Skip to content

Conversation

@N6REJ
Copy link
Collaborator

@N6REJ N6REJ commented Sep 24, 2025

PR Type

Enhancement


Description

• Added complete PHP 8.3.26 and 8.4.13 configurations with Bearsampp integration
• Updated bundle release version from 2025.8.22 to 2025.9.24
• Configured PHP extensions (imagick, memcache, xdebug) for both versions
• Added ImageMagick dependencies and PEAR installer configurations
• Included comprehensive php.ini files with development settings and debugging support
• Added documentation for dependencies directories


Diagram Walkthrough

flowchart LR
  A["Bundle Release 2025.8.22"] --> B["Bundle Release 2025.9.24"]
  B --> C["PHP 8.3.26 Configuration"]
  B --> D["PHP 8.4.13 Configuration"]
  C --> E["Extensions & Dependencies"]
  D --> F["Extensions & Dependencies"]
  E --> G["imagick, memcache, xdebug"]
  F --> H["imagick, memcache, xdebug"]
Loading

File Walkthrough

Relevant files
Configuration changes
11 files
php.ini.ber
PHP 8.3.26 configuration file with Bearsampp integration 

bin/php8.3.26/php.ini.ber

• Added complete PHP 8.3.26 configuration file with development
settings
• Configured paths for Bearsampp environment with
placeholders like BEARSAMPP_LIN_PATH
• Enabled extensions including
curl, gd, mysqli, openssl, and xdebug
• Set up OPcache and xdebug
configurations for development environment

+1959/-0
releases.properties
Added PHP 8.3.26 and 8.4.13 release mappings                         

releases.properties

• Added download URLs for PHP 8.3.26 and 8.4.13 releases
• Updated
release mappings to point to 2025.9.24 release versions

+2/-0     
exts.properties
PHP 8.3.26 extension configuration                                             

bin/php8.3.26/exts.properties

• Defined extension download URLs for imagick, memcache, and xdebug

All extensions point to 2025.9.24 release versions

+3/-0     
exts.properties
PHP 8.4.13 extension configuration                                             

bin/php8.4.13/exts.properties

• Defined extension download URLs for imagick, memcache, and xdebug

All extensions point to 2025.9.24 release versions with VS17 compiler
support

+3/-0     
bearsampp.conf
PHP 8.3.26 Bearsampp configuration                                             

bin/php8.3.26/bearsampp.conf

• Set PHP version to 8.3.26 with standard executable names

Configured Apache module as php8apache2_4.dll
• Added bundle release
placeholder

+9/-0     
bearsampp.conf
PHP 8.4.13 Bearsampp configuration                                             

bin/php8.4.13/bearsampp.conf

• Set PHP version to 8.4.13 with standard executable names

Configured Apache module as php8apache2_4.dll
• Added bundle release
placeholder

+9/-0     
build.properties
Updated bundle release version                                                     

build.properties

• Updated bundle release version from 2025.8.22 to 2025.9.24

+1/-1     
pear.properties
PHP 8.3.26 PEAR configuration                                                       

bin/php8.3.26/pear.properties

• Added PEAR installer URL for PHP 8.3.26

+1/-0     
pear.properties
PHP 8.4.13 PEAR configuration                                                       

bin/php8.4.13/pear.properties

• Added PEAR installer URL for PHP 8.4.13

+1/-0     
php.ini
Complete PHP 8.3.26 configuration with development settings and
extensions

bin/php8.3.26/php.ini

• Complete PHP 8.3.26 configuration file with comprehensive settings
for language options, error handling, resource limits, and module
configurations
• Includes development-oriented settings with error
reporting enabled and debugging features configured
• Contains
extensive extension configurations including database drivers (MySQL,
PostgreSQL), web services (curl, openssl), and development tools
(xdebug, opcache)
• Features BEARSAMPP-specific path configurations
and temporary directory settings

+1959/-0
php.ini
Add PHP 8.4.13 configuration file with extensions               

bin/php8.4.13/php.ini

• Added complete PHP 8.4.13 configuration file with development
settings
• Configured PHP extensions including curl, gd, mysqli,
pdo_mysql, openssl, and others
• Set up OPcache extension with
disabled default state for development
• Included Xdebug configuration
for debugging support

+1925/-0
Dependencies
2 files
deps.properties
PHP 8.3.26 dependencies configuration                                       

bin/php8.3.26/deps.properties

• Added ImageMagick dependency URL for PHP 8.3.26

+1/-0     
deps.properties
PHP 8.4.13 dependencies configuration                                       

bin/php8.4.13/deps.properties

• Added ImageMagick dependency URL for PHP 8.4.13

+1/-0     
Documentation
2 files
README.txt
PHP 8.3.26 dependencies documentation                                       

bin/php8.3.26/deps/README.txt

• Added documentation for PHP dependencies directory usage

+2/-0     
README.txt
PHP 8.4.13 dependencies documentation                                       

bin/php8.4.13/deps/README.txt

• Added documentation for PHP dependencies directory usage

+2/-0     
Additional files
1 files
php.ini.ber +1922/-0

@qodo-code-review
Copy link

qodo-code-review bot commented Sep 24, 2025

PR Reviewer Guide 🔍

(Review updated until commit 852c02a)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
🧪 No relevant tests
🔒 Security concerns

Potential information disclosure:
expose_php = On and display_errors = On can reveal environment details and stack traces in web contexts. If these php.ini files are used beyond local development, consider setting expose_php = Off and display_errors = Off (with log_errors = On).

⚡ Recommended focus areas for review

Xdebug Loading

Using zend_extension = "xdebug" without a full path can fail if the extension directory or filename resolution differs; verify that Xdebug is discoverable for both CLI and Apache SAPI, and that the DLL name matches the shipped file.

zend_extension = "xdebug"
xdebug.mode = debug
xdebug.start_with_request = trigger
xdebug.output_name = cachegrind.out.%t.%p
xdebug.output_dir = "~BEARSAMPP_LIN_PATH~/tmp/cachegrind"
xdebug.var_display_max_children = "1024"
xdebug.var_display_max_depth = "8192"
xdebug.var_display_max_data = "32768"
xdebug.max_nesting_level = "250"
Development Settings

Settings like display_errors = On, display_startup_errors = On, expose_php = On, and opcache.enable=0 are development-oriented; confirm these are intended for this bundle or consider production-safer defaults or environment overrides.

expose_php = On

;;;;;;;;;;;;;;;;;;;
; Resource Limits ;
;;;;;;;;;;;;;;;;;;;

; Maximum execution time of each script, in seconds
; http://php.net/max-execution-time
; Note: This directive is hardcoded to 0 for the CLI SAPI
max_execution_time = 60

; Maximum amount of time each script may spend parsing request data. It's a good
; idea to limit this time on productions servers in order to eliminate unexpectedly
; long running scripts.
; Note: This directive is hardcoded to -1 for the CLI SAPI
; Default Value: -1 (Unlimited)
; Development Value: 60 (60 seconds)
; Production Value: 60 (60 seconds)
; http://php.net/max-input-time
max_input_time = 90

; Maximum input variable nesting level
; http://php.net/max-input-nesting-level
;max_input_nesting_level = 64

; How many GET/POST/COOKIE input variables may be accepted
;max_input_vars = 1000

; Maximum amount of memory a script may consume
; http://php.net/memory-limit
memory_limit = 512M

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; Error handling and logging ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

