Post

PHP's default password hash only reads the first 72 bytes of your password. Last week's plan to refuse longer ones split the list. This week, a fix that breaks nothing arrived, borrowed from a Python library. https://youtu.be/HHhoh-7H37A #PHP #PHPInternals #PHP87

Top story: Sjoerd Langkemper set aside his RFC to throw on bcrypt passwords past 72 bytes and proposed PASSWORD_BCRYPT_SHA256: opt-in, no BC break, Passlib-compatible. @timwolla.bsky.social suggested it and Anton Smirnov loves it. Jeff Dafoe had to force password resets over the old limit.

Two votes are open after 7 straight episodes with none. @nicksdot.dev's RFC to end PEAR's endorsement was 26–0 at recording (closes Oct 19). Weilin Du's IntlRelativeDateTimeFormatter is back with @timwolla.bsky.social's enum design: 7–0, Tim included (closes Oct 22).

Time\Instant won't pick a JSON format for you. Ilia called the empty object a trap and Rob Landers wants it to throw, but @timwolla.bsky.social and Derick Rethans say pick one yourself. Marc's 15-point review turned getUnixTimestamp into toUnixTimestamp.

Io\Terminal v0.4 dropped its interfaces: @timwolla.bsky.social argued the real boundary is the stream, not the terminal, and Bob Weinand agreed. Larry Garfield sketched tests with in-memory streams, and Pratik Bhujel is heading toward a vote.

@mnapoli.bsky.social's RFC puts FPM inside the php binary: on Lambda, 18% smaller, 25% faster cold start. @timwolla.bsky.social sees no drawbacks, Ayesh Karunaratne flagged a -F clash, Larry Garfield fears locking in FPM, and @nicolasgrekas.bsky.social and Jakub Zelenka want FPM to embed the CLI.

Ilia ran Jakub Zelenka's IO Hooks branch, found crashes under Fibers, and would make hooked calls opt-in. Jakub: fixable, not a design issue. Edmond Dantes: "now we have both halves: Scheduler + IO Hooks."

Karoly Negyesi's implements … by won over Larry Garfield and James Gilliland. Sebastian Bergmann warned new interface methods get forwarded silently, and Rowan Tommins has been here before: use cases need "just one small thing on top of the forwarded call."

Quick hits: Weilin Du takes array shorthand back to the colon. Daniel Scherzer put the b string prefix in the 8.7 deprecations RFC after Juliette Reinders Folmer stepped back. Muhammed Arshid's filter RFC is now backed enums.

Derick Rethans wants default input filtering back. Máté Kocsis wants a vote on query parameters soon. David Carlier wants unit formatting in intl. And PHP 8.6 RC3 was due Oct 8, with GA on November 19.