Post

Pick a password longer than 72 bytes and PHP's default hash keeps only the first 72, so a shortened password still logs you in. An RFC wants PHP to refuse instead, and the list can't agree it's worth the break. https://youtu.be/3Hp0E0SbusM #PHP #PHPInternals #PHP87

Top story: Sjoerd Langkemper's RFC would make password_hash() with bcrypt refuse passwords past 72 bytes. Kamil Tekiela and @timwolla.bsky.social: checking length is the app's job. Rowan Tommins, Andrey Andreev and Robert Chapin are for it. Derick Rethans is a -1: "a scary BC break."

Gina P. Banyard's CompiledRegex prototype drew 18 replies, and several want it called just Regex: Larry Garfield, Casper Langemeijer, Jordi Kroon, Juris Evertovskis. Ayesh Karunaratne and @seld.be want to build one from the patterns you already have.

Pratik Bhujel's terminal extension is now the Io\Terminal RFC for PHP 8.7. @nicolasgrekas.bsky.social: calling stty is "a workaround we've been carrying since way too long." Larry Garfield wants it mockable, so v0.3 makes Terminal an interface.

Time\Instant got a bridge from DateTime: toInstant(). @timwolla.bsky.social and Derick Rethans won't write the testing-clocks RFC, and they're inviting the community to. Mirco Babin flagged a clash with PSR-20's now(). Morgan: "Well, then it's not an instant, is it?"

Weilin Du's array shorthand turns =$x into 'x' => $x. Sebastian Bergmann will vote against without data, David Carlier showed one missing comma silently changing a program, Anton Smirnov pointed at compact(), and Christian Schneider has run a local patch "for many years".

Jakub Zelenka's IO Hooks RFC would hand PHP's blocking calls (streams, sockets, curl, sleep) to a provider such as an event loop, so existing code runs concurrently under Fibers. No provider, no change. It builds on a second new RFC, Polling API Additions.

The internals list removed a contributor this week, after a warning from Derick Rethans on Sep 15 and a last warning from moderator Ilija Tovilo on Sep 21 (one new thread a month, three emails a week). A new RFC followed on Sep 27, and the address was blocked.

Quick hits: Matteo Beccati's PHP 8.6.0 RC2 is out (RC1 was skipped over a packaging error), plus security releases for 8.5, 8.4, 8.3 and 8.2. Sjoerd's number-base RFC now throws an Exception, not a ValueError. Juliette Reinders Folmer wants the b string prefix deprecated.

This week's episode is supported by Scalpels: professionally built, open source alternatives to the parts you actually use of things like Private Packagist, Mailtrap and remove.bg. Forked into your GitHub org, deployed to your own Laravel Cloud, all MIT. https://scalpels.app