(crypt()'s problem was already fixed our php53-5.3.7nb1 package.)
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
23 Aug 2011, PHP 5.3.8
- Core:
. Fixed bug #55439 (crypt() returns only the salt for MD5). (Stas)
- OpenSSL:
. Reverted a change in timeout handling restoring PHP 5.3.6 behavior,
as the new behavior caused mysqlnd SSL connections to hang (#55283).
(Pierre, Andrey, Johannes)
- based on openjdk7 b147 and the bsd-port branch as of 20110811.
- integrates mozilla rhino 1.7R3 scripting support based on patches
from icedtea7 snapshot as of 20110819.
- refresh bootstrap kits
- tested on NetBSD 5.0/current, i386/amd64 and DragonFlyBSD 2.10 i386.
Upstream changes: mostly bugfixes. Perhaps also noteworthy is that the
zero assembler port has been integrated which should open up for wider
platform support in pkgsrc in the future.
changes in sbcl-1.0.51 relative to sbcl-1.0.50:
* minor incompatible change: SB-BSD-SOCKET socket streams no longer
participate in SERVE-EVENT by default: pass :SERVE-EVENTS T to
MAKE-SOCKET-STREAM if using SERVE-EVENT.
* enhancement: added support for socket keepalive timeout intervals
and probe counts on Linux.
* enhancement: building 32-bit SBCL on Linux/x86-64 now works without a
chroot. (Use "SBCL_ARCH=x86 sh make.sh" to build.)
* enhancement: added new toplevel options --quit and --non-interactive
(lp#822712).
* enhancement: the Windows port of SBCL now builds and runs on Wine
(thanks to Anton Kovalenko).
* enhancement: more, and more correct, SSE instruction definitions on
x86-64 (thanks to Alexander Gavrilov).
* enhancement: SB-EXT:SPIN-LOOP-HINT assembles to an instruction designed
to help the processor execute spin loops, when applicable. Currently
implemented for x86 and x86-64.
* optimization: unsigned integer divisions by a constant are implemented
using multiplication (affects CEILING, FLOOR, TRUNCATE, MOD, and REM.)
* optimization: improved type-derivation for LOAD-TIME-VALUE.
* bug fix: correct RIP offset calculation in SSE comparison and shuffle
instructions. (lp#814688)
* bug fix: COERCE to unfinalized extended sequence classes now works.
(reported by Jan Moringen; lp#815155)
* bug fix: a compiler error during typecheck generation, reported by Eric
Marsden. (lp#816564)
* bug fix: obsolete instance protocol fires when shared slots are added
or removed.
* bug fix: fixed-format floating point printing with scaling factors.
(lp#811386)
* bug fix: using GCC >= 4.6 to build SBCL on x86 no longer breaks
backtraces. (lp#818460)
* bug fix: better backtraces for interrupted syscall frames on x86.
(lp#549673)
* bug fix: SSE comparison instructions can be disassembled even when one
operand is in memory. (lp#814702)
* bug fix: incomplete writes when not using SERVE-EVENTS. (lp#820599)
* bug fix: MULTIPLE-VALUE-BIND + VALUES -> LET conversion could lose derived
type information associated with the VALUES form.
* bug fix: broken warnings/errors for type-errors involving LOAD-TIME-VALUE
forms. (lp#823014)
* bug fix: OPEN :IF-EXISTS :APPEND now returns correct FILE-POSITION before
first write (lp#561642).
* bug fix: compiled closures from EVAL could not be DESCRIBEd. (lp#824974)
* bug fix: bound propagation involving conversion of large bignums to
floats no longer signals a SIMPLE-TYPE-ERROR, reported by Lutz Euler.
(lp#819269)
* bug fix: &REST to &MORE conversion still works in unsafe call to known
functions; reported by Lutz Euler (lp#826459).
* bug fix: bogus deadlocks from interrupts and GCs. (lp#807475, regression
since 1.0.48)
changes in sbcl-1.0.50 relative to sbcl-1.0.49:
* enhancement: errors from FD handlers now provide a restart to remove
the offending handler.
* enhancement: SB-INTROSPECT:FIND-DEFINITION-SOURCE now works on structure
copiers as well.
* enhancement: location of user or system initialization file can now easily
be customized for saved cores. See: SB-EXT:*USERINIT-PATHNAME-FUNCTION*
and SB-EXT:*SYSINIT-PATHNAME-FUNCTION*.