; This directive informs PHP of which errors, warnings and notices you would like
; it to take action for. The recommended way of setting values for this
; directive is through the use of the error level constants and bitwise
; operators. The error level constants are below here for convenience as well as
; some common settings and their meanings.
; By default, PHP is set to take action on all errors, notices and warnings EXCEPT
; those related to E_NOTICE and E_STRICT, which together cover best practices and
; recommended coding standards in PHP. For performance reasons, this is the
; recommend error reporting setting. Your production server shouldn't be wasting
; resources complaining about best practices and coding standards. That's what
; development servers and development settings are for.
; Note: The php.ini-development file has this setting as E_ALL. This
; means it pretty much reports everything which is exactly what you want during
; development and early testing.
;
; Error Level Constants:
; E_ALL             - All errors and warnings (includes E_STRICT as of PHP 5.4.0)
; E_ERROR           - fatal run-time errors
; E_RECOVERABLE_ERROR  - almost fatal run-time errors
; E_WARNING         - run-time warnings (non-fatal errors)
; E_PARSE           - compile-time parse errors
; E_NOTICE          - run-time notices (these are warnings which often result
;     from a bug in your code, but it's possible that it was
;     intentional (e.g., using an uninitialized variable and
;     relying on the fact it is automatically initialized to an
;     empty string)
; E_STRICT          - run-time notices, enable to have PHP suggest changes
;     to your code which will ensure the best interoperability
;     and forward compatibility of your code
; E_CORE_ERROR      - fatal errors that occur during PHP's initial startup
; E_CORE_WARNING    - warnings (non-fatal errors) that occur during PHP's
;     initial startup
; E_COMPILE_ERROR   - fatal compile-time errors
; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)
; E_USER_ERROR      - user-generated error message
; E_USER_WARNING    - user-generated warning message
; E_USER_NOTICE     - user-generated notice message
; E_DEPRECATED      - warn about code that will not work in future versions
;     of PHP
; E_USER_DEPRECATED - user-generated deprecation warnings
;
; Common Values:
;   E_ALL (Show all errors, warnings and notices including coding standards.)
;   E_ALL & ~E_NOTICE  (Show all errors, except for notices)
;   E_ALL & ~E_NOTICE & ~E_STRICT  (Show all errors, except for notices and coding standards warnings.)
;   E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR  (Show only errors)
; Default Value: E_ALL
; Development Value: E_ALL
; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT
; http://php.net/error-reporting
error_reporting = E_ALL

; This directive controls whether or not and where PHP will output errors,
; notices and warnings too. Error output is very useful during development, but
; it could be very dangerous in production environments. Depending on the code
; which is triggering the error, sensitive information could potentially leak
; out of your application such as database usernames and passwords or worse.
; For production environments, we recommend logging errors rather than
; sending them to STDOUT.
; Possible Values:
;   Off = Do not display any errors
;   stderr = Display errors to STDERR (affects only CGI/CLI binaries!)
;   On or stdout = Display errors to STDOUT
; Default Value: On
; Development Value: On
; Production Value: Off
; http://php.net/display-errors
display_errors = On

; The display of errors which occur during PHP's startup sequence are handled
; separately from display_errors. We strongly recommend you set this to 'off'
; for production servers to avoid leaking configuration details.
; Default Value: On
; Development Value: On
; Production Value: Off
; http://php.net/display-startup-errors
display_startup_errors = On
Asset URLs Consistency

Newly added release links (8.3.26 and 8.4.13) should match the exact tag and artifact naming conventions; validate that files exist and checksums/signatures are handled similarly to previous entries.

8.3.26 = https://github.com/Bearsampp/module-php/releases/download/2025.9.24/bearsampp-php-8.3.26-2025.9.24.7z
8.4.1 = https://github.com/Bearsampp/module-php/releases/download/2025.2.11/bearsampp-php-8.4.1-2025.2.11.7z
8.4.3 = https://github.com/Bearsampp/module-php/releases/download/2025.2.18/bearsampp-php-8.4.3-2025.2.18.7z
8.4.4 = https://github.com/Bearsampp/module-php/releases/download/2025.2.20/bearsampp-php-8.4.4-2025.2.20.7z
8.4.5 = https://github.com/Bearsampp/module-php/releases/download/2025.4.8/bearsampp-php-8.4.5-2025.4.8.7z
8.4.6 = https://github.com/Bearsampp/module-php/releases/download/2025.4.24/bearsampp-php-8.4.6-2025.4.24.7z
8.4.10 = https://github.com/Bearsampp/module-php/releases/download/2025.8.22/bearsampp-php-8.4.10-2025.8.22.7z
8.4.11 = https://github.com/Bearsampp/module-php/releases/download/2025.8.21/bearsampp-php-8.4.11-2025.8.20.7z
8.4.13 = https://github.com/Bearsampp/module-php/releases/download/2025.9.24/bearsampp-php-8.4.13-2025.9.24.7z

