Skip to content

[pull] master from php:master#767

Merged
pull[bot] merged 5 commits into
dolfly:masterfrom
php:master
May 19, 2026
Merged

[pull] master from php:master#767
pull[bot] merged 5 commits into
dolfly:masterfrom
php:master

Conversation

@pull

@pull pull Bot commented May 19, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

TimWolla and others added 5 commits May 19, 2026 14:16
…s()` (#22089)

* zend_objects: Make `old_object` a `const*` in `zend_objects_clone_members()`

* tree-wide: Make the original object `const` in `clone_obj` handlers
* ext/session: secure session configuration defaults (PHP 8.6 RFC)

Implements the "Secure Session Configuration Defaults" RFC by changing
three INI defaults to provide secure session behavior out of the box:

- session.use_strict_mode: 0 -> 1 (mitigates session fixation)
- session.cookie_httponly: 0 -> 1 (mitigates XSS access to session cookie)
- session.cookie_samesite: "" -> "Lax" (mitigates CSRF)

RFC: https://wiki.php.net/rfc/session_security_defaults
* PHP-8.4:
  PHP-8.4 is now for PHP 8.4.23-dev
* PHP-8.5:
  PHP-8.4 is now for PHP 8.4.23-dev
@pull pull Bot locked and limited conversation to collaborators May 19, 2026
@pull pull Bot added the ⤵️ pull label May 19, 2026
@pull pull Bot merged commit 5394a8a into dolfly:master May 19, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants