php8.5 (8.5.4-0ubuntu1) resolute; urgency=medium

  * Bring new version from salsa to Ubuntu (LP: #2143075)
  * Remaining changes:
    - d/rules: set PHP_BUILD_PROVIDER to Ubuntu in Ubuntu builds
    - d/rules: enable DTrace (LP #2088977)
  * Remove secure DNS telemetry functionality: (LP: #2147444)
    - d/p/0045-Add-minimal-privacy-preserving-secure-DNS-telemetry-.patch:
      remove the telemetry patch
    - d/control, d/control.in: remove dependencies only needed for
      telemetry
    - d/rules: remove logic to setup the telemetry at build time

 -- Renan Rodrigo <rr@ubuntu.com>  Wed, 01 Apr 2026 06:36:11 -0300

php8.5 (8.5.4-1) experimental; urgency=medium

  * New upstream version 8.5.4

 -- Ondřej Surý <ondrej@debian.org>  Mon, 30 Mar 2026 21:14:32 +0200

php8.5 (8.5.3-2) experimental; urgency=medium

  * Disable debugging output in secure DNS telemetry
  * The secure DNS telemetry is disabled at the compile-time

 -- Ondřej Surý <ondrej@debian.org>  Fri, 13 Feb 2026 16:47:37 +0100

php8.5 (8.5.3-1) experimental; urgency=medium

  * Make the apache2 configuration ReDoS resistant
  * Add a minimal privacy-preserving secure DNS telemetry to check current
    version if there are security updates available
  * New upstream version 8.5.3

 -- Ondřej Surý <ondrej@debian.org>  Thu, 12 Feb 2026 21:48:53 +0100

php8.5 (8.5.2-0ubuntu1) resolute; urgency=medium

  * Upload to Ubuntu (LP: #2138759)
  * d/rules: set PHP_BUILD_PROVIDER to Ubuntu in Ubuntu builds
  * d/rules: enable DTrace (LP #2088977)

 -- Renan Rodrigo <rr@ubuntu.com>  Wed, 21 Jan 2026 14:35:28 -0300

php8.5 (8.5.2-1) experimental; urgency=medium

  * New upstream version 8.5.2

 -- Ondřej Surý <ondrej@debian.org>  Sun, 18 Jan 2026 14:56:15 +0100

php8.5 (8.5.1-1) experimental; urgency=medium

  * Add preliminary LiteSpeed SAPI support
  * Update the PHP 8.5 signing keys
  * New upstream version 8.5.1
   + [CVE-2025-14180]: Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null
     deref).
   + [CVE-2025-14178]: Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in
     array_merge()).
   + [CVE-2025-14177]: Fixed GHSA-3237-qqm7-mfv7 (Information Leak of
     Memory in getimagesize).

 -- Ondřej Surý <ondrej@debian.org>  Thu, 18 Dec 2025 18:42:33 +0100

php8.5 (8.5.0-1) experimental; urgency=medium

  * Update d/watch for final PHP 8.5.0 release
  * New upstream version 8.5.0

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 Nov 2025 20:12:00 +0100

php8.5 (8.5.0~rc5-3) experimental; urgency=medium

  * Fix the LDAP build on i386 (use multiarch directories again)
  * Or just use /bin/sed; that should work everywhere

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 Nov 2025 10:45:02 +0100

php8.5 (8.5.0~rc5-2) experimental; urgency=medium

  * Workaround make $(shell ...) command unable to execute builtins

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 Nov 2025 08:56:38 +0100

php8.5 (8.5.0~rc5-1) experimental; urgency=medium

  * Use command -v sed to resolve path to SED
  * New upstream version 8.5.0~rc5

 -- Ondřej Surý <ondrej@debian.org>  Fri, 14 Nov 2025 18:15:27 +0100

php8.5 (8.5.0~rc4-1) experimental; urgency=medium

  * New upstream version 8.5.0~rc4

 -- Ondřej Surý <ondrej@debian.org>  Thu, 13 Nov 2025 21:28:38 +0100

php8.5 (8.5.0~rc3-2) experimental; urgency=medium

  * Disable Berkeley DB support (Closes: #1119170)

 -- Ondřej Surý <ondrej@debian.org>  Tue, 28 Oct 2025 07:42:50 +0100

php8.5 (8.5.0~rc3-1) experimental; urgency=medium

  * New upstream version 8.5.0~rc3

 -- Ondřej Surý <ondrej@debian.org>  Mon, 27 Oct 2025 22:08:04 +0100

php8.5 (8.5.0~rc1-1) experimental; urgency=medium

  * New upstream version 8.5.0~rc1
  * Bump phpapi to 20250925

 -- Ondřej Surý <ondrej@debian.org>  Wed, 01 Oct 2025 22:33:17 +0200

php8.5 (8.5.0~alpha4-1) experimental; urgency=medium

  * New upstream version 8.5.0~alpha4
   - OpenSSL 1.1.1 or higher is now required.
   - The Opcache extension is now always built into the PHP binary
  * Bump PHPAPI to 20240925