@qodo-code-review
Copy link

qodo-code-review bot commented Sep 24, 2025

PR Code Suggestions ✨

Latest suggestions up to 852c02a

CategorySuggestion                                                                                                                                    Impact
Possible issue
Fix OPcache module and enable

Enable OPcache by setting opcache.enable=1 and correct the extension path to use
opcache.so instead of php_opcache.dll for a Linux environment to fix a major
performance issue.

bin/php8.3.26/php.ini.ber [1759-1768]

 ; OPCache
 
-zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/php_opcache.dll"
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/opcache.so"
 
 [opcache]
 ; Determines if Zend OPCache is enabled
-opcache.enable=0
+opcache.enable=1
 
 ; Determines if Zend OPCache is enabled for the CLI version of PHP
 opcache.enable_cli=0
  • Apply / Chat
Suggestion importance[1-10]: 9

__

Why: This suggestion fixes a critical performance issue by enabling OPcache and corrects a platform-specific error by changing the extension from .dll to .so for a Linux environment.

High
Fix platform-specific OPcache binary

Use the correct platform-specific file extension for the OPcache Zend extension
(.so for Unix-like systems, .dll for Windows) to prevent fatal startup errors.

bin/php8.4.13/php.ini [1727]

+; For Windows builds
 zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/php_opcache.dll"
+; For Unix-like builds
+;zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/opcache.so"
  • Apply / Chat
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies a critical platform incompatibility issue where a Windows .dll is specified in a configuration file likely intended for Linux, which would cause a fatal PHP startup error.

High
Fix OPcache module and enable

Correct the OPcache extension from .dll to .so for non-Windows systems and
enable it to fix a loading error and improve performance.

bin/php8.3.26/php.ini [1759-1768]

 ; OPCache
 
-zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/php_opcache.dll"
+; Use OS-appropriate extension filename:
+; - Windows: php_opcache.dll
+; - Linux/macOS: opcache.so
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/opcache.so"
 
 [opcache]
 ; Determines if Zend OPCache is enabled
-opcache.enable=0
+opcache.enable=1
 
 ; Determines if Zend OPCache is enabled for the CLI version of PHP
 opcache.enable_cli=0
  • Apply / Chat
Suggestion importance[1-10]: 8

__

Why: The suggestion correctly identifies a platform-compatibility error by pointing out the use of a .dll file in a Linux-like path context and also enables OPcache, which significantly improves performance.

Medium
Use absolute Xdebug extension path

Use the full, absolute path for the zend_extension setting for Xdebug to ensure
it loads reliably across different environments.

bin/php8.3.26/php.ini [1950-1959]

 [xdebug]
-zend_extension = "xdebug"
+; Use absolute path to the Xdebug extension for the target OS:
+; - Windows: php_xdebug.dll
+; - Linux/macOS: xdebug.so
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/xdebug.so"
 xdebug.mode = debug
 xdebug.start_with_request = trigger
 xdebug.output_name = cachegrind.out.%t.%p
 xdebug.output_dir = "~BEARSAMPP_LIN_PATH~/tmp/cachegrind"
 xdebug.var_display_max_children = "1024"
 xdebug.var_display_max_depth = "8192"
 xdebug.var_display_max_data = "32768"
 xdebug.max_nesting_level = "250"
  • Apply / Chat
Suggestion importance[1-10]: 8

__

Why: This suggestion correctly identifies that using a relative name for a Zend extension is unreliable and provides a robust fix by using an absolute path, ensuring the debugging tool loads correctly.

Medium
Remove unresolved extension placeholder

Resolve the @PHP_EXTENSIONS@ placeholder before runtime to avoid PHP startup
warnings from attempting to load an invalid extension.

bin/php8.4.13/php.ini [951]

 extension_dir = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext"
 ...
 extension=curl
 ...
 extension=pgsql
 ...
-@PHP_EXTENSIONS@
+; @PHP_EXTENSIONS@ placeholder must be removed or replaced during build.
+;extension=example_optional_ext

[To ensure code accuracy, apply this suggestion manually]

Suggestion importance[1-10]: 7

__

Why: The suggestion correctly points out that the @PHP_EXTENSIONS@ placeholder will cause PHP startup warnings if not replaced, which is a valid issue to address in a template file.

