PHP 8.5.0 변경 기록과 적용 점검

PHP 8.5.0 변경 사항

공식 php-src 태그의 NEWS에서 이 버전의 항목만 추출했습니다. 아래 구성요소와 확인 순서는 원문에 따라 자동 구성됩니다. 애플리케이션 호환성이나 취약점 영향 여부를 판정하지 않습니다.

변경된 구성요소

Core · BCMath · Bz2 · CLI · COM · Curl · Date · DOM · Enchant · EXIF · FileInfo · Filter · FPM · GD · Iconv · Intl · LDAP · MBstring · MySQLi · MySQLnd · ODBC · Opcache · OpenSSL · Output · PCNTL · PCRE · PDO · PDO_ODBC · PDO_PGSQL · PDO_SQLITE · PGSQL · Phar · POSIX · Random · Reflection · SAPI · Session · SimpleXML · SNMP · SOAP · Sockets · Sodium · SPL · Sqlite · Standard · Streams · Tests · Tidy · Tokenizer · Windows · XML · XMLWriter · XSL · Zlib · Zip

원문에 명시된 CVE

이 NEWS 항목에 CVE 번호가 명시되어 있지 않습니다. 보안 문제가 없다는 의미는 아닙니다.

사용 환경별 확인 순서

• php -v와 php -m으로 실제 실행 버전과 확장 목록을 확인하고 아래 원문에서 사용 중인 구성요소의 변경을 찾으세요.
• composer check-platform-reqs로 설치 환경의 요구사항을 확인하세요. 성공하더라도 동작 호환성까지 보장하지는 않습니다.
• 날짜·시간대를 사용한다면 Carbon 및 날짜 변환 테스트에서 변경 항목과 관련된 입력을 점검하세요.
• PHP-FPM을 사용한다면 스테이징에서 프로세스 재시작과 오류 로그를 확인하세요.
• PDO를 사용한다면 실제 데이터베이스 드라이버로 조회·트랜잭션 테스트를 실행하세요.
• PostgreSQL을 사용한다면 해당 확장과 드라이버의 쿼리 처리를 점검하세요.
• TLS 연결을 사용한다면 외부 API·메일 서버 연결과 인증서 검증을 점검하세요.
• GD를 사용한다면 이미지 업로드·리사이즈 처리를 실제 파일로 확인하세요.
• BCMath를 사용한다면 금액·정밀도·부호 경계값의 계산 결과를 확인하세요.
• 배포 전 스테이징에서 애플리케이션 테스트를 실행하고, 배포 후 웹 프로세스와 큐 워커가 새 PHP를 사용하는지 확인하세요.