* enhancement: SB-EXT:MAKE-THREAD accepts an argument list designator for
the thunk, as a keyword argument, :arguments.
* enhancement: constraint propagation is simplified (and sped up) when
COMPILATION-SPEED > SPEED.
* enhancement: SB-ALIEN exports alien type specifiers SIZE-T and OFF-T.
* enhancement: debugger understands &MORE arguments better.
* optimization: extracting bits of a single-float on x86-64 has been
optimized. (lp#555201)
* optimization: MAP and MAP-INTO are more efficient for non-simple vectors,
when (> SPEED SPACE).
* optimization: local call trampolines (x86 and x86-64) are emitted
inline.
* optimization: implicit value cells for dynamic-extent closed-over bindings
on x86 and x86-64 can hold unboxed values as well.
* meta-optimization: improved compilation speed, especially for large
functions. (lp#792363 and lp#394206)
* bug fix: bound derivation for floating point operations is now more
careful about rounding possibly closing open bounds. (lp#793771)
* bug fix: SB-POSIX:SYSCALL-ERROR's argument is now optional. (accidental
backwards incompatible change in 1.0.48.27)
* bug fix: occasional debugger errors in when a type-error occured in a
function with dynamic-extent &rest list.
* bug fix: &optional and &key supplied-p arguments in DEFSTRUCT
boa-construtors can be used to initialized structure slots.
* bug fix: FMAKUNBOUND removes the MACRO-FUNCTION, should one exist.
(lp#795705, regression)
* bug fix: DIRECTORY works better on logical pathnames.
* bug fix: RUN-PROGRAM no longer fails spuriously when argument strings
are of the order of ARRAY-TOTAL-SIZE-LIMIT. (lp#787237)
* bug fix: the compiler no longer constant-folds NaNs in
MAKE-{SINGLE,DOUBLE}-FLOAT. (lp#486812)
* bug fix: FORMAT now handles floating point rounding correct, eg.
(format nil "~,1F" 0.01) => "0.0" instead of "0.01" as previously.
(lp#308961)
* bug fix: style warning during lambda-list introspection of generic
functions with both optional and key argments.
* bug fix: regalloc doesn't barf on unused TNs due to type-directed constant
folding. (lp#729765)
* bug fix: Fixed an off-by-one in MAP-ALLOCATED-OBJECTS that might have caused
infinite loops.
pkgsrc change
* Remove unused XMLUTIL_WRKSRC.
* don't patch a file which we have in our tree, go-pear.php
- Remove unused code.
- Prevent deprecated warnings on PHP 5.3.x.
PEAR 1.9.4:
Release date: 2011-07-07 00:27 UTC
Release state: stable
Changelog:
Bug Fixes:
* Bug #17350: "pear install --force" doesn't uninstall files from previous pkg
versions [dufuz]
* Bug #18362: A whitespace TEMP_DIR path breaks install/upgrade functionality
[dufuz]
* Bug #18440: bad tmp folder path on install : Unable to create path for
C:/Program/tmp [dufuz]
* Bug #18581: "config-get -c" not returning channel's configuration when using
alias [dufuz]
* Bug #18639: regression: installing xdebug fails most likely due to another
fix [dufuz]
Features
* All System (the class) functions can now take in spaced paths as long as
they are surrounded in quotes.
Prior to this it was possible to do that by passing all values in as an
array (by product of #18362, #18440)
PHP 5.3.7 Released!
[18-Aug-2011] The PHP development team would like to announce the immediate
availability of PHP 5.3.7. This release focuses on improving the stability of
the PHP 5.3.x branch with over 90 bug fixes, some of which are security
related.
Security Enhancements and Fixes in PHP 5.3.7:
* Updated crypt_blowfish to 1.2. (CVE-2011-2483)
* Fixed crash in error_log(). Reported by Mateusz Kocielski
* Fixed buffer overflow on overlog salt in crypt().
