php-src Runtime Maintenance Around OpenSSL 4 and SOAP

php-src had a busy seven day window: 82 commits, 340 files changed, and a clear bias toward runtime plumbing rather than user facing syntax. For data engineers, the useful read is not a new language feature. It is the maintenance around TLS builds, SOAP transport code, URI validation, archive reads, and profiling paths that sit under CMS exports, feed pullers, and old integration jobs.

The largest operator visible change is the OpenSSL 4 compatibility pass. It changes macOS CI to install openssl@4, points package config at that path, and adjusts extension code so PHP can build against the newer library while keeping OpenSSL 1.1 compatibility.

The important part is in the runtime code, not the package install line. ext/openssl/openssl.c now avoids registering sslv3 when OpenSSL is 4 or newer. ext/openssl/xp_ssl.c is also part of the same patch set, which matters because PHP streams are where many ingestion scripts meet HTTPS endpoints.

This is mostly preparation work. It does not mean every production image should jump to OpenSSL 4 this week. It does mean custom PHP builds in regulated environments should start testing images that link against the newer OpenSSL line. The failure mode here is basic but expensive: a data puller that worked in CI with one TLS stack can fail at build time or at connection setup when the base image moves.

SOAP is not fashionable, but it is still present in payment exports, insurance feeds, public sector systems, and vendor APIs that data teams inherit. That is why the cluster of SOAP commits is worth more than a quick glance.

The parser refactor changes parse_packet_soap() to accept a zend_string instead of a raw buffer plus size pair. The touched path includes ext/soap/php_packet_soap.c and ext/soap/soap.c. The behavioral goal is modest: make ownership and length handling harder to misuse.

The HTTP side follows the same pattern. The zend_string cleanup in php_http.c pushes header and body handling toward typed Zend strings in ext/soap/php_http.c. The bool cleanup replaces integer truth values in request and response control flow. None of this changes a WSDL contract. It reduces the room for future bugs in a path where malformed responses, redirects, chunked bodies, and compression already make enough noise.

The URI change is only two lines, but it points at the kind of detail that matters in long running workers. IPv6 and IPvFuture host validation now uses the memory manager aware helpers from the URI parser. For services that validate many remote feed URLs, small allocator mismatches are exactly the kind of issue that can hide until traffic or input variety changes.

A similar cleanup landed in phpdbg. The breakpoint lookup fix replaces manual lower case key duplication with zend_hash_str_find_ptr_lc(). The old path leaked the duplicated lookup key when resolving method and function opline breakpoints. That is a debugger path, not a production request path, but it still matters for teams using phpdbg to chase memory behavior in CLI import jobs.

The wider case insensitive lookup cleanup is visible in the zend_hash_find_ptr_lc() change, which touches engine and extension call sites including ext/hash/hash.c, ext/opcache/ZendAccelerator.c, and ext/reflection/php_reflection.c. The pattern is the same: remove local string handling where a shared helper can carry the details.

The ZipArchive fix is a good example of a narrow change with real pipeline impact. ZipArchive::getFromIndex() now honors FL_UNCHANGED for deleted entries, matching getFromName(). If a job stages an archive, marks entries for deletion, and still needs to read original contents before close, getFromIndex() should no longer diverge from the name based path.

Intl had a more cautious outcome. A NumberFormatter parse offset overflow guard added a range check before casting a PHP integer into an ICU int32_t, with tests for 64 bit builds in ext/intl/formatter/formatter_parse.cpp. It was then reverted shortly after landing. The right takeaway is simple: do not plan on that guard yet. Track the follow up if your import code passes user supplied offsets into number or currency parsing.

There is also a small DBA cleanup. The info function no longer duplicates constant handler strings before returning them. For most users that is invisible. For extension maintainers, it is one more sign that the week was about tightening ownership rules around old surfaces rather than adding new API surface.

CGI now has perf stat --control support. The new helper lets a profiled CGI process enable counters after warmup and disable them before shutdown. That matches the existing Valgrind shape and gives lower noise when measuring request work instead of process setup.

The practical setup uses fifos and two environment variables:

mkfifo /tmp/perfctl /tmp/perfack
perf stat -D -1 --control fifo:/tmp/perfctl,/tmp/perfack
PERF_STAT_CTL_FIFO=/tmp/perfctl PERF_STAT_ACK_FIFO=/tmp/perfack php-cgi ...

This is not an everyday production switch. It is useful when a PHP based importer or CMS export endpoint is slow enough that sampling alone leaves too much uncertainty. The change gives maintainers a way to measure the request slice more cleanly.

  • Test PHP images that link against OpenSSL 4 before base image upgrades force the issue.
  • Watch the intl follow up if your code passes offsets into number or currency parsing.
  • Keep an eye on SOAP changes if you own old vendor integrations. The current work is internal, but the touched code is close to headers, redirects, compressed bodies, and XML parsing.