공식 변경 기록

20 Nov 2025, PHP 8.5.0

• Core: . Added the #[\NoDiscard] attribute to indicate that a function's return value is important and should be consumed. (timwolla, edorian) . Added the (void) cast to indicate that not using a value is intentional. (timwolla, edorian) . Added get_error_handler(), get_exception_handler() functions. (Arnaud) . Added support for casts in constant expressions. (nielsdos) . Added the pipe (|>) operator. (crell) . Added support for final with constructor property promotion. (DanielEScherzer) . Added support for configuring the URI parser for the FTP/FTPS as well as the SSL/TLS stream wrappers as described in https://wiki.php.net/rfc/url_parsing_api#plugability. (kocsismate) . Added PHP_BUILD_PROVIDER constant. (timwolla) . Added PHP_BUILD_DATE constant. (cmb) . Added support for Closures and first class callables in constant expressions. (timwolla, edorian) . Add support for backtraces for fatal errors. (enorris) . Add clone-with support to the clone() function. (timwolla, edorian) . Add RFC 3986 and WHATWG URL compliant APIs for URL parsing and manipulation (kocsismate, timwolla) . Fixed AST printing for immediately invoked Closure. (Dmitrii Derepko) . Properly handle __debugInfo() returning an array reference. (nielsdos) . Properly handle reference return value from __toString(). (nielsdos) . Improved error message of UnhandledMatchError for zend.exception_string_param_max_len=0. (timwolla) . Fixed bug GH-15753 and GH-16198 (Bind traits before parent class). (ilutov) . Fixed bug GH-17951 (memory_limit is not always limited by max_memory_limit). (manuelm) . Fixed bug GH-20183 (Stale EG(opline_before_exception) pointer through eval). (ilutov) . Fixed bug GH-20113 (Missing new Foo(...) error in constant expressions). (ilutov) . Fixed bug GH-19844 (Don't bail when closing resources on shutdown). (ilutov) . Fixed bug GH-20177 (Accessing overridden private property in get_object_vars() triggers assertion error). (ilutov) . Fix OSS-Fuzz #447521098 (Fatal error during sccp shift eval). (ilutov) . Fixed bug GH-20002 (Broken build on *BSD with MSAN). (outtersg) . Fixed bug GH-19352 (Cross-compilation with musl C library). (henderkes, Peter Kokot) . Fixed bug GH-19765 (object_properties_load() bypasses readonly property checks). (timwolla) . Fixed hard_timeout with --enable-zend-max-execution-timers. (Appla) . Fixed bug GH-19839 (Incorrect HASH_FLAG_HAS_EMPTY_IND flag on userland array). (ilutov) . Fixed bug GH-19823 (register_argc_argv deprecation emitted twice when using OPcache). (timwolla) . Fixed bug GH-19480 (error_log php.ini cannot be unset when open_basedir is configured). (nielsdos) . Fixed bug GH-19719 (Allow empty statements before declare(strict_types)). (nielsdos) . Fixed bug GH-19934 (CGI with auto_globals_jit=0 causes uouv). (ilutov) . Fixed bug GH-19613 (Stale array iterator pointer). (ilutov) . Fixed bug GH-19679 (zend_ssa_range_widening may fail to converge). (Arnaud) . Fixed bug GH-19681 (PHP_EXPAND_PATH broken with bash 5.3.0). (Remi) . Fixed bug GH-18850 (Repeated inclusion of file with __halt_compiler() triggers "Constant already defined" warning). (ilutov) . Fixed bug GH-19476 (pipe operator fails to correctly handle returning by reference). (alexandre-daubois) . Fixed bug GH-19081 (Wrong lineno in property error with constructor property promotion). (ilutov) . Fixed bug GH-17959 (Relax missing trait fatal error to error exception). (ilutov) . Fixed bug GH-18033 (NULL-ptr dereference when using register_tick_function in destructor). (nielsdos) . Fixed bug GH-18026 (Improve "expecting token" error for ampersand). (ilutov) . The report_memleaks INI directive has been deprecated. (alexandre-daubois) . Fixed OSS-Fuzz #439125710 (Pipe cannot be used in write context). (nielsdos) . Fixed bug GH-19548 (Shared memory violation on property inheritance). (alexandre-daubois) . Fixed bug GH-19544 (GC treats ZEND_WEAKREF_TAG_MAP references as WeakMap references). (Arnaud, timwolla) . Fixed bug GH-18373 (Don't substitute self/parent with anonymous class). (ilutov) . Fix support for non-userland stream notifiers. (timwolla) . Fixed bug GH-19305 (Operands may be being released during comparison). (Arnaud) . Fixed bug GH-19306 (Generator can be resumed while fetching next value from delegated Generator). (Arnaud) . Fixed bug GH-19326 (Calling Generator::throw() on a running generator with a non-Generator delegate crashes). (Arnaud) . Fix OSS-Fuzz #427814452 (pipe compilation fails with assert). (nielsdos, ilutov) . Fixed bug GH-16665 (\array and \callable should not be usable in class_alias). (nielsdos) . Use clock_gettime_nsec_np() for high resolution timer on macOS if available. (timwolla) . Make clone() a function. (timwolla, edorian) . Introduced the TAILCALL VM, enabled by default when compiling with Clang>=19 on x86_64 or aarch64. (Arnaud) . Enacted the follow-up phase of the "Path to Saner Increment/Decrement operators" RFC, meaning that incrementing non-numeric strings is now deprecated. (Girgias). . Various closure binding issues are now deprecated. (alexandre-daubois) . Constant redeclaration has been deprecated. (alexandre-daubois) . Marks the stack as non-executable on Haiku. (David Carlier) . Deriving $_SERVER['argc'] and $_SERVER['argv'] from the query string is now deprecated. (timwolla, nicolasgrekas) . Using null as an array offset or when calling array_key_exists() is now deprecated. (alexandre-daubois) . The disable_classes INI directive has been removed. (Girgias) . The locally predefined variable $http_response_header is deprecated. (Girgias) . Non-canonical cast names (boolean), (integer), (double), and (binary) have been deprecated. (Girgias) . The $exclude_disabled parameter of the get_defined_functions() function has been deprecated, as it no longer has any effect since PHP 8.0. (Girgias) . Terminating case statements with a semicolon instead of a colon has been deprecated. (theodorejb) . The backtick operator as an alias for shell_exec() has been deprecated. (timwolla) . Returning null from __debugInfo() has been deprecated. (DanielEScherzer) . Support #[\Override] on properties. (Jiří Pudil) . Destructing non-array values (other than NULL) using [] or list() now emits a warning. (Girgias) . Casting floats that are not representable as ints now emits a warning. (Girgias) . Casting NAN to other types now emits a warning. (Girgias) . Implement GH-15680 (Enhance zend_dump_op_array to properly represent non-printable characters in string literals). (nielsdos, WangYihang) . Fixed bug GH-17442 (Engine UAF with reference assign and dtor). (nielsdos) . Do not use RTLD_DEEPBIND if dlmopen is available. (Daniil Gentili)