 -- Ondřej Surý <ondrej@debian.org>  Mon, 04 Aug 2025 09:46:39 +0200

php8.4 (8.4.11-1) unstable; urgency=medium

  * New upstream version 8.4.11

 -- Ondřej Surý <ondrej@debian.org>  Sun, 03 Aug 2025 09:32:21 +0200

php8.4 (8.4.10-1) unstable; urgency=medium

  * Set PHP_BUILD_PROVIDER to Debian with option to override this from
    shell environment
  * New upstream version 8.4.10

 -- Ondřej Surý <ondrej@debian.org>  Thu, 03 Jul 2025 14:35:27 +0200

php8.4 (8.4.8-1) unstable; urgency=medium

  * Move setting ICU_CXXFLAGS to the right place in d/rules
  * Use ICU >= 75 version to determine the need for C++11 or C++17
  * New upstream version 8.4.8

 -- Ondřej Surý <ondrej@debian.org>  Sat, 07 Jun 2025 16:22:04 +0200

php8.4 (8.4.7-1) unstable; urgency=medium

  * New upstream version 8.4.7

 -- Ondřej Surý <ondrej@debian.org>  Fri, 09 May 2025 08:06:27 +0200

php8.4 (8.4.6-2) unstable; urgency=medium

  * Remove libxmltok1-dev from Build-Depends (Closes: #871826)

 -- Ondřej Surý <ondrej@debian.org>  Mon, 14 Apr 2025 18:59:47 +0200

php8.4 (8.4.6-1) unstable; urgency=medium

  * New upstream version 8.4.6

 -- Ondřej Surý <ondrej@debian.org>  Fri, 11 Apr 2025 03:47:19 +0200

php8.4 (8.4.5-1) unstable; urgency=medium

  * New upstream version 8.4.5
   - [CVE-2024-11235]: Reference counting in php_request_shutdown
     causes Use-After-Free.
   - [CVE-2025-1219]: libxml streams use wrong `content-type` header
     when requesting a redirected resource.
   - [CVE-2025-1736]: Stream HTTP wrapper header check might omit
     basic auth header.
   - [CVE-2025-1861]: Stream HTTP wrapper truncate redirect location
     to 1024 bytes.
   - [CVE-2025-1734]: Streams HTTP wrapper does not fail for headers
     without colon.
   - [CVE-2025-1217]: Header parser of `http` stream wrapper does not
     handle folded headers.

 -- Ondřej Surý <ondrej@debian.org>  Thu, 13 Mar 2025 16:28:14 +0100

php8.4 (8.4.4-1) unstable; urgency=medium

  * New upstream version 8.4.4

 -- Ondřej Surý <ondrej@debian.org>  Sat, 15 Feb 2025 09:51:15 +0100

php8.4 (8.4.3-1) unstable; urgency=medium

  * New upstream version 8.4.3
  * Remove the C++11 compatibility patch (Closes: #1092329)

 -- Ondřej Surý <ondrej@debian.org>  Sun, 19 Jan 2025 14:35:15 +0100

php8.4 (8.4.2-1) unstable; urgency=medium

  * Add --enable-rtld-deepbind configure flag, disable it by default
    except for apache (Closes: #1089097)
  * New upstream version 8.4.2

 -- Ondřej Surý <ondrej@debian.org>  Tue, 24 Dec 2024 06:58:15 +0100

php8.4 (8.4.1-6) unstable; urgency=medium

  * Bump php-common dependency to >= 2:95~

 -- Ondřej Surý <ondrej@debian.org>  Wed, 04 Dec 2024 12:17:25 +0100

php8.4 (8.4.1-5) unstable; urgency=medium

  * Remove the /usr/lib/libphp.so symbolic link if unowned
    (Closes: #1035798)

 -- Ondřej Surý <ondrej@debian.org>  Mon, 02 Dec 2024 08:28:50 +0100

php8.4 (8.4.1-4) unstable; urgency=medium

  * Upload to unstable.