Medium
Use explicit Xdebug binary path

Use an explicit, absolute path for the zend_extension directive when loading
Xdebug to ensure it loads reliably in custom environments.

bin/php8.4.13/php.ini [1916-1919]

 [xdebug]
-zend_extension = "xdebug"
+; Use explicit absolute path for reliability
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/xdebug.so"
+; On Windows:
+;zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/php_xdebug.dll"
 xdebug.mode = debug
 xdebug.start_with_request = trigger
  • Apply / Chat
Suggestion importance[1-10]: 6

__

Why: The suggestion correctly advises using an absolute path for zend_extension to improve robustness, which is a good practice, although loading by name often works in standard setups.

Low
General
Disable Xdebug by default

Disable Xdebug by default by setting xdebug.mode to off to avoid performance
penalties, allowing it to be enabled on-demand.

bin/php8.3.26/php.ini.ber [1950-1959]

 [xdebug]
 zend_extension = "xdebug"
-xdebug.mode = debug
+xdebug.mode = off
 xdebug.start_with_request = trigger
 xdebug.output_name = cachegrind.out.%t.%p
 xdebug.output_dir = "~BEARSAMPP_LIN_PATH~/tmp/cachegrind"
 xdebug.var_display_max_children = "1024"
 xdebug.var_display_max_depth = "8192"
 xdebug.var_display_max_data = "32768"
 xdebug.max_nesting_level = "250"
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: This suggestion correctly points out that having Xdebug enabled with mode=debug introduces significant performance overhead, and recommends disabling it by default for better performance.

Medium
Security
Disable PHP version exposure

Disable PHP version exposure in HTTP headers by setting expose_php to Off to
improve security by preventing information disclosure.

bin/php8.3.26/php.ini.ber [397]

-expose_php = On
+expose_php = Off
  • Apply / Chat
Suggestion importance[1-10]: 6

__

Why: This is a good security hardening practice to prevent information leakage, which could aid attackers in identifying potential vulnerabilities based on the PHP version.

Low
Disable PHP version exposure

Set expose_php to Off to prevent exposing the PHP version in HTTP headers,
enhancing security by reducing information leakage.

bin/php8.3.26/php.ini [397]

-expose_php = On
+expose_php = Off
  • Apply / Chat
Suggestion importance[1-10]: 5

__

Why: This is a valid security hardening suggestion, but its impact is moderate as the configuration file is explicitly for a development environment where information disclosure is less critical.

Low
  • More

Previous suggestions

Suggestions up to commit 0a983d2
CategorySuggestion                                                                                                                                    Impact
Possible issue
Fix OPcache binary for platform

Correct the OPcache extension from .dll to .so to match the non-Windows path
placeholder (BEARSAMPP_LIN_PATH) and prevent loading errors.

bin/php8.3.26/php.ini.ber [1759-1765]

 ; OPCache
 
-zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/php_opcache.dll"
+; For non-Windows platforms, use the shared object:
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/opcache.so"
 
 [opcache]
 ; Determines if Zend OPCache is enabled
 opcache.enable=0
Suggestion importance[1-10]: 9

__

Why: This suggestion correctly identifies a critical configuration error where a Windows .dll file is used with a Linux-style path, which would cause the OPcache extension to fail to load.

High
Fix cross-platform OPcache loader

Replace the Windows-specific .dll path for the OPcache extension with the
platform-agnostic name opcache to ensure it loads correctly on non-Windows
systems.

bin/php8.3.26/php.ini [1761]

-zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/php_opcache.dll"
+zend_extension = "opcache"
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies a critical configuration error where a Windows-specific .dll file is used for a Linux environment, which would prevent the OPcache extension from loading and severely impact performance.

