5.5 has reached end-of-life and will no longer receive
bugfixes or security patches from the PHP Project. Some downstream distributions may still continue to provide
backported fixes for a time, depending on their support policy.
Fixed bug #65028 (Phar::buildFromDirectory creates corrupt archives for some specific contents).
sessions
Implemented strict sessions RFC (https://wiki.php.net/rfc/strict_sessions) which protects against session fixation attacks and session collisions. (CVE-2011-4718).
Fixed possible buffer overflow under Windows. Note: Not a security fix.
Changed session.auto_start to PHP_INI_PERDIR.
soap
Fixed bug #65018 (SoapHeader problems with SoapServer).
spl
Fixed bug #65328 (Segfault when getting SplStack object Value).
Added RecursiveTreeIterator setPostfix and getPostifx methods.
Added simplified password hashing API (https://wiki.php.net/rfc/password_hash).
Added support for constant array/string dereferencing.
Added array_column function which returns a column in a multidimensional array. https://wiki.php.net/rfc/array_column.
Added boolval().
Added "Z" option to pack/unpack.
Added Generator::throw() method.
Added Class Name Resolution As Scalar Via "class" Keyword.
Added optional second argument for assert() to specify custom message. Patch by Lonny Kapelushnik (lonny@lonnylot.com).
Added support for using empty() on the result of function calls and other expressions (https://wiki.php.net/rfc/empty_isset_exprs).
Added support for non-scalar Iterator keys in foreach (https://wiki.php.net/rfc/foreach-non-scalar-keys).
Added support for list in foreach (https://wiki.php.net/rfc/foreachlist).
Added support for changing the process's title in CLI/CLI-Server SAPIs. The implementation is more robust that the proctitle PECL module. More details here: https://wiki.php.net/rfc/cli_process_title.
Added ARMv7/v8 versions of various Zend arithmetic functions that are implemented using inline assembler
Added systemtap support by enabling systemtap compatible dtrace probes on linux.
Optimized access to temporary and compiled VM variables. 8% less memory reads.
The VM stacks for passing function arguments and syntaticaly nested calls were merged into a single stack. The stack size needed for op_array execution is calculated at compile time and preallocated at once. As result all the stack push operatins don't require checks for stack overflow any more.
Improve set_exception_handler while doing reset.
Return previous handler when passing NULL to set_error_handler and set_exception_handler.
Fixed bug #49348 (Uninitialized ++$foo->bar; does not cause a notice).
Fixed Bug #23955: allow specifying Max-Age attribute in setcookie()
Fixed bug #18556 (Engine uses locale rules to handle class names).
Fix undefined behavior when converting double variables to integers. The double is now always rounded towards zero, the remainder of its division by 2^32 or 2^64 (depending on sizeof(long)) is calculated and it's made signed assuming a two's complement representation.
Drop support for bison < 2.4 when building PHP from GIT source.
apache2 handler sapi
Enabled Apache 2.4 configure option for Windows
calendar
Fixed bug #64895 (Integer overflow in SndToJewish).
Fixed bug #54254 (cal_from_jd returns month = 6 when there is only one Adar)
cli server
Fixed bug #64128 (buit-in web server is broken on ppc64).
curl
Remove curl stream wrappers.
Implemented FR #46439 - added CURLFile for safer file uploads.
Fixed bug #53437 (Crash when using unserialized DatePeriod instance).
dba
Bug #62489: dba_insert not working as expected.
filter
Implemented FR #49180 - added MAC address validation.
fileinfo
Upgraded libmagic to 5.14.
Fixed bug #64830 (mimetype detection segfaults on mp3 file).
Fixed bug #63590 (Different results in TS and NTS under Windows).
Fixed bug #63248 (Load multiple magic files from a directory under Windows).
fpm
Add --with-fpm-systemd option to report health to systemd, and systemd_interval option to configure this. The service can now use Type=notify in the systemd unit file.
Ignore QUERY_STRING when sent in SCRIPT_FILENAME.
Log a warning when a syscall fails.
Implemented FR #64764 (add support for FPM init.d script).
Fixed Bug #64915 (error_log ignored when daemonize=0).
Fixed bug #63999 (php with fpm fails to build on Solaris 10 or 11).
Fixed some possible memory or resource leaks and possible null dereference detected by code coverity scan.
Fixed Bug #64961 (segfault in imagesetinterpolation).
Fix build with system libgd >= 2.1 which is now the minimal version required (as build with previous version is broken). No change when bundled libgd is used.
hash
Added support for PBKDF2 via hash_pbkdf2().
Fixed Bug #64745 (hash_pbkdf2() truncates data when using default length and hex output).
intl
Added UConverter wrapper.
The intl extension now requires ICU 4.0+.
Added intl.use_exceptions INI directive, which controls what happens when global errors are set together with intl.error_level.
MessageFormatter::format() and related functions now accepted named arguments and mixed numeric/named arguments in ICU 4.8+.
MessageFormatter::format() and related functions now don't error out when an insufficient argument count is provided. Instead, the placeholders will remain unsubstituted.
MessageFormatter::parse() and MessageFormat::format() (and their static equivalents) don't throw away better than second precision in the arguments.
IntlDateFormatter::__construct and datefmt_create() now accept for the $timezone argument time zone identifiers, IntlTimeZone objects, DateTimeZone objects and NULL.
IntlDateFormatter::__construct and datefmt_create() no longer accept invalid timezone identifiers or empty strings.
The default time zone used in IntlDateFormatter::__construct and datefmt_create() (when the corresponding argument is not passed or NULL is passed) is now the one given by date_default_timezone_get(), not the default ICU time zone.
The time zone passed to the IntlDateFormatter is ignored if it is NULL and if the calendar passed is an IntlCalendar object -- in this case, the IntlCalendar's time zone will be used instead. Otherwise, the time zone specified in the $timezone argument is used instead. This does not affect old code, as IntlCalendar was introduced in this version.
IntlDateFormatter::__construct and datefmt_create() now accept for the $calendar argument also IntlCalendar objects.
IntlDateFormatter::getCalendar() and datefmt_get_calendar() return false if the IntlDateFormatter was set up with an IntlCalendar instead of the constants IntlDateFormatter::GREGORIAN/TRADITIONAL. IntlCalendar did not exist before this version.
IntlDateFormatter::setCalendar() and datefmt_set_calendar() now also accept an IntlCalendar object, in which case its time zone is taken. Passing a constant is still allowed, and still keeps the time zone.
IntlDateFormatter::setTimeZoneID() and datefmt_set_timezone_id() are deprecated. Use IntlDateFormatter::setTimeZone() or datefmt_set_timezone() instead.
IntlDateFormatter::format() and datefmt_format() now also accept an IntlCalendar object for formatting.
Added the classes: IntlCalendar, IntlGregorianCalendar, IntlTimeZone, IntlBreakIterator, IntlRuleBasedBreakIterator and IntlCodePointBreakIterator.
Added the methods: IntlDateFormatter::formatObject(), IntlDateFormatter::getCalendarObject(), IntlDateFormatter::getTimeZone(), IntlDateFormatter::setTimeZone().
Added the functions: datefmt_format_object(), datefmt_get_calendar_object(), datefmt_get_timezone(), datefmt_set_timezone(), datefmt_get_calendar_object(), intlcal_create_instance().
mbstring
Fixed bug #64769 (mbstring PHPTs crash on Windows x64).
MCrypt
mcrypt_ecb(), mcrypt_cbc(), mcrypt_cfb() and mcrypt_ofb() now throw E_DEPRECATED.
mysql
This extension is now deprecated, and deprecation warnings will be generated when connections are established to databases via mysql_connect(), mysql_pconnect(), or through implicit connection: use MySQLi or PDO_MySQL instead (https://wiki.php.net/rfc/mysql_deprecation).
Dropped support for LOAD DATA LOCAL INFILE handlers when using libmysql. Known for stability problems.
Added support for SHA256 authentication available with MySQL 5.6.6+.
mysqli
Added mysqli_begin_transaction()/mysqli::begin_transaction(). Implemented all options, per MySQL 5.6, which can be used with START TRANSACTION, COMMIT and ROLLBACK through options to mysqli_commit()/mysqli_rollback() and their respective OO counterparts. They work in libmysql and mysqlnd mode.
Fixed bug #64726 (Segfault when calling fetch_object on a use_result and DB pointer has closed).
Fixed bug #64394 (MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS undeclared when using Connector/C).
mysqlnd
Add new begin_transaction() call to the connection object. Implemented all options, per MySQL 5.6, which can be used with START TRANSACTION, COMMIT and ROLLBACK.