 -- Ondřej Surý <ondrej@debian.org>  Wed, 27 Nov 2024 13:57:13 +0100

php8.4 (8.4.1-3) experimental; urgency=medium

  * Revert "ext/gmp: gmp_pow fix FPE with large values" patch

 -- Ondřej Surý <ondrej@debian.org>  Mon, 25 Nov 2024 18:17:44 +0100

php8.4 (8.4.1-2) experimental; urgency=medium

  * Fix GH-16870: gmp_pow(64, 11) throws overflow exception

 -- Ondřej Surý <ondrej@debian.org>  Thu, 21 Nov 2024 15:37:00 +0100

php8.4 (8.4.1-1) experimental; urgency=medium

  * New upstream version 8.4.1

 -- Ondřej Surý <ondrej@debian.org>  Thu, 21 Nov 2024 14:21:13 +0100

php8.4 (8.4.0~rc4-1) experimental; urgency=medium

  * New upstream version 8.4.0~rc4

 -- Ondřej Surý <ondrej@debian.org>  Sat, 16 Nov 2024 10:40:32 +0100

php8.4 (8.4.0~rc3-1) experimental; urgency=medium

  * New upstream version 8.4.0~rc3

 -- Ondřej Surý <ondrej@debian.org>  Wed, 30 Oct 2024 12:23:46 +0100

php8.4 (8.4.0~rc1-2) experimental; urgency=medium

  * Bump required versions for several build-dependencies

 -- Ondřej Surý <ondrej@debian.org>  Wed, 02 Oct 2024 11:50:27 +0200

php8.4 (8.4.0~rc1-1) experimental; urgency=medium

  * New upstream version 8.4.0~rc1
  * Bump PHP API number to 20240924

 -- Ondřej Surý <ondrej@debian.org>  Fri, 27 Sep 2024 05:39:51 +0200

php8.4 (8.4.0~beta5-1) experimental; urgency=medium

  * New upstream version 8.4.0~beta5

 -- Ondřej Surý <ondrej@debian.org>  Sat, 14 Sep 2024 13:40:48 +0200

php8.4 (8.4.0~beta4-1) experimental; urgency=medium

  * New upstream version 8.4.0~beta4

 -- Ondřej Surý <ondrej@debian.org>  Fri, 30 Aug 2024 11:14:08 +0200

php8.4 (8.4.0~beta3-1) experimental; urgency=medium

  * New upstream version 8.4.0~beta3

 -- Ondřej Surý <ondrej@debian.org>  Tue, 27 Aug 2024 05:20:02 +0200

php8.4 (8.4.0~alpha4-1) experimental; urgency=medium

  * New upstream version 8.4.0~alpha4

 -- Ondřej Surý <ondrej@debian.org>  Fri, 02 Aug 2024 18:03:15 +0200

php8.4 (8.4.0~alpha2-1) experimental; urgency=medium

  * New upstream version 8.4.0~alpha2
  * Update d/watch to use qa.php.net site

 -- Ondřej Surý <ondrej@debian.org>  Sat, 20 Jul 2024 21:07:00 +0200

php8.4 (8.4.0~alpha1-1) experimental; urgency=medium

  * Update upstream signing keys for PHP 8.4
  * New upstream version 8.4.0~alpha1
  * The IMAP extension has been unbundled and moved to PECL.
  * The pspell extension has been unbundled and moved to PECL.
  * Bump phpapi to 20230901

 -- Ondřej Surý <ondrej@debian.org>  Sat, 06 Jul 2024 07:48:05 +0200

php8.3 (8.3.9-1) experimental; urgency=medium

  * Add Restart=on-failure to the systemd service file
  * New upstream version 8.3.9
  * Remove the patch that fixed GH-14480 (merged upstream)

 -- Ondřej Surý <ondrej@debian.org>  Fri, 05 Jul 2024 13:48:48 +0200

php8.3 (8.3.8-2) experimental; urgency=medium

  * Fix GH-14480: Method visibility issue introduced in version 8.3.8 (#14484)

 -- Ondřej Surý <ondrej@debian.org>  Sat, 08 Jun 2024 22:27:05 +0200

php8.3 (8.3.8-1) experimental; urgency=medium

  * New upstream version 8.3.8  
   + [CVE-2024-4577]: Bypass of CVE-2012-1823, Argument Injection in
     PHP-CGI.
   + [CVE-2024-5458]: Filter bypass in filter_var FILTER_VALIDATE_URL.
   + [CVE-2024-5585]: Bypass of CVE-2024-1874.

 -- Ondřej Surý <ondrej@debian.org>  Thu, 06 Jun 2024 17:16:55 +0200

php8.3 (8.3.7-2) experimental; urgency=medium

  * Fix the php-config mangling script in configure embeds the options in
    a single quote

 -- Ondřej Surý <ondrej@debian.org>  Thu, 23 May 2024 12:29:30 +0200

php8.3 (8.3.7-1) experimental; urgency=medium

  * New upstream version 8.3.7

 -- Ondřej Surý <ondrej@debian.org>  Mon, 13 May 2024 17:25:50 +0200

php8.3 (8.3.6-1) experimental; urgency=medium

  * New upstream version 8.3.6

 -- Ondřej Surý <ondrej@debian.org>  Thu, 11 Apr 2024 22:16:27 +0200

php8.3 (8.3.4-1) experimental; urgency=medium

  [ Ondřej Surý ]
  * New upstream version 8.3.4
  * Just don't set PHP extra version at all - it makes a little
    sense when we are just updating upstream versions
  * Remove hardcoded dependency on libmagic1 (Closes: #1065985)

  [ Andrey Rakhmatullin ]
  * Fix FTBFS with -Werror=implicit-function-declaration (Closes: #1066234).