High
Fix OPcache module path for OS

Replace the Windows-specific .dll for the OPcache extension with the correct .so
for Linux/macOS to prevent fatal loading errors.

bin/php8.4.13/php.ini [1725-1727]

 ; OPCache
 
-zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/php_opcache.dll"
+; Use platform-appropriate OPcache module
+; Linux/macOS:
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/opcache.so"
+; Windows (if applicable):
+; zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/php_opcache.dll"
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies a critical configuration error where a Windows .dll extension is used in a file intended for a Linux environment, which would cause a fatal error.

High
Use absolute Xdebug module path

Use an absolute path with the correct platform-specific extension (e.g.,
xdebug.so) for the zend_extension directive to ensure the Xdebug module loads
reliably.

bin/php8.3.26/php.ini.ber [1950-1959]

 [xdebug]
-zend_extension = "xdebug"
+; Use absolute path to the Xdebug module to ensure reliable loading.
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/xdebug.so"
 xdebug.mode = debug
 xdebug.start_with_request = trigger
 xdebug.output_name = cachegrind.out.%t.%p
 xdebug.output_dir = "~BEARSAMPP_LIN_PATH~/tmp/cachegrind"
 xdebug.var_display_max_children = "1024"
 xdebug.var_display_max_depth = "8192"
 xdebug.var_display_max_data = "32768"
 xdebug.max_nesting_level = "250"
Suggestion importance[1-10]: 8

__

Why: The suggestion correctly points out that loading xdebug without a platform-specific extension (.so or .dll) is unreliable and proposes a fix that ensures the extension loads correctly on the intended platform.

Medium
Point Xdebug to absolute module

Use an absolute path for the zend_extension setting for Xdebug to ensure the
module is loaded reliably.

bin/php8.4.13/php.ini [1916-1925]

 [xdebug]
-zend_extension = "xdebug"
+; Linux/macOS:
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/xdebug.so"
+; Windows (if applicable):
+; zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/php_xdebug.dll"
 xdebug.mode = debug
 xdebug.start_with_request = trigger
 xdebug.output_name = cachegrind.out.%t.%p
 xdebug.output_dir = "~BEARSAMPP_LIN_PATH~/tmp/cachegrind"
 xdebug.var_display_max_children = "1024"
 xdebug.var_display_max_depth = "8192"
 xdebug.var_display_max_data = "32768"
 xdebug.max_nesting_level = "250"
Suggestion importance[1-10]: 8

__

Why: The suggestion correctly points out that using a relative name for zend_extension is fragile and provides a more robust absolute path, preventing likely extension loading failures.

Medium
Correct Xdebug load and options

Remove the xdebug.max_nesting_level setting, as it has been removed in Xdebug 3
and is no longer valid.

bin/php8.3.26/php.ini [1950-1959]

 [xdebug]
-zend_extension = "xdebug"
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/xdebug"
 xdebug.mode = debug
 xdebug.start_with_request = trigger
 xdebug.output_name = cachegrind.out.%t.%p
 xdebug.output_dir = "~BEARSAMPP_LIN_PATH~/tmp/cachegrind"
 xdebug.var_display_max_children = "1024"
 xdebug.var_display_max_depth = "8192"
 xdebug.var_display_max_data = "32768"
-xdebug.max_nesting_level = "250"
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly identifies that xdebug.max_nesting_level is a deprecated setting in Xdebug 3 and should be removed to avoid confusion, which is a valid and useful cleanup.

Medium
Remove unresolved extension placeholder

Verify that the @PHP_EXTENSIONS@ placeholder is correctly replaced during a
build step to prevent PHP startup errors.

bin/php8.3.26/php.ini [773-957]

 extension_dir = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext"
 ...
 extension=curl
 ...
-@PHP_EXTENSIONS@
+; @PHP_EXTENSIONS@  (removed or replaced during build)
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly identifies that the @PHP_EXTENSIONS@ placeholder will cause a startup error if not replaced by a build process, which is a valid and important point to verify.