• BCMath: . Simplify bc_divide() code. (SakiTakamachi) . If the result is 0, n_scale is set to 0. (SakiTakamachi) . If size of BC_VECTOR array is within 64 bytes, stack area is now used. (SakiTakamachi) . Fixed bug GH-20006 (Power of 0 of BcMath number causes UB). (nielsdos)

• Bz2: . Fixed bug GH-19810 (Broken bzopen() stream mode validation). (ilutov)

• CLI: . Add --ini=diff to print INI settings changed from the builtin default. (timwolla) . Drop support for -z CLI/CGI flag. (nielsdos) . Fixed GH-17956 - development server 404 page does not adapt to mobiles. (pascalchevrel) . Fix useless "Failed to poll event" error logs due to EAGAIN in CLI server with PHP_CLI_SERVER_WORKERS. (leotaku) . Fixed bug GH-19461 (Improve error message on listening error with IPv6 address). (alexandre-daubois)

• COM: . Fixed property access of PHP objects wrapped in variant. (cmb) . Fixed method calls for PHP objects wrapped in variant. (cmb)

• Curl: . Added CURLFOLLOW_ALL, CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY values for CURLOPT_FOLLOWLOCATION curl_easy_setopt option. (David Carlier) . Added curl_multi_get_handles(). (timwolla) . Added curl_share_init_persistent(). (enorris) . Added CURLINFO_USED_PROXY, CURLINFO_HTTPAUTH_USED, and CURLINFO_PROXYAUTH_USED support to curl_getinfo. (Ayesh Karunaratne) . Add support for CURLINFO_CONN_ID in curl_getinfo() (thecaliskan) . Add support for CURLINFO_QUEUE_TIME_T in curl_getinfo() (thecaliskan) . Add support for CURLOPT_SSL_SIGNATURE_ALGORITHMS. (Ayesh Karunaratne) . The curl_close() function has been deprecated. (DanielEScherzer) . The curl_share_close() function has been deprecated. (DanielEScherzer) . Fix cloning of CURLOPT_POSTFIELDS when using the clone operator instead of the curl_copy_handle() function to clone a CurlHandle. (timwolla)

• Date: . Fix undefined behaviour problems regarding integer overflow in extreme edge cases. (nielsdos, cmb, ilutov) . The DATE_RFC7231 and DateTimeInterface::RFC7231 constants have been deprecated. (jorgsowa) . Fixed date_sunrise() and date_sunset() with partial-hour UTC offset. (ilutov) . Fixed GH-17159: "P" format for ::createFromFormat swallows string literals. (nielsdos) . The __wakeup() magic method of DateTimeInterface, DateTime, DateTimeImmutable, DateTimeZone, DateInterval, and DatePeriod has been deprecated in favour of the __unserialize() magic method. (Girgias)

• DOM: . Added Dom\Element::$outerHTML. (nielsdos) . Added Dom\Element::insertAdjacentHTML(). (nielsdos) . Added $children property to ParentNode implementations. (nielsdos) . Make cloning DOM node lists, maps, and collections fail. (nielsdos) . Added Dom\Element::getElementsByClassName(). (nielsdos) . Fixed bug GH-18877 (\Dom\HTMLDocument querySelectorAll selecting only the first when using ~ and :has). (nielsdos, lexborisov) . Fix getNamedItemNS() incorrect namespace check. (nielsdos)

• Enchant: . Added enchant_dict_remove_from_session(). (nielsdos) . Added enchant_dict_remove(). (nielsdos) . Fix missing empty string checks. (nielsdos)