* Fixed bug #54939 (File path injection vulnerability in RFC1867 File upload
filename). Reported by Krzysztof Kotowicz. (CVE-2011-2202)
* Fixed stack buffer overflow in socket_connect(). (CVE-2011-1938)
* Fixed bug #54238 (use-after-free in substr_replace()). (CVE-2011-1148)
Key enhancements in PHP 5.3.7 include:
* Upgraded bundled Sqlite3 to version 3.7.7.1
* Upgraded bundled PCRE to version 8.12
* Fixed bug #54910 (Crash when calling call_user_func with unknown function
name)
* Fixed bug #54585 (track_errors causes segfault)
* Fixed bug #54262 (Crash when assigning value to a dimension in a non-array)
* Fixed a crash inside dtor for error handling
* Fixed bug #55339 (Segfault with allow_call_time_pass_reference = Off)
* Fixed bug #54935 php_win_err can lead to crash
* Fixed bug #54332 (Crash in zend_mm_check_ptr // Heap corruption)
* Fixed bug #54305 (Crash in gc_remove_zval_from_buffer)
* Fixed bug #54580 (get_browser() segmentation fault when browscap ini
directive is set through php_admin_value)
* Fixed bug #54529 (SAPI crashes on apache_config.c:197)
* Fixed bug #54283 (new DatePeriod(NULL) causes crash).
* Fixed bug #54269 (Short exception message buffer causes crash)
* Fixed Bug #54221 (mysqli::get_warnings segfault when used in multi queries)
* Fixed bug #54395 (Phar::mount() crashes when calling with wrong parameters)
* Fixed bug #54384 (Dual iterators, GlobIterator, SplFileObject and
SplTempFileObject crash when user-space classes don't call the parent
constructor)
* Fixed bug #54292 (Wrong parameter causes crash in
SplFileObject::__construct())
* Fixed bug #54291 (Crash iterating DirectoryIterator for dir name starting
with \0)
* Fixed bug #54281 (Crash in non-initialized RecursiveIteratorIterator)
* Fixed bug #54623 (Segfault when writing to a persistent socket after closing
a copy of the socket)
* Fixed bug #54681 (addGlob() crashes on invalid flags)
* Over 80 other bug fixes.
Changes in Racket 5.1.3
This is a bugfix release, resolving the DrRacket issue with
the contour view. In addition, two tex files with problematic
licensing were removed.
Changes in Racket 5.1.2
* The download page includes 64-bit installers for Mac OS X,
Windows, and two Debian flavors. Racket now supports OS X Lion.
* Racket now includes a new `racket/place' library to support
parallelism, complementing `racket/future'. Racket's parallel
build process is now based on places instead of multiple OS
processes.
Places support share-nothing parallelism and message-passing
communication. Compared to futures, places are heavyweight, but
they have a simpler performance model.
* The syntax-certificate system has been replaced by a syntax-taint
system. Both certificates and taints were designed to protect
otherwise inaccessible bindings from abuse when they appear in
macro expansions. Taints are simpler and lighter, and the switch
closes known holes in the certificate system. Macros that are not
implemented with `syntax-rules' or `define-syntax-rule', however,
must explicitly use `syntax-protect' to protect their expansions
from abuse.
* The `net/url' library supports HTTPS connections, but beware that
by default all sites are accepted (equivalent to ignoring a
browser's warnings about untrusted certificates).
* Error messages in the student languages use a simplified
vocabulary and consistent phrasings. If you maintain curriculum
material or teachpacks then please consider updating. See the
"Error Message Composition Guidelines" section in the
documentation for details.
* Typed Racket: almost all core Racket data structures and
operations are now accessible in Typed Racket (most of this work
is due to prolific contributor Eric Dobson). The performance of
the typechecker has been significantly improved.
* The `scriblib/bibtex' library supports BibTeX-formatted citation
databases in Scribble documents. BibTeX can be tricky to parse,
so please report failed entries as bug reports.
* The `for' forms now support an `#:unless' clause, and a
nonnegative integer can be used as a sequence. The new `compose1'
function creates single-valued composition functions. The
`racket/function' library now provides `identity', `thunk', and
`thunk*'.
* The license has been clarified: we now use LGPLv2.1 uniformly.
(The license file used to specify LGPLv2, contrary to the download
pages.)
Here is quote from the article of Ruby Inside.
(http://www.rubyinside.com/ruby-1-9-2-p290-released-the-lowdown-on-rubys-latest-production-release-5145.html) For more change, please refer:
http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog
What's Changed From p180 to p290?
