Post

PHP's default password hash only reads the first 72 bytes of your password. Last week's plan to refuse longer ones split the list. This week, a fix that breaks nothing arrived, borrowed from a Python library. https://youtu.be/HHhoh-7H37A #PHP #PHPInternals #PHP87

Top story: Sjoerd Langkemper set aside his RFC to throw on bcrypt passwords past 72 bytes and proposed PASSWORD_BCRYPT_SHA256: opt-in, no BC break, Passlib-compatible. @timwolla.bsky.social suggested it and Anton Smirnov loves it. Jeff Dafoe had to force password resets over the old limit.

Two votes are open after 7 straight episodes with none. @nicksdot.dev's RFC to end PEAR's endorsement was 26–0 at recording (closes Oct 19). Weilin Du's IntlRelativeDateTimeFormatter is back with @timwolla.bsky.social's enum design: 7–0, Tim included (closes Oct 22).

Time\Instant won't pick a JSON format for you. Ilia called the empty object a trap and Rob Landers wants it to throw, but @timwolla.bsky.social and Derick Rethans say pick one yourself. Marc's 15-point review turned getUnixTimestamp into toUnixTimestamp.

Io\Terminal v0.4 dropped its interfaces: @timwolla.bsky.social argued the real boundary is the stream, not the terminal, and Bob Weinand agreed. Larry Garfield sketched tests with in-memory streams, and Pratik Bhujel is heading toward a vote.

@mnapoli.bsky.social's RFC puts FPM inside the php binary: on Lambda, 18% smaller, 25% faster cold start. @timwolla.bsky.social sees no drawbacks, Ayesh Karunaratne flagged a -F clash, Larry Garfield fears locking in FPM, and @nicolasgrekas.bsky.social and Jakub Zelenka want FPM to embed the CLI.