Len Woodward

Sponsored by Tideways — PHP production profiling, tracing, and monitoring: from slow request to root cause. Free trial: tideways.com We're Artisan Build. See you next week.

This week in PHP internals: the 35-ballot deprecation vote enters its final week with list() deadlocked 21-21, a second RFC author pulled his own vote over the process rules, and PHP 8.6 officially gets a Duration class. Full rundown: https://youtu.be/8YUc-A2h-f4 #PHP #PHPInternals #PHP86

Quick hits: @zeriyoshi@phpc.social rebuilt his cache RFC as a bundled user_cache extension (8.7-bound, says @Crell@phpc.social); Holly Schilling's 4x setter fix needs no RFC; fennic pitched engine-native PSR-4 autoloading (Heinz Wiesinger already has a PECL ext); TrueAsync's Edmond posted an async scheduler ABI pre-RFC with zero user-visible changes; Osama Aldemeery got RFC karma in 2 minutes; and 8.6.0alpha2, 8.5.9RC1, and 8.4.24RC1 all shipped. Soft freeze August 11, beta1 August 13.

Quick hits: the query params array API slimmed to 2–3 methods, readonly property defaults finally got replies, Holly Schilling's 4x asymmetric-setter fix became a formal RFC, PregException got its name, the CURLOPT_HTTPHEADER newline-injection fix (upstream curl agrees), bundled GD to libgd 2.4, and a real DTLS draft PR.

gd 2.4 (Pierre Joye): codec sync with upstream libgd — QOI, JPEG XL, UltraHDR, animated GIF and WebP — plus a Gd\ OOP API and a new 2D vector canvas. The problem is the calendar: with alpha1 out July 2, the cutoff for an RFC's final state was July 14, four days before the thread opened. @mbeccati@phpc.social: "As much as I like this RFC, I'm afraid it came in a little too late." Jakub Zelenka: nobody can grant exceptions. So it's alive — aimed at the next release, whatever its number.

Seifeddine Gmati opened the literal scalar types vote Thursday morning - and retracted it 18 minutes later over the process prerequisites. Juris Evertovskis: "bureaucratic hoops that people have to jump through". Bob Weinand: "way overboard in terms of strictness". It reopens July 30.

gd 2.4 wound down to closing statements. Pierre Joye: "Process has to be humane." @imsop@tech.lgbt: a 47-60-minute read is triage, not red tape. And the procedural gd functions are headed for a deprecation warning in 8.7, gone in PHP 9.

Function autoloading (mark 5) got smaller on purpose. @timwolla@phpc.social argued the declare(strict_namespace=1) directive was "a sufficiently unrelated concern" that it should be its own prerequisite RFC — and Paul M. Jones agreed and shipped it overnight. strict-namespace is now its own RFC on the wiki.

Deprecations for PHP 8.6 (@Girgias@phpc.social) is frozen: call to vote July 20, ballots open July 27, done by August 10 — timed so accepted proposals land in 8.6.0beta1. Every removal still gets its own ballot. The week's lightest subplot: whether the deprecation notices' comma splices should be semicolons.

Caleb White's pipe assignment operator went to ballot Tuesday, coached to the deadline by @timwolla@phpc.social - and split the voters clean down the middle, 8-8-3. It needs 2/3 by Aug 11.

@Girgias@phpc.social opened the 8.6 mass-deprecation vote: 35 separate ballots, each needing its own 2/3. list() sits at 17-19 - more no than yes - after @jrf_nl@phpc.social's Packagist scan found it 12,000+ times. The _() gettext alias (6-18) and in/out/inout (5-16) are failing too. Closes Aug 10.

Typed arrays: 5 days from proposal to shelf. Wendell Adriel proposed array Thursday with 3 enforcement levels. Lazare Inepologlou flagged the variance soundness hole, Rob Landers the generics overlap, @imsop@tech.lgbt the rhyme with the just-declined bound-erased generics, and @brzuchal@phpc.social a parse_str() loophole that dodges the check. On hold by Monday. @Crell@phpc.social wants real typed list/set/dict objects instead — Wendell volunteered to help build exactly that.

Nick Sdot's readonly property defaults stand at 17-0. Khaled Alam's const object property writes stand at 11-2 (after @ilutov@phpc.social caught a missing abstain option on day 1). Both above the bar, closing Aug 7 and 8.

New: Primary Constructors (Rob Landers) — the whole constructor hoisted onto the class line. The fight is whether it should allow a body; Rob says no ("use a constructor"). His pitch: ~30–40% of constructors are completely empty, and 71% of Laravel / 61% of Symfony classes could use it.

@derickr@phpc.social found master's stream warnings no longer say which file failed to open - display_error_function_args fallout. Kamil Tekiela: paths can leak, fix forward rather than revert.

ime\Duration (@timwolla@phpc.social & @derickr@phpc.social) is slimming down for 8.6: ship add / subtract / multiply now, defer dividing one duration by another. The word "period" is being dropped from the method names, and negative durations are now allowed after a concrete use case turned up.

