This should improve compatibility and performance. See GH-10809, GH-10733.

========================================
14. Performance Improvements
========================================

- Core:
  . Remove OPcodes for identity comparisons against booleans, particularly
    for the match(true) pattern.
  . Add OPcode specialization for `=== []` and `!== []` comparisons.
  . Creating exception objects is now much faster.
  . The parts of the code that used SSE2 have been adapted to use SIMD
    with ARM NEON as well.

- Intl:
  . Now avoids creating extra string copies when converting strings
    for use in the collator.

- MBString:
  . The parts of the code that used SSE2 have been adapted to use SIMD
    with ARM NEON as well.

- Opcache:
  . Improved performance of fetching TLS variables in JIT'ed code in non-Glibc
    builds.

- ReflectionProperty:
  . Improved performance of the following methods: getValue(), getRawValue(),
    isInitialized(), setValue(), setRawValue().

- SPL:
  . Improved performance of dimension accessors and methods of SplFixedArray.

- Standard:
  . Improved performance of array functions with callbacks
    (array_find, array_filter, array_map, usort, ...).
  . Improved performance of urlencode() and rawurlencode().
  . Improved unpack() performance with nameless repetitions by avoiding
    creating temporary strings and reparsing them.
  . Improved pack() performance.
  . Minor improvements in array_chunk() performance.

- XMLReader:
  . Improved property access performance.

- XMLWriter:
  . Improved performance and reduce memory consumption.