• EXIF: . Add OffsetTime* Exif tags. (acc987) . Added support to retrieve Exif from HEIF file. (Benstone Zhang) . Fix OSS-Fuzz #442954659 (zero-size box in HEIF file causes infinite loop). (nielsdos) . Fix OSS-Fuzz #442954659 (Crash in exif_scan_HEIF_header). (nielsdos) . Various hardening fixes to HEIF parsing. (nielsdos)

• FileInfo: . The finfo_close() function has been deprecated. (timwolla) . The $context parameter of the finfo_buffer() function has been deprecated as it is ignored. (Girgias) . Upgrade to file 5.46. (nielsdos) . Change return type of finfo_close() to true. (timwolla)

• Filter: . Added support for configuring the URI parser for FILTER_VALIDATE_URL as described in https://wiki.php.net/rfc/url_parsing_api#plugability. (kocsismate) . Fixed bug GH-16993 (filter_var_array with FILTER_VALIDATE_INT|FILTER_NULL_ON_FAILURE should emit warning for invalid filter usage). (alexandre-daubois)

• FPM: . Fixed bug GH-19817 (Decode SCRIPT_FILENAME issue in php 8.5). (Jakub Zelenka) . Fixed bug GH-19989 (PHP 8.5 FPM access log lines also go to STDERR). (Jakub Zelenka) . Fixed GH-17645 (FPM with httpd ProxyPass does not decode script path). (Jakub Zelenka) . Make FPM access log limit configurable using log_limit. (Jakub Zelenka) . Fixed failed debug assertion when php_admin_value setting fails. (ilutov) . Fixed GH-8157 (post_max_size evaluates .user.ini too late in php-fpm). (Jakub Zelenka)

• GD: . Fixed bug #68629 (Transparent artifacts when using imagerotate). (pierre, cmb) . Fixed bug #64823 (ZTS GD fails to find system TrueType font). (cmb) . Fix incorrect comparison with result of php_stream_can_cast(). (Girgias) . The imagedestroy() function has been deprecated. (DanielEScherzer)

• Iconv: . Extends the ICONV_CONST preprocessor for illumos/solaris. (jMichaelA)

• Intl: . Bumped ICU requirement to ICU >= 57.1. (cmb) . IntlDateFormatter::setTimeZone()/datefmt_set_timezone() throws an exception with uninitialised classes or clone failure. (David Carlier) . Added DECIMAL_COMPACT_SHORT/DECIMAL_COMPACT_LONG for NumberFormatter class. (BogdanUngureanu) . Added Locale::isRightToLeft to check if a locale is written right to left. (David Carlier) . Added null bytes presence in locale inputs for Locale class. (David Carlier) . Added grapheme_levenshtein() function. (Yuya Hamada) . Added Locale::addLikelySubtags/Locale::minimizeSubtags to handle adding/removing likely subtags to a locale. (David Carlier) . Added IntlListFormatter class to format a list of items with a locale, operands types and units. (BogdanUngureanu) . Added grapheme_strpos(), grapheme_stripos(), grapheme_strrpos(), grapheme_strripos(), grapheme_substr(), grapheme_strstr(), grapheme_stristr() and grapheme_levenshtein() functions add $locale parameter (Yuya Hamada). . Fixed bug GH-11952 (Fix locale strings canonicalization for IntlDateFormatter and NumberFormatter). (alexandre-daubois) . Fixed bug GH-18566 ([intl] Weird numeric sort in Collator). (nielsdos) . Fix return value on failure for resourcebundle count handler. (Girgias) . Fixed bug GH-19307 (PGO builds of shared ext-intl are broken). (cmb) . Intl's internal error mechanism has been modernized so that it indicates more accurately which call site caused what error. Moreover, some ext/date exceptions have been wrapped inside a IntlException now. (Girgias) . The intl.error_level INI setting has been deprecated. (Girgias)

• LDAP: . Allow ldap_get_option to retrieve global option by allowing NULL for connection instance ($ldap). (Remi)

• MBstring: . Updated Unicode data tables to Unicode 17.0. (Yuya Hamada)

• MySQLi: . Fixed bugs GH-17900 and GH-8084 (calling mysqli::__construct twice). (nielsdos) . The mysqli_execute() alias function has been deprecated. (timwolla)

• MySQLnd: . Added mysqlnd.collect_memory_statistics to ini quick reference. (hauk92)

• ODBC: . Removed driver-specific build flags and support. (Calvin Buckley) . Remove ODBCVER and assume ODBC 3.5. (Calvin Buckley)