...and by Geocodio - address correction, geocoding, data enrichment, and distance calculations for North America and the UK. Built on Laravel since 2014. Try it free: https://geocod.io

Time\Duration (@timwolla@phpc.social and @derickr@phpc.social) is days from the ballot box — and picked up its first declared No, from Pierre Joye: "it adds confusions and limitations from what is supposed to be a simple first step." The defense reached for Usain Bolt's 9 seconds 58 hundredths. Cooldown ends Friday evening; the vote opens within days.

PHP's next time class marks a moment and leaves telling the time to a clock, and there's a request on the table for the map of the rest of the new API. The regex RFC's callback question is settled against wrapping, with a compiled-pattern alternative posted alongside it. A closure-as-entry-point idea lasted a day, the Argon2 default ran into OpenSSL, and 8.6 is frozen. 12 stories, about 12 minutes. A new one every week. https://youtu.be/ygEvagzKZy8 #PHP #PHPInternals #PHP86

The Duration thread grew a PHP 9 subplot: Holly Schilling (@TheCodeLorax@tech.lgbt) announced a Value Structs proposal for after the 8.6 window and argued Duration would make a better struct than a class. @ilutov@phpc.social linked his existing structs-v2 draft — she'd read it before drafting her own and diverged on purpose. @timwolla@phpc.social saw no reason to make the stdlib wait on a draft that "will take an unknown duration to land" — his pun.

No ballots were open this week — instead the queue got dates: minimum supported versions opens July 16, Time\Duration around July 17–20, deprecations July 27, const obj->prop write by July 28 at the latest. All 8.6 voting must close before beta 1 on August 13 (soft freeze August 11).

The other live vote: minimum supported versions for PHP 8.6 (Eric Norris). Requiring autoconf 2.71 stands at 20–3 with 4 abstentions; COM_RESET_CONNECTION (MySQL 5.7.3+ / MariaDB 10.2.4+, so persistent connections actually reset) at 21–0 with 3. Alexander Kurilo asked for an opt-in; Eric: "MySQL 5.7.3 is at least a decade old; it was released on December 3rd, 2013." Jakub Zelenka's No is about RHEL 8/9 packaging — Tim offered to delay that merge to early 8.7. Closes July 30.

@mbeccati@phpc.social was the only no on deprecating the dechunk filter on Monday; by Wednesday morning the count is 15-13. Jakub Zelenka calls it "a half baked deprecation" that stays for internal use either way; Pierre Joye would keep the deprecation. Symfony has shipped a pure-PHP fallback since 8.2.

strict-namespace (Paul M. Jones) spent its first full week arguing about one word. @imsop@tech.lgbt objected that "strict" implies a check that isn't there; @ilutov@phpc.social questioned the value if the old behavior never goes away; @timwolla@phpc.social is in favor — renamed global_fallback=0. Four candidates on the table. Theodore Brown floated the same directive in 2019. @beberlei@phpc.social suggested voting concept and name separately; Rowan warned that traps voters who hate one name.

Top story: voting on Time\Duration (@timwolla@phpc.social and @derickr@phpc.social) opened Friday. The primary stands at 23–1; full method names lead 18–1 — multiplyBy and divideBy, not mul and divBy. And Pierre Joye, last week's most vocal skeptic, closed the loop: "We were like ships passing in the night for some of my disagreements." The per-unit constructors had been in the RFC all along. His verdict: "Anything can be perfect, or shipped. Choose one." He voted yes. Closes July 31.

Sponsored by Tideways — from slow request to root cause in minutes: profiling, tracing, and monitoring built for PHP. 5-minute install, no credit card: tideways.com We're Artisan Build. See you next week.

Marc Henderkes wants one PHP build: ZTS by default, NTS gone in PHP 9 (FPM stays — a single-threaded ZTS run keeps everything NTS does today). The performance tax is dissolving: ~5% in 8.5, ~1.5% in 8.6, likely ~0.5% after open PRs. Both named blockers were fixed within two days. Benjamin Eberlei is on board.

Osama Aldemeery's PREG_THROW_ON_ERROR is now a real RFC: an opt-in flag, a catchable PregException, byte-for-byte identical behavior otherwise. Targets the release after 8.6.

Hours before we hit record: Native Markup Expressions, from Liam Hammett — JSX-style markup as first-class PHP expressions, escaped by default, compiling to new \Markup\Element(...). Pure compile-time sugar, per the RFC. The first fight is over the capitalized-tags-are-components heuristic.

The deprecations list for 8.6 got its evidence file: @jrf_nl@phpc.social scanned the Packagist Top 4000 (446,664 files) — list() appears 12,275 times ("I'm definitely not in favour of deprecating list()"), spl_object_hash() 625, is_integer() 303, several proposals a clean 0. Kamil Tekiela patched a missed procedural mysqli_stmt_init(). And @Girgias@phpc.social confirmed the timetable: ballots open Monday, July 27, for 2 weeks — every deprecation voted in isolation.