 -- Ondřej Surý <ondrej@debian.org>  Sat, 16 Mar 2024 09:31:56 +0100

php8.3 (8.3.3-1) experimental; urgency=medium

  * New upstream version 8.3.3

 -- Ondřej Surý <ondrej@debian.org>  Thu, 15 Feb 2024 19:30:31 +0100

php8.3 (8.3.2-1) experimental; urgency=medium

  [ Ondřej Surý ]
  * New upstream version 8.3.2

  [ Athos Ribeiro ]
  * Fix PHP_EXTRA_VERSION setting
  * Test the PHP_EXTRA_VERSION setting
  * Move disabling the upstream GC routine to a patch (Closes: #831752)

 -- Ondřej Surý <ondrej@debian.org>  Sat, 20 Jan 2024 14:05:31 +0100

php8.3 (8.3.1-1) experimental; urgency=medium

  * New upstream version 8.3.1

 -- Ondřej Surý <ondrej@debian.org>  Thu, 21 Dec 2023 21:05:27 +0100

php8.3 (8.3.0-5) experimental; urgency=medium

  * Disable avx512vbmi detection with gcc < 6

 -- Ondřej Surý <ondrej@debian.org>  Tue, 05 Dec 2023 08:12:00 +0100

php8.3 (8.3.0-4) experimental; urgency=medium

  * Disable AVX detection with GCC < 6

 -- Ondřej Surý <ondrej@debian.org>  Mon, 04 Dec 2023 19:54:57 +0100

php8.3 (8.3.0-3) experimental; urgency=medium

  * Also disable avx detection with older compilers

 -- Ondřej Surý <ondrej@debian.org>  Sun, 03 Dec 2023 08:59:08 +0100

php8.3 (8.3.0-2) experimental; urgency=medium

  * We also have to disable assembly code with gcc 4.9 on i386.

 -- Ondřej Surý <ondrej@debian.org>  Sat, 02 Dec 2023 22:10:03 +0100

php8.3 (8.3.0-1) experimental; urgency=medium

  * New upstream version 8.3.0

 -- Ondřej Surý <ondrej@debian.org>  Fri, 24 Nov 2023 09:03:44 +0100

php8.3 (8.3.0~rc5-1) experimental; urgency=medium

  * New upstream version 8.3.0~rc5

 -- Ondřej Surý <ondrej@debian.org>  Thu, 26 Oct 2023 08:55:54 +0200

php8.3 (8.3.0~rc3-1) experimental; urgency=medium

  * Reintroduce patch to copy config.guess, config.sub, and ltmain.sh
  * New upstream version 8.3.0~rc3

 -- Ondřej Surý <ondrej@debian.org>  Fri, 06 Oct 2023 11:18:21 +0200

php8.3 (8.3.0~rc1-1) experimental; urgency=medium

  * New upstream version 8.3.0~rc1
  * Bump PHPAPI to 20230831

 -- Ondřej Surý <ondrej@debian.org>  Sat, 02 Sep 2023 08:28:02 +0200

php8.3 (8.3.0~beta3-2) experimental; urgency=medium

  * Disable DTrace as it still FTBFS

 -- Ondřej Surý <ondrej@debian.org>  Tue, 29 Aug 2023 11:19:05 +0200

php8.3 (8.3.0~beta3-1) experimental; urgency=medium

  * New upstream version 8.3.0~beta3

 -- Ondřej Surý <ondrej@debian.org>  Tue, 29 Aug 2023 09:27:19 +0200

php8.3 (8.3.0~beta2-1) experimental; urgency=medium

  * New upstream version 8.3.0~beta2
  * Remove DTrace build patch, fixed upstream
  * Enable DTrace on all architectures
  * Pull patch to fix DTrace enabled build

 -- Ondřej Surý <ondrej@debian.org>  Sun, 20 Aug 2023 13:28:13 +0200

php8.3 (8.3.0~alpha3-1) experimental; urgency=medium

  * New upstream version 8.3.0~alpha3
  * Bump PHPAPI to 20220830

 -- Ondřej Surý <ondrej@debian.org>  Mon, 10 Jul 2023 09:57:19 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog php8.5-common`.
