This post is a summary of PHP Core Roundup #18, the PHP Foundation's official monthly newsletter. 🐘🎉

Last month brought some excellent improvements to PHP's core, most of which will land in PHP 8.4.

PHP 8.3

The version is on its final release candidates (RCs), scheduled to officially ship on November 23rd.

Last month, I got to contribute the pt_BR translation of every change for this version, you can check it out at: Migrating from PHP 8.2.x to PHP 8.3.x.

Releases

The PHP development team shipped two new versions in October 2023: PHP 8.2.12 and PHP 8.1.25.

These versions include several bug fixes and improvements, mainly in areas like Core, CLI, CType, DOM, Fileinfo, Filter, Hash, Intl, MySQLnd, Opcache, PCRE, SimpleXML, Streams, XML, and XSL.

PHP 8.0 is reaching its end of life ):

The version will reach its end of life (EOL) and won't receive any more security updates after November 26th, 2023.

You can check out the version support timeline here.

RFCs

Several topics were discussed last month. So, I decided to include the ones I find most relevant in my opinion, you can check out the rest in the newsletter's official post, linked at the end of this article.

Increasing the default BCrypt cost by Tim Düsterhus

The RFC was unanimously approved, but in the second vote, where a new cost value had to be decided, opinions were split.

This cost refers to BCrypt's variable cost factor, which aims to provide adaptive security against increases in processing power, and thus faster cracking speed.

The change will be applied to the password_hash() function, e.g.:

$password = 'my_super_hard_password';
// Previously, the default value was 10
password_hash($password, \PASSWORD_BCRYPT, ['cost' => 10]);

// Now it will be 12
password_hash($password, \PASSWORD_BCRYPT, ['cost' => 12]);

// The final [cost] argument isn't required, it was included just for the example

This will mean a small performance hit, but a gain in security.

This change was proposed following a discussion started by Vinicius Dias, from the Dias de Dev channel.

DOM HTML5 parsing and serialization by Niels Dossche

This RFC is very important, it adds support for parsing and serializing HTML5 documents. That's right, the language only supported parsing up to HTML4.

With this, PHP 8.4 will get new classes in the DOM extension, namely: DOM\HTMLDocument and DOM\XMLDocument.

The HTMLDocument class will add support for parsing and serializing HTML5 documents. The XMLDocument class serves as a modern alternative to \DOMDocument, which is kept for compatibility.

A new JIT implementation based on IR Framework by Dmitry Stogov

The RFC proposed a new JIT implementation, which was and will keep being developed separately from the Core, through an Intermediate Representation (IR).

The main advantage of the new approach is that the PHP source code will be free from the low-level details of JIT compilation. The downside is a longer JIT compile time.

For most applications, there shouldn't be major performance changes for now.

If you know a lot about low-level stuff or are just curious to learn more about this change, check out this presentation by the author.

Unbundle ext/imap, ext/pspell, ext/oci8, and ext/PDO_OCI by Derick Rethans

The RFC proposes removing the mentioned extensions from PHP's source distribution and moving them to PECL.

Why? They're quite outdated and/or don't have an official maintainer to support them.

Merged PRs and commits

PHP's Core received several contributions last month, you can check out the list in the official newsletter.

Support the PHP Foundation

The PHP Foundation supports, promotes, and advances the PHP language. You can help support the PHP Foundation on OpenCollective or through GitHub Sponsors.

Official newsletter #18

To check out everything new this month, click here.

Thanks for following along this far, see you in the next one! 🐘🤟