Skip to content

ext/zip: Exclude broken libzip 1.12(.0) - #24358

Merged
LamentXU123 merged 1 commit into
php:PHP-8.4from
LamentXU123:exclude-1.12-libzip
Oct 25, 2026
Merged

LamentXU123 merged 1 commit into
php:PHP-8.4from
LamentXU123:exclude-1.12-libzip

Conversation

@LamentXU123

Copy link
Copy Markdown
Member

libzip 1.12 introduced a regression that prevents adding or replacing files in TorrentZip archives, causing oo_torrentzip.phpt to fail. This was fixed in libzip 1.12.1.

Exclude both 1.12 and 1.12.0 at configure time, as pkg-config treats them as distinct versions (wtf bro).

See nih-at/libzip#617.

@iliaal

iliaal commented Oct 15, 2026

Copy link
Copy Markdown
Member

LGTM, Do we need this for 8.3 and 8.2 as well?

@LamentXU123

LamentXU123 commented Oct 15, 2026 •

Copy link
Copy Markdown
Member Author

I dont think we have that feature in 8.2. So if we are going to backport to security-only branches this should target 8.3.
I will first merge this because it's burning CI. If @php/release-managers-83 think this should be backported feel free to tell me I will create a commit to backport.

Oh I just realised this will not fix CI instantly, we need to wait for homebrew's image to update itself. Okay than we don't need to rush anyways. Let's wait for 8.3 RM's opinion.

@LamentXU123
LamentXU123 requested a review from a team October 15, 2026 18:29
@LamentXU123
LamentXU123 marked this pull request as draft October 15, 2026 18:32
@LamentXU123
LamentXU123 changed the base branch from PHP-8.4 to PHP-8.3 October 15, 2026 18:33
@LamentXU123
LamentXU123 marked this pull request as ready for review October 15, 2026 18:33
@andypost

Copy link
Copy Markdown
Contributor

the fix is nih-at/libzip@e3f6db9 but better to beware this version sadly no way for 8.2/8.3

@LamentXU123 LamentXU123 changed the title ext/zip: Exclude broken libzip 1.12 ext/zip: Exclude broken libzip 1.12(.0) Oct 16, 2026
@Sjord

Sjord commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Looks good to me. Does the Windows build config also need such a check?

@LamentXU123

Copy link
Copy Markdown
Member Author

Looks good to me. Does the Windows build config also need such a check?

Well, seems like the former excluded version ain't added in Windows build condig either! Thank you for reminding.

Yes. And I will also file a PR to add 1.3.1 and 1.7.0 as excluded version in Windows.

@ericmann

Copy link
Copy Markdown
Contributor

I like that libzip fixed their regression, but this doesn't feel like it warrants being bundled into a security release for 8.3.

@LamentXU123
LamentXU123 marked this pull request as draft October 25, 2026 05:56
@LamentXU123
LamentXU123 changed the base branch from PHP-8.3 to PHP-8.4 October 25, 2026 05:57
@ndossche

Copy link
Copy Markdown
Member

Go ahead with merging into 8.4

@LamentXU123
LamentXU123 marked this pull request as ready for review October 25, 2026 13:53
@LamentXU123
LamentXU123 merged commit 2f6fd11 into php:PHP-8.4 Oct 25, 2026
17 of 18 checks passed
LamentXU123 added a commit that referenced this pull request Oct 25, 2026
* PHP-8.6:
  Merge branch 'PHP-8.5' into PHP-8.6
  Merge branch 'PHP-8.4' into PHP-8.5
  ext/zip: Exclude broken libzip 1.12 (#24358)
opensource-fork-sync Bot pushed a commit to cla7aye15I4nd/opensource-php__php-src that referenced this pull request Oct 25, 2026
* PHP-8.4:
  ext/zip: Exclude broken libzip 1.12 (php#24358)
opensource-fork-sync Bot pushed a commit to cla7aye15I4nd/opensource-php__php-src that referenced this pull request Oct 25, 2026
* PHP-8.5:
  Merge branch 'PHP-8.4' into PHP-8.5
  ext/zip: Exclude broken libzip 1.12 (php#24358)
arnaud-lb added a commit to prateekbhujel/php-src that referenced this pull request Oct 27, 2026
* PHP-8.4: (26 commits)
  Fix phpGH-24695: FPM tester sends signal to process group when PID is missing (php#24698)
  Fix phpGH-24605: Guard var_export() against native stack overflow (php#24671)
  Fix use-after-free of CURLOPT_STDERR stream on cloned curl handle
  IR: Backport code buffer rollback fix
  Fix SQL test on Windows (php#24755)
  Fix phpGH-24697: cli: passing PHP_HTTP_PARSER_STRICT build option doesn't work
  Fix phpGH-24438: Preserve indirect types in JIT side traces
  Fix phpGH-17733: System entropy does not take into account function order, resulting in wrong functions possibly called in different configurations
  Fix unmapping of an unrelated range when the aligned chunk mmap fails (php#24542)
  Backport: Adapt intl timezone test expectations for ICU 79.1 (php#24724)
  Tracing JIT: keep the SEND_VAL type guard after assigning to a reference
  Backport: Adapt intl timezone test expectations for ICU 79.1 (php#24684)
  ext/zip: Reject broken libzip versions on Windows (php#24371)
  ext/zip: Exclude broken libzip 1.12 (php#24358)
  Fix phpGH-24264: Unwind/GracefulExit discarded in spl_iterators.c
  phpdbg: Backport watchpoint fixes to PHP-8.4
  Fix JIT reading packed-turned-hash array as packed after string key write
  ext/standard: Skip proc_open descriptor 0 tests without /proc/self/fd symlinks
  JIT: Fix operand type check in zend_redo_pass_two_ex() (php#24658)
  Fix error paths in dom_xml_serializing_a_document_node()
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants