On Fri, 19 Dec 2025 at 01:07, Saki Takamachi <[email protected]> wrote: > The PHP development team announces the immediate availability of PHP > 8.4.16. This is a security release. > > In the git repository, there are some oddities with the patch-level branch `PHP-8.4.16` used for the corresponding release: It contains a cherry-picked commit `cbb854f0260` that **did not** make into the actual release (tag `php-8.4.16`), and consequently, the release tag does not contain the patch-level branch, which normally does (or should).
* | | | 51f4450b47d Merge branch 'PHP-8.3' into PHP-8.4 |\ \ \ \ | |/ / / | * | | ff51ac161d6 Fix GH-20603 issue on windows 32 bits. * | | | baf193fc0de Merge branch 'PHP-8.3' into PHP-8.4 |\ \ \ \ | |/ / / | * | | 0106134bb92 Merge branch 'PHP-8.2' into PHP-8.3 | |\ \ \ | | |/ / | | * | fe070fcc756 Fix yet another xml deprecation * | | | 2ec8c29fda7 PHP-8.4 is now for PHP 8.4.17-dev | | | | * 2890cbbc494 (tag: php-8.4.16) Update versions for PHP 8.4.16 | | | | * 769a8807d99 Update NEWS with info about security issues | | | | * 7ac9c40f67e Fix GHSA-www2-q4fc-65wf | | | | * e6d7d34c1ae Fix GHSA-h96m-rvf9-jgm2 | | | | * d521259e442 Fix GHSA-8xr5-qppj-gvwj: PDO quoting result null deref | |_|_|/ |/| | | | | | | * cbb854f0260 (upstream/PHP-8.4.16) Fix GH-20603 issue on windows 32 bits. <<--- | |_|_|/ |/| | | * | | | 78e3d05d7de Merge branch 'PHP-8.3' into PHP-8.4 <<--- I believe the `PHP-8.4.16` branch should be force-pushed to `78e3d05d7de`, which is the most common ancestor with `PHP-8.4`, or to `7ac9c40f67e` if you wish to include the security patches, but definitely not to `cbb854f0260` as that commit is not in the released tarballs! (this caused some oddities in my setup as I usually merge the patch branch with the tag in my local repository).