• Opcache: . Make OPcache non-optional (Arnaud, timwolla) . Added opcache.file_cache_read_only. (Samuel Melrose) . Updated default value of opcache.jit_hot_loop. (Arnaud) . Log a warning when opcache lock file permissions could not be changed. (Taavi Eomäe) . Fixed bug GH-20012 (heap buffer overflow in jit). (Arnaud) . Partially fixed bug GH-17733 (Avoid calling wrong function when reusing file caches across differing environments). (ilutov) . Disallow changing opcache.memory_consumption when SHM is already set up. (timwolla) . Fixed bug GH-15074 (Compiling opcache statically into ZTS PHP fails). (Arnaud) . Fixed bug GH-17422 (OPcache bypasses the user-defined error handler for deprecations). (Arnaud, timwolla) . Fixed bug GH-19301 (opcache build failure). (Remi) . Fixed bug GH-20081 (access to uninitialized vars in preload_load()). (Arnaud) . Fixed bug GH-20121 (JIT broken in ZTS builds on MacOS 15). (Arnaud, Shivam Mathur) . Fixed bug GH-19875 (JIT 1205 segfault on large file compiled in subprocess). (Arnaud) . Fixed segfault in function JIT due to NAN to bool warning. (Girgias) . Fixed bug GH-19984 (Double-free of EG(errors)/persistent_script->warnings on persist of already persisted file). (ilutov, Arnaud) . Fixed bug GH-19889 (race condition in zend_runtime_jit(), zend_jit_hot_func()). (Arnaud) . Fixed bug GH-19669 (assertion failure in zend_jit_trace_type_to_info_ex). (Arnaud) . Fixed bug GH-19831 (function JIT may not deref property value). (Arnaud) . Fixed bug GH-19486 (Incorrect opline after deoptimization). (Arnaud) . Fixed bug GH-19601 (Wrong JIT stack setup on aarch64/clang). (Arnaud) . Fixed bug GH-19388 (Broken opcache.huge_code_pages). (Arnaud) . Fixed bug GH-19657 (Build fails on non-glibc/musl/freebsd/macos/win platforms). (Arnaud) . Fixed ZTS OPcache build on Cygwin. (cmb) . Fixed bug GH-19493 (JIT variable not stored before YIELD). (Arnaud)

• OpenSSL: . Added openssl.libctx INI that allows to select the OpenSSL library context type and convert various parts of the extension to use the custom libctx. (Jakub Zelenka) . Add $digest_algo parameter to openssl_public_encrypt() and openssl_private_decrypt() functions. (Jakub Zelenka) . Implement #81724 (openssl_cms_encrypt only allows specific ciphers). (Jakub Zelenka) . Implement #80495 (Enable to set padding in openssl_(sign|verify). (Jakub Zelenka) . Implement #47728 (openssl_pkcs7_sign ignores new openssl flags). (Jakub Zelenka) . Fixed bug GH-19994 (openssl_get_cipher_methods inconsistent with fetching). (Jakub Zelenka) . Fixed build when --with-openssl-legacy-provider set. (Jakub Zelenka) . Fixed bug GH-19369 (8.5 | Regression in openssl_sign() - support for alias algorithms appears to be broken). (Jakub Zelenka) . The $key_length parameter for openssl_pkey_derive() has been deprecated. (Girgias)

• Output: . Fixed calculation of aligned buffer size. (cmb)

• PCNTL: . Extend pcntl_waitid with rusage parameter. (vrza)

• PCRE: . Remove PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK from pcre compile options. (mvorisek)

• PDO: . Fixed bug GH-20095 (Incorrect class name in deprecation message for PDO mixins). (timwolla) . Driver specific methods and constants in the PDO class are now deprecated. (Arnaud) . The "uri:" DSN scheme has been deprecated due to security concerns with DSNs coming from remote URIs. (timwolla)

• PDO_ODBC: . Fetch larger block sizes and better handle SQL_NO_TOTAL when calling SQLGetData. (Calvin Buckley, Saki Takamachi)

• PDO_PGSQL: . Added Iterable support for PDO::pgsqlCopyFromArray. (KentarouTakeda) . Implement GH-15387 Pdo\Pgsql::setAttribute(PDO::ATTR_PREFETCH, 0) or Pdo\Pgsql::prepare(…, [ PDO::ATTR_PREFETCH => 0 ]) make fetch() lazy instead of storing the whole result set in memory (Guillaume Outters)