Quite a lot got changed in terms of the numbers. 132 files were
tweaked with a total of 3505 lines added and 788 taken away.
A selection of the fixes:
* require 'date'; Date.new === nil throws an undefined method error for
coerce on p180 - this has now been fixed
* The Thread.kill segfaults when the object to be killed isn't a thread bug
has been resolved.
* Tweaks to reduce segmentation faults when using zlib on x86-64 Darwin
(OS X) - always good
* Modification to prevent random number sequence repetition on forked child
processes in SecureRandom
* Fix to io system to resolve a Windows-only bug where characters are being
read incorrectly due to ASCII not being treated as 7 bit
* A tweak to Psych (the YAML parser) to plug a memory leak
* Load paths are now always expanded by rb_et_expanded_load_path (I think
this might yield a performance gain?)
* Fixes to Psych's treatment and testing of string taint
* Prevention of temporary objects being garbage collected in some cases
* Fixes to resolve compilation problems with Visual C++ 2010
* A fix so that Tk's extconf.rb would run successfully
* Lots of Tk related fixes generally - I'm guessing Tk is very popular
amongst the core team, particularly in Japan, because it seems to be a
common release blocker.
* A fix to string parsing to resolve an obscure symbol-containing-newlines
parsing bug
If it specified, it modify gemspec's dependency using update-gemspec.rb
Ruby script.
The goal is avoid to use patch for modifying depending version or gem's
name since gemspec files' content differ using rubygem's version.
move PKGREVISION to each Makefile including the Makefile.common for
keep version number, and bump again for ocaml-graphics because the
previous bump resuited in downgrade.
* Several modules were updated to fix minor bugs.
* Tests were fixed.
* Documentation was improved.
Changes 5.14.0:
* Unicode version 6.0 is now supported.
* Regular expressions can now be reset to the default modifiers.
* Four new regular expression modifiers, "/d", "/l" , "/u", and "/a", were
introduced.
* The substitution operators now support the modifier "/r" to work
non-destructively, leaving the original unmodified.
* Larger octals can now be specified.
* Array and hash operators can now experimentally operate directly on hard
references.
* printf-like functions now understand post-1980 size modifiers.
* Exception handling was made more reliable and consistent.
* Other enhancements and many bug fixes were made
PkgSrc:
* Fixed configuring on Mac OS X 10.7.
From upstream comment:
nm isn't known to work after Snow Leopard and XCode 4; testing with OS X 10.5
and Xcode 3 shows a working nm, but pretending it doesn't work produces no
problems.
From upstream commit log:
Testing from 10.5 with Xcode 3 to the latest OS X works with usenm='false' but
not always with usenm='true'
Changes in version 5.1.1, May 2011:
Enabled single-precision floats by default
Added single-flonum?
Changed eqv? so that inexacts are equivalent only when they
have the same precision
Changed file-or-directory-permission to add 'bits mode
and permission-setting mode
Added special treatment of void as an 'inferred-name property
Removed the "MrEd" compatability executable under Windows
and Mac OS X, but the "mred" compatibility script remains
racket/gui: added multi-column support to list-box%
racket/gui: added scrollbar support to panel%, vertical-panel%,
and horizontal-panel%
racket/gui: added 'wheel-left and 'wheel-right events
racket/file: add user-read-bit, etc.
racket/contract: removed some (undocumented) exports.
Changes in version 5.1, February 2011
Renamed "proxy" to "impersonator"
Added current-get-interaction-input-port, which enables
racket/gui events to be dispatched while a REPL is blocked
Changed equal? to equate C pointers when they refer to the
same address
Internal: weak boxes are cleared before non-will-like
finalizers; use late-weak boxes to get the old behavior
Changes in version 5.0.2, October 2010
Changed body of `when', `unless', `cond' clauses, `case'
clauses, and `match' clauses to be internal-definition contexts
Swapped unsafe-vector*-ref with unsafe-vector-ref, etc.
Added ->i to the contract library, improved ->*, adding #:pre and
#:post, as well as making the optional arguments clause optional.
Added #true and #false, and changed #t/#T and #f/#F to
require a delimiter afterward
Added print-boolean-long-form
Added read-accept-lang, which is set to #t when
reading a module
Added flonum?