Medium
General
Configure reliable CA bundle

Explicitly configure openssl.cafile to point to a bundled CA certificate file to
ensure reliable HTTPS functionality in a self-contained application.

bin/php8.4.13/php.ini [1888-1895]

 [openssl]
-; The location of a Certificate Authority (CA) file on the local filesystem
-; to use when verifying the identity of SSL/TLS peers. Most users should
-; not specify a value for this directive as PHP will attempt to use the
-; OS-managed cert stores in its absence. If specified, this value may still
-; be overridden on a per-stream basis via the "cafile" SSL stream context
-; option.
-;openssl.cafile=
+; Use bundled CA bundle to guarantee HTTPS verification works across environments
+openssl.cafile="~BEARSAMPP_LIN_PATH~/certs/cacert.pem"
Suggestion importance[1-10]: 7

__

Why: This is a valuable suggestion for improving the robustness of a bundled application by ensuring reliable SSL/TLS certificate verification, preventing potential runtime failures.

Medium
Security
Disable PHP version exposure

Disable expose_php by setting it to Off to avoid exposing the PHP version in
HTTP headers for security reasons.

bin/php8.3.26/php.ini.ber [397]

-expose_php = On
+expose_php = Off
Suggestion importance[1-10]: 6

__

Why: The suggestion provides a valid security hardening recommendation by disabling expose_php, which helps prevent information leakage.

Low
Suggestions up to commit b553ea6
CategorySuggestion                                                                                                                                    Impact
Possible issue
Fix platform-specific OPcache binary

Correct the OPcache extension filename from .dll to .so to ensure it loads
correctly on the target Unix-like platform.

bin/php8.3.26/php.ini [1761]

-zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/php_opcache.dll"
+; Windows:
+; zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/php_opcache.dll"
+; Unix-like:
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/opcache.so"
Suggestion importance[1-10]: 9

__

Why: The suggestion identifies a critical error where a Windows DLL (.dll) is specified for a Unix-like environment, which would prevent the OPcache extension from loading.

High
Fix OPcache module filename

Change the OPcache extension from the Windows-specific php_opcache.dll to the
correct opcache.so for Linux/macOS environments.

bin/php8.3.26/php.ini.ber [1761]

-zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/php_opcache.dll"
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/opcache.so"
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies a critical error where a Windows .dll file is specified in a configuration clearly intended for a Linux-like environment, which would cause PHP to fail on startup.

High
Fix OPcache shared object path

Change the OPcache extension from .dll to .so to match the non-Windows target
environment indicated by the path placeholder.

bin/php8.4.13/php.ini [1727]

-zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/php_opcache.dll"
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/opcache.so"
Suggestion importance[1-10]: 8

__

Why: The suggestion correctly identifies that a .dll file is for Windows, while the ~BEARSAMPP_LIN_PATH~ placeholder indicates a Linux/Unix environment, where a .so file is required. This change is necessary for the OPcache extension to load correctly.

Medium
Use absolute Xdebug path

Change the xdebug zend_extension directive to use an absolute path to the shared
object file for improved robustness and consistency.

bin/php8.3.26/php.ini.ber [1950-1951]

 [xdebug]
-zend_extension = "xdebug"
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/xdebug.so"
Suggestion importance[1-10]: 6

__

Why: The suggestion improves the configuration's robustness and consistency by using an absolute path for the xdebug extension, which is a best practice for Zend extensions.

Low
Use explicit Xdebug module path

Use an explicit path for the xdebug zend extension to ensure it loads reliably
and to maintain consistency with other extension paths in the file.

bin/php8.4.13/php.ini [1916-1918]

 [xdebug]
-zend_extension = "xdebug"
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/xdebug.so"
 xdebug.mode = debug
Suggestion importance[1-10]: 4

__

Why: The suggestion to use an explicit path for the xdebug extension improves consistency with how the opcache extension is loaded in this file. While using "xdebug" is modern and should work with extension_dir set, an explicit path can be more robust in complex environments.

Low
Security
Disable PHP version exposure

Disable the expose_php setting to avoid leaking the PHP version in HTTP headers,
which is a security best practice.

bin/php8.4.13/php.ini [392]

-expose_php = On
+expose_php = Off
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly points out a security best practice. Disabling expose_php reduces the information exposed to potential attackers, making it a valuable security hardening measure for any environment.