• PDO_SQLITE: . Add PDO\Sqlite::ATTR_TRANSACTION_MODE connection attribute. (Samuel Štancl) . Implement GH-17321: Add setAuthorizer to Pdo\Sqlite. (nielsdos) . PDO::sqliteCreateCollation now throws a TypeError if the callback has a wrong return type. (David Carlier) . Added Pdo_Sqlite::ATTR_BUSY_STATEMENT constant to check if a statement is currently executing. (David Carlier) . Added Pdo_Sqlite::ATTR_EXPLAIN_STATEMENT constant to set a statement in either EXPLAIN_MODE_PREPARED, EXPLAIN_MODE_EXPLAIN, EXPLAIN_MODE_EXPLAIN_QUERY_PLAN modes. (David Carlier) . Fix bug GH-13952 (sqlite PDO::quote silently corrupts strings with null bytes) by throwing on null bytes. (divinity76)

• PGSQL: . Added pg_close_stmt to close a prepared statement while allowing its name to be reused. (David Carlier) . Added Iterable support for pgsql_copy_from. (David Carlier) . pg_connect checks if connection_string contains any null byte, pg_close_stmt check if the statement contains any null byte. (David Carlier) . Added pg_service to get the connection current service identifier. (David Carlier) . Fix segfaults when attempting to fetch row into a non-instantiable class name. (Girgias, nielsdos)

• Phar: . Fix potential buffer length truncation due to usage of type int instead of type size_t. (Girgias) . Fixed memory leaks when verifying OpenSSL signature. (Girgias)

• POSIX: . Added POSIX_SC_OPEN_MAX constant to get the number of file descriptors a process can handle. (David Carlier) . posix_ttyname() sets last_error to EBADF on invalid file descriptors, posix_isatty() raises E_WARNING on invalid file descriptors, posix_fpathconf checks invalid file descriptors. (David Carlier) . posix_kill and posix_setpgid throws a ValueError on invalid process_id. (David Carlier) . posix_setpgid throws a ValueError on invalid process_group_id, posix_setrlimit throws a ValueError on invalid soft_limit and hard_limit arguments. (David Carlier)

• Random: . Moves from /dev/urandom usage to arc4random_buf on Haiku. (David Carlier)

• Reflection: . Added ReflectionConstant::getExtension() and ::getExtensionName(). (DanielEScherzer) . Added ReflectionProperty::getMangledName() method. (alexandre-daubois) . ReflectionConstant is no longer final. (sasezaki) . The setAccessible() methods of various Reflection objects have been deprecated, as those no longer have an effect. (timwolla) . ReflectionClass::getConstant() for constants that do not exist has been deprecated. (DanielEScherzer) . ReflectionProperty::getDefaultValue() for properties without default values has been deprecated. (DanielEScherzer) . Fixed bug GH-12856 (ReflectionClass::getStaticPropertyValue() returns UNDEF zval for uninitialized typed properties). (nielsdos) . Fixed bug GH-15766 (ReflectionClass::__toString() should have better output for enums). (DanielEScherzer) . Fix GH-19691 (getModifierNames() not reporting asymmetric visibility). (DanielEScherzer) . Fixed bug GH-17927 (Reflection: have some indication of property hooks in _property_string()). (DanielEScherzer) . Fixed bug GH-19187 (ReflectionNamedType::getName() prints nullable type when retrieved from ReflectionProperty::getSettableType()). (ilutov) . Fixed bug GH-20217 (ReflectionClass::isIterable() incorrectly returns true for classes with property hooks). (alexandre-daubois)

• SAPI: . Fixed bug GH-18582 and #81451: http_response_code() does not override the status code generated by header(). (ilutov, Jakub Zelenka)

• Session: . session_start() throws a ValueError on option argument if not a hashmap or a TypeError if read_and_close value is not compatible with int. (David Carlier) . Added support for partitioned cookies. (nielsdos) . Fix RC violation of session SID constant deprecation attribute. (ilutov) . Fixed GH-19197: build broken with ZEND_STRL usage with memcpy when implemented as macro. (David Carlier)

• SimpleXML: . Fixed bug GH-12231 (SimpleXML xpath should warn when returning other return types than node lists). (nielsdos)

• SNMP: . snmpget, snmpset, snmp_get2, snmp_set2, snmp_get3, snmp_set3 and SNMP::__construct() throw an exception on invalid hostname, community timeout and retries arguments. (David Carlier)