Changed continuation-marks to accept a #f argument
to produce an empty set of marks
Added fxvectors
Added unsafe-{s,u}16-{ref,set!}
Added prop:proxy-of
Added proxies to go with chaperones, and renamed chaperone property
as proxy property; beware that the word "proxy" will change in
a future version, perhaps to "impersonator"
Added collection-file-path and collection splicing at the file
level
Upstream changes:
- Core
+ Parrot_PMC_destroy, Parrot_PMC_mark and Parrot_PMC_invoke were removed from
the public extension API.
+ PAST now has PAST::Stmt node types, supports reusable temporary registers.
+ Test coverage of the embedding and extending interface is now at least 95%.
+ A snapshot of Winxed is now included in Parrot core to facilitate writing
core Parrot tools from a higher level language than PIR.
- Languages
+ Winxed
- Improved compile time scope search.
- Added 'using namespace' statement.
- Compiler classes and functions now live in the Winxed;Compiler namespace.
- Tests
+ The Parrot test suite harness now understands the HARNESS_TIMER
environment variable. Setting it to a true value will show timing results
for a test run.
+ IPv6 tests are now parallel testing friendly.
It was really needed by devel/ruby-railties, sigh.
=== 3.8 / ??
* Minor enhancements
* RDoc::Parser::C can now discover methods on ENV and ARGF.
* RDoc::Parser::C now knows about rb_cSocket and rb_mDL.
* Bug fixes
* Updating Object in an ri data store with new data now removes methods,
includes, constants and aliases.
=== 3.7 / 2011-06-27
* Minor enhancements
* New directive :category: which allows methods to be grouped into sections
more cleanly. See RDoc::Markup for details.
* Document-class for RDoc::Parser::C now supports Foo::CONST as well as
CONST.
* ri method output is now a comma-separated list when displayed
interactively. Pull Request #39 by Benoit Daloze.
* RDoc::ClassModule#merge now prefers the argument's information over the
receiver's (it now behaves like Hash#merge! instead of a backwards
Hash#merge!).
* RDoc::Markup#convert now accepts an RDoc::Markup::Document instance
* RDoc now owns the code for generating RDoc and ri data when gems install
* Added RDoc::RDoc::reset
* Added RDoc::CodeObject#file_name
* Bug fixes
* ri no longer crashes when attempting to complete a plain [.
* ri data now tracks which file information came from so it can process
removals and changes to:
* Classes and Modules
* Methods
* Attributes
* Includes
* Constants
You will need to rebuild your ri data for it to update properly. Issue
#21 by Sven Riedel
* Signal and SignalException no longer clobber each other
* RDoc::Parser::C no longer creates classes when processing aliases.
* RDoc::Text#strip_stars handles Document-method for methods with =, ! and ?
now.
* RDoc::Parser::C now allows .cpp files to be used with the "in" comment on
rb_define_method. Bug #35 by Hanmac.
* RDoc::Parser::Ruby no longer eats content when =begin/=end documentation
blocks are followed by a documentable item. Issue #41 by mfn.
* RDoc::Markup::Formatter and subclasses now allow an optional +markup+
parameter for adding custom markup. The example in
RDoc::Markup::Formatter will now work. Issue #38 by tsilen.
* RDoc::Parser::C can now distinguish between class methods and instance
methods in Document-method. Issue #36 by Vincent Batts.
* RDoc now encodes file names in the output encoding. Issue #33 by Perry
Smith.
* ri data generation for method aliases no longer duplicates the class in
#full_name
Bump pkgrevision.
While I'm here: add a comment to patch-at explaining what it does.
Tested by
$ make install
$ cd work/ocaml-3.12.0/testsuite && gmake one DIR=tests/lib-dynlink-native
(Not in a build-env because that uses the wrappers, which don't let the
test suite see the installed OCaml files.)
This is only a workaround on NetBSD/{i386,amd64} for the problems of
OCaml PR#5049 <http://caml.inria.fr/mantis/view.php?id=5049>. (E.g.,
this workaround makes Coccinelle build on those platforms -- but it
still won't build on platforms with native compilation but no native
dynamic loading. Need to hack everything that uses dynlink to have
four compile-time cases -- {yes,no} {byte,nat}dynlink.)
John Marino per PM
-deal with possibly builtin gmp/mpfr/mpc libs (this is incomplete
for D'fly -- choices are to convert the pre-configure test or
to set USE_BUILTIN.x=no)