Medium
Disable PHP version exposure

Change expose_php from On to Off to prevent disclosing the PHP version in HTTP
headers for security reasons.

bin/php8.3.26/php.ini [397]

-expose_php = On
+expose_php = Off
Suggestion importance[1-10]: 6

__

Why: The suggestion correctly points out a security best practice to avoid leaking the PHP version, which is a valid concern even for a development environment.

Low
General
Enable OPcache for performance

Enable OPcache by setting opcache.enable to 1 to improve performance in the
development environment.

bin/php8.3.26/php.ini [1763-1768]

 [opcache]
 ; Determines if Zend OPCache is enabled
-opcache.enable=0
+opcache.enable=1
 
 ; Determines if Zend OPCache is enabled for the CLI version of PHP
 opcache.enable_cli=0
Suggestion importance[1-10]: 7

__

Why: Enabling OPcache, even in development, provides a significant performance boost and makes the development environment more consistent with production, which is a valid and impactful suggestion.

Medium
Suggestions up to commit 2de8f7f
CategorySuggestion                                                                                                                                    Impact
High-level
Consolidate duplicated PHP configuration files

The PR adds large, duplicated php.ini files for new PHP versions, including a
redundant php.ini.ber file, which is hard to maintain. It is recommended to use
a single base template and smaller, version-specific override files to generate
the final configurations.

Examples:

bin/php8.3.26/php.ini [1-1959]
[PHP]

;;;;;;;;;;;;;;;;;;;
; About php.ini   ;
;;;;;;;;;;;;;;;;;;;
; PHP's initialization file, generally called php.ini, is responsible for
; configuring many of the aspects of PHP's behavior.

; PHP attempts to find and load this configuration from a number of locations.
; The following is a summary of its search order:

 ... (clipped 1949 lines)
bin/php8.4.13/php.ini [1-1925]
[PHP]

;;;;;;;;;;;;;;;;;;;
; About php.ini   ;
;;;;;;;;;;;;;;;;;;;
; PHP's initialization file, generally called php.ini, is responsible for
; configuring many of the aspects of PHP's behavior.

; PHP attempts to find and load this configuration from a number of locations.
; The following is a summary of its search order:

 ... (clipped 1915 lines)

Solution Walkthrough:

Before:

// File: bin/php8.3.26/php.ini
...
memory_limit = 512M
extension_dir = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext"
...
// (1900+ lines)

// File: bin/php8.3.26/php.ini.ber
...
memory_limit = 512M
extension_dir = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext"
...
// (1900+ lines, identical to the file above)

// File: bin/php8.4.13/php.ini
...
memory_limit = 512M
extension_dir = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext"
...
// (1900+ lines, nearly identical to the others)

After:

// File: config/php.ini.template
[PHP]
...
memory_limit = 512M
...
// Use placeholders for version-specific paths
extension_dir = "~BEARSAMPP_LIN_PATH~/bin/php/${PHP_VERSION}/ext"
include_path=".;~BEARSAMPP_LIN_PATH~/bin/php/${PHP_VERSION}/pear/pear"
...
// (Common configuration)

// File: config/php8.3.26.inc
// Version-specific overrides
session.sid_length = 26
session.sid_bits_per_character = 5

// Build script logic:
// generate_config("8.3.26") -> combines template + overrides
// generate_config("8.4.13") -> uses template only
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies a significant architectural flaw, as the PR adds thousands of lines of duplicated configuration, making future maintenance difficult and error-prone.

High
Security
Enable strict session mode for security

Enable session.use_strict_mode to enhance security by protecting against session
fixation vulnerabilities.

bin/php8.3.26/php.ini.ber [1352-1359]

 ; Whether to use strict session mode.
 ; Strict session mode does not accept an uninitialized session ID, and
 ; regenerates the session ID if the browser sends an uninitialized session ID.
 ; Strict mode protects applications from session fixation via a session adoption
 ; vulnerability. It is disabled by default for maximum compatibility, but
 ; enabling it is encouraged.
 ; https://wiki.php.net/rfc/strict