• SOAP: . Added support for configuring the URI parser for SoapClient::__doRequest() as described in https://wiki.php.net/rfc/url_parsing_api#plugability. (kocsismate) . Implement request #55503 (Extend __getTypes to support enumerations). (nielsdos, datibbaw) . Implement request #61105 (Support Soap 1.2 SoapFault Reason Text lang attribute). (nielsdos) . Fixed bug #49169 (SoapServer calls wrong function, although "SOAP action" header is correct). (nielsdos) . Fix namespace handling of WSDL and XML schema in SOAP, fixing at least GH-16320 and bug #68576. (nielsdos) . Fixed bug #70951 (Segmentation fault on invalid WSDL cache). (nielsdos) . Fixed bug GH-19773 (SIGSEGV due to uninitialized soap_globals->lang_en). (nielsdos, KaseyJenkins) . Fixed bug GH-19226 (Segfault when spawning new thread in soap extension). (Florian Engelhardt)

• Sockets: . Added IPPROTO_ICMP/IPPROTO_ICMPV6 to create raw socket for ICMP usage. (David Carlier) . Added TCP_FUNCTION_BLK to change the TCP stack algorithm on FreeBSD. (David Carlier) . Added IP_BINDANY for a socket to bind to any address. (David Carlier) . Added SO_BUSY_POOL to reduce packets poll latency. (David Carlier) . Added UDP_SEGMENT support to optimise multiple large datagrams over UDP if the kernel and hardware supports it. (David Carlier) . Added SHUT_RD, SHUT_WR and SHUT_RDWR constants for socket_shutdown(). (David Carlier) . Added TCP_FUNCTION_ALIAS, TCP_REUSPORT_LB_NUMA, TCP_REUSPORT_LB_NUMA_NODOM, TCP_REUSPORT_LB_CURDOM, TCP_BBR_ALGORITHM constants. . socket_set_option() catches possible overflow with SO_RCVTIMEO/SO_SNDTIMEO with timeout setting on windows. (David Carlier) . socket_create_listen() throws an exception on invalid port value. (David Carlier) . socket_bind() throws an exception on invalid port value. (David Carlier) . socket_sendto() throws an exception on invalid port value. (David Carlier) . socket_addrinfo_lookup throws an exception on invalid hints value types. (David Carlier) . socket_addrinfo_lookup throws an exception if any of the hints value overflows. (David Carlier) . socket_addrinfo_lookup throws an exception if one or more hints entries has an index as numeric. (David Carlier) . socket_set_option with the options MCAST_LEAVE_GROUP/MCAST_LEAVE_SOURCE_GROUP will throw an exception if its value is not a valid array/object. (David Carlier) . socket_getsockname/socket_create/socket_bind handled AF_PACKET family socket. (David Carlier) . socket_set_option for multicast context throws a ValueError when the socket family is not of AF_INET/AF_INET6 family. (David Carlier)

• Sodium: . Fix overall theoretical overflows on zend_string buffer allocations. (David Carlier/nielsdos)

• SPL: . Fixed bug GH-20101 (SplHeap/SplPriorityQueue serialization exposes INDIRECTs). (nielsdos) . Improve __unserialize() hardening for SplHeap/SplPriorityQueue. (nielsdos) . Deprecate ArrayObject and ArrayIterator with objects. (Girgias) . Unregistering all autoloaders by passing the spl_autoload_call() function as a callback argument to spl_autoload_unregister() has been deprecated. Instead if this is needed, one should iterate over the return value of spl_autoload_functions() and call spl_autoload_unregister() on each value. (Girgias) . The SplObjectStorage::contains(), SplObjectStorage::attach(), and SplObjectStorage::detach() methods have been deprecated in favour of SplObjectStorage::offsetExists(), SplObjectStorage::offsetSet(), and SplObjectStorage::offsetUnset() respectively. (Girgias)

• Sqlite: . Added Sqlite3Stmt::busy to check if a statement is still being executed. (David Carlier) . Added Sqlite3Stmt::explain to produce an explain query plan from the statement. (David Carlier) . Added Sqlite3Result::fetchAll to return all results at once from a query. (David Carlier)