TrueAsync's Edmond shipped the async scheduler ABI RFC: a coroutine representation in the engine, the scheduler pluggable by extension, zero new PHP symbols. Seifeddine Gmati: "the right path forward."

Top story: class extensions, from Holly Schilling — add methods to classes you don't own, Swift-style. Three draft RFCs plus a working implementation, and the biggest thread of the week at 26 messages. The twist: two days in she disowned her own scalar-methods design ("If I can't support my own implementation, no one else should either") and rebuilt all three drafts on C# 14's new extension syntax — in a day.

This week's sponsor: OurCVEs — inventory your entire infrastructure and surface only the security risks that actually apply to your team. Free for open source: ourcves.com We're Artisan Build. See you next week.

This week's episode is supported by Tideways - profiling, tracing & monitoring built for PHP: from slow request to root cause in minutes. Free trial, 5-minute setup, no credit card: https://tideways.com

Quick hits: grapheme_mask's vote was called too early and sent back; the write-to-constants RFC grew and slipped its vote; DTLS is converging on a dtls:// stream wrapper; Gina volunteered to review the SNMP work; Literal Scalar Types hit v0.3; and PHP 8.6.0 alpha 1 was built.

Serializable closures (Nicolas Grekas) spent the week absorbing @timwolla@phpc.social's review — the tagged-union serialization format went in, a compile-time body-hash staleness check replaced the fragile line-number guard — and then hit a wall: Ilija Tovilo is "sadly not in favor of this RFC."

Runtime modules → "containers" (Alex Pătrănescu): give each package a private symbol table so two versions can coexist in one request. Rowan Tommins keeps circling the genuinely hard part — what happens when an object crosses the wall between two containers?

Being a polymath can be interesting, but it can also backfire. Like when your kid asks you (at bedtime) how books are made, and you decide that’s a perfect time for a 90 minute lesson on bookbinding

Also this week: beta 1 lands Aug 13 and every 8.6 vote must close first. curl (@bagder@mastodon.social) will reject header newlines upstream. The snmp PRs are at the finish line. PEAR bug pages now error out (@jrf_nl@phpc.social). And collections wait on reified generics, say @Crell@phpc.social and @TheCodeLorax@tech.lgbt.

A PHP RFC went to a vote on Tuesday morning, was winning 4 to 1, and its author closed it inside the hour — because of what the one no vote said. The enum question it left behind now has a concrete proposal on the table. Also: the array_str_contains benchmark came back slower than a foreach loop, and the list said, in as many words, that it doesn't want the function. And PEAR's bug data is back. 10 stories, about 10 minutes. https://youtu.be/flBkw2Rf7xE #PHP #PHPInternals #PHP86

Pipe assignment |>= (Caleb White) picked up a rival: Vadim Dvorovenko's left-to-right assignment RFC claims the same token with opposite semantics — and pushed @Crell@phpc.social into the No column. @timwolla@phpc.social corrected the schedule claim: voting could still open July 27 and close August 10, before the freeze. Bob Weinand asked whether the desugaring double-fires property hooks; Caleb's tests show |>= behaves exactly like ??=. Vadim's own RFC: 0 replies so far.

Spicy pre-RFC: scalar object methods (Michal Kral) — write (3)->pow(2) or "hello"->trim(), rewritten at compile time. Cool reception. Seif's core objection: PHP compiles one file at a time, so "the compiler already knows it's a scalar" covers almost no real code.

First-time author watch: Caleb White got RFC karma and his pipe assignment operator (|>=) went through review at speed — @timwolla@phpc.social liked the shape, caught a precedence claim, and Caleb fixed it same-day, twice. Ben Ramsey's contribution: |> is the volcano operator, |>= is the erupting volcano operator.

Votes. Declined: Generics 7–19–10, __exists 2–13. Passed, no No votes: return-from-constructor 39–0 (unanimous), php://filter chain cap 30–0–2, Locale display keywords 18–0–2. Still open: third-party ext docs out of the manual, 25–1–1, closes July 3.

Closing this week: minimum supported versions (autoconf 27-2, COM_RESET_CONNECTION 26-0 - Thursday) and Time\Duration by @timwolla@phpc.social and @derickr@phpc.social (33-1, full method names winning 28-2 - Friday).

The rawest thread of the week: a user's "Disheartening Rant" (Michael Morris) after TrueAsync's author put its odds of acceptance at ~10%. Larry Garfield drew the line: don't confuse "not this async, done this way" with "no async, ever." His fix — a real working group.

Serializable closures hit v0.3: @nicolasgrekas@phpc.social cut the reflection API and kept serialize() — "the one feature that most/all cache systems are built on." On security he held the line against name-based closure unserialization: "I won't commit to an RFC that turns every serialized payload into that kind of gadget, and I don't think we should, either."