php-src/UPGRADING

$Id$

PHP X.Y UPGRADE NOTES

1. Backward Incompatible Changes
2. New Features
2. Changes in SAPI modules
3. Deprecated Functionality
4. Changed Functions
5. New Functions
6. New Classes and Interfaces
7. Removed Extensions
8. Other Changes to Extensions
9. New Global Constants
10. Changes to INI File Handling
11. Other Changes


========================================
1. Backward Incompatible Changes
========================================

- JSON:
  json_decode() no longer accepts non-lowercase variants of lone JSON true,
  false or null values. For example, True or FALSE will now cause json_decode to
  return NULL and set an error value you can fetch with json_last_error().
  This affects JSON texts consisting solely of true, false or null. Text
  containing non-lowercase values inside JSON arrays or objects has never been
  accepted.

- openssl:
  To prevent Man-in-the-Middle attacks against encrypted transfers client
  streams now verify peer certificates by default. Previous versions
  required users to manually enable peer verification. As a result of this
  change, existing code using ssl:// or tls:// stream wrappers (e.g.
  file_get_contents(), fsockopen(), stream_socket_client()) may no longer
  connect successfully without manually disabling peer verification via the
  stream context's "verify_peer" setting. Encrypted transfers delegate to
  operating system certificate stores by default, so many/most users *should*
  be unaffected by this transparent security enhancement.

========================================
2. New Features
========================================

- Added constant scalar expressions syntax.
  (https://wiki.php.net/rfc/const_scalar_exprs)

- Added dedicated syntax for variadic functions.
  (https://wiki.php.net/rfc/variadics)

- Added support for argument unpacking to complement the variadic syntax.
  (https://wiki.php.net/rfc/argument_unpacking)

- Added T_POW (**) operator.
  (https://wiki.php.net/rfc/pow-operator)

- Added unified default encoding. default_charset=UTF-8 and functions/extensions
  use encoding settings honor default_charset.
  (https://wiki.php.net/rfc/default_encoding)

- The php://input stream is now re-usable and can be used concurrently with 
  enable_post_data_reading=0.

- Added gost-crypto (CryptoPro S-box) hash algo.

- Added openssl certificate fingerprint support (inclusive stream context 
  option).

- Added openssl crypto method stream context option.

- Added openssl peer verification support for SAN x509 extension

- Added use function and use const.
  (https://wiki.php.net/rfc/use_function)

========================================
2. Changes in SAPI modules
========================================

- Added phpdbg sapi.
  (https://wiki.php.net/rfc/phpdbg)

========================================
3. Deprecated Functionality
========================================

- Incompatible context calls:
  Instance calls from an incompatible context are now deprecated and issue
  E_DEPRECATED instead of E_STRICT. See https://wiki.php.net/rfc/incompat_ctx

========================================
4. Changed Functions
========================================

- cURL:
  CURLOPT_SAFE_UPLOAD is now turned on by default and uploads with @file 
  do not work unless it is explicitly set to false.

- Crypt:
  crypt() will now raise an E_NOTICE error if the salt parameter is omitted.
  See: https://wiki.php.net/rfc/crypt_function_salt

- XMLReader:
  XMLReader::getAttributeNs and XMLReader::getAttributeNo now return NULL if
  the attribute could not be found, just like XMLReader::getAttribute.

- Pgsql:
  pg_insert()/pg_select()/pg_update()/pg_delete() are no longer EXPERIMENTAL.

========================================
5. New Functions
========================================

- GMP:
  Added gmp_root($a, $nth) and gmp_rootrem($a, $nth) for calculating nth roots.

- Openssl:
  Added string openssl_x509_fingerprint($x509, $type, $binary).
  Added string openssl_spki_new($private_key, $challenge, $algorithm)
  Added bool openssl_spki_verify($spkac)
  Added string openssl_spki_export($spkac)
  Added string openssl_spki_export_challenge($spkac)

- LDAP:
  Added ldap_escape($value, $ignore = "", $flags = 0).
  Added ldap_modify_batch($link_identifier, $dn, $modifications) described in https://wiki.php.net/rfc/ldap_modify_batch.

- Zip:
  Added ZipArchive::setPassword($password)

========================================
6. New Classes and Interfaces
========================================


========================================
7. Removed Extensions
========================================


========================================
8. Other Changes to Extensions
========================================

- GMP:
  The GMP extension now uses objects as the underlying data structure, rather
  than resources. GMP instances now support dumping, serialization, cloning,
  casts to primitive types and have overloaded operators.
  (RFC: https://wiki.php.net/rfc/operator_overloading_gmp)

- OCI8:
  - Added Implicit Result Set support for Oracle Database 12c with a
    new oci_get_implicit_resultset() function.
  - Using 'oci_execute($s, OCI_NO_AUTO_COMMIT)' for a SELECT no longer
    unnecessarily initiates an internal ROLLBACK during connection
    close.
  - Added DTrace probes enabled with PHP's generic --enable-dtrace
  - The oci_internal_debug() function is now a no-op.
  - The phpinfo() output format for OCI8 has changed.

- Pgsql:
  - pg_insert()/pg_select()/pg_update()/pg_delete()/pg_meta_data()/pg_convert()
    are no longer EXPERIMENTAL
  - pg_select() return PostgreSQL query resources when query is executed.
  - Added extended flag parameter for pg_meta_data(). pg_meta_data() always
    returns "is enum" attribute.

========================================
9. New Global Constants
========================================

- LDAP:
  LDAP_ESCAPE_FILTER int(1)
  LDAP_ESCAPE_DN     int(2)

- Pgsql:
  PGSQL_DML_ESCAPE   int(4096)

========================================
10. Changes to INI File Handling
========================================

- Core:
  Changed always_populate_raw_post_data to throw a deprecation warning when
  enabled and to recognize ohe value -1 for never populating the global 
  $HTTP_RAW_POST_DATA variable, which will be default in future PHP versions.

========================================
11. Other Changes
========================================

- File upload:
  Uploads equal or greater than 2GB in size are now accepted.

- HTTP stream wrapper:
  HTTP 1.1 requests now include a Connection: close header unless explicitly
  overridden by setting a Connection header via the header context option.

- Zip:
  New --with-libzip option allow to use system libzip. Version > 0.11 required,
  Version >= 0.11.2 recommended for all features.