• Standard: . Add HEIF/HEIC support to getimagesize. (Benstone Zhang) . Added support for partitioned cookies. (nielsdos) . Implement #71517 (Implement SVG support for getimagesize() and friends). (nielsdos) . Implement GH-19188: Add support for new INI mail.cr_lf_mode. (alexandre-daubois) . Optimized PHP html_entity_decode function. (Artem Ukrainskiy) . Minor optimization to array_chunk(). (nielsdos) . Optimized pack(). (nielsdos, divinity76) . Fixed crypt() tests on musl when using --with-external-libcrypt (Michael Orlitzky). . Fixed bug GH-18062 (is_callable(func(...), callable_name: $name) for first class callables returns wrong name). (timwolla) . Added array_first() and array_last(). (nielsdos) . Fixed bug GH-18823 (setlocale's 2nd and 3rd argument ignores strict_types). (nielsdos) . Fixed exit code handling of sendmail cmd and added warnings. (Jesse Hathaway) . Fixed bug GH-18897 (printf: empty precision is interpreted as precision 6, not as precision 0). (nielsdos) . Fixed bug GH-20257 (mail() heap overflow with an empty message in lf mode). (David Carlier) . Fixed bug GH-20201 (AVIF images misdetected as HEIF after introducing HEIF support in getimagesize()). (nielsdos) . Fixed bug GH-19926 (reset internal pointer earlier while splicing array while COW violation flag is still set). (alexandre-daubois) . Fixed bug GH-19801 (leaks in var_dump() and debug_zval_dump()). (alexandre-daubois) . Fixed GH-14402 (SplPriorityQueue, SplMinHeap, and SplMaxHeap lost their data on serialize()). (alexandre-daubois) . Fixed GH-19610 (Deprecation warnings in functions taking as argument). (Girgias) . Fixed bug GH-19577 (Avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator). (alexandre-daubois) . Fixed bug GH-19153 (#[\Attribute] validation should error on trait/interface/enum/abstract class). (DanielEScherzer) . Fixed bug GH-19070 (setlocale($type, NULL) should not be deprecated). (nielsdos) . Fixed bug GH-16649 (UAF during array_splice). (alexandre-daubois) . Passing strings which are not one byte long to ord() is now deprecated. (Girgias) . Passing integers outside the interval [0, 255] to chr() is now deprecated. (Girgias) . The socket_set_timeout() alias function has been deprecated. (timwolla) . Passing null to readdir(), rewinddir(), and closedir() to use the last opened directory has been deprecated. (Girgias)

• Streams: . Fixed bug GH-16889 (stream_select() timeout useless for pipes on Windows). (cmb) . Fixed bug GH-19798: XP_SOCKET XP_SSL (Socket stream modules): Incorrect condition for Win32/Win64. (Jakub Zelenka) . Fixed bug GH-14506 (Closing a userspace stream inside a userspace handler causes heap corruption). (nielsdos) . Avoid double conversion to string in php_userstreamop_readdir(). (nielsdos)

• Tests: . Allow to shuffle tests even in non-parallel mode. (dhuang00)

• Tidy: . tidy::__construct/parseFile/parseString methods throw an exception if the configuration argument is invalid. (David Carlier) . Fixed GH-19021 (improved tidyOptGetCategory detection). (arjendekorte, David Carlier, Peter Kokot)

• Tokenizer: . Fixed bug GH-19507 (Corrupted result after recursive tokenization during token_get_all()). (kubawerlos, nielsdos, Arnaud)

• Windows: . Fixed bug GH-10992 (Improper long path support for relative paths). (cmb, nielsdos) . Fixed bug GH-16843 (Windows phpize builds ignore source subfolders). (cmb) . Fix GH-19722 (_get_osfhandle asserts in debug mode when given a socket). (dktapps)

• XML: . The xml_parser_free() function has been deprecated. (DanielEScherzer)

• XMLWriter: . Improved performance and reduce memory consumption. (nielsdos)

• XSL: . Implement request #30622 (make $namespace parameter functional). (nielsdos)

• Zlib: . gzfile, gzopen and readgzfile, their "use_include_path" argument is now a boolean. (David Carlier) . Fixed bug GH-16883 (gzopen() does not use the default stream context when opening HTTP URLs). (nielsdos) . Implemented GH-17668 (zlib streams should support locking). (nielsdos)

• Zip: . Fixed missing zend_release_fcall_info_cache on the following methods ZipArchive::registerProgressCallback() and ZipArchive::registerCancelCallback() on failure. (David Carlier)

출처

PHP 8.5.0 공식 NEWS · 현재 PHP 지원 일정

원문에 없는 지원 종료일, CVE, Laravel 호환성 결론은 자동으로 추가하지 않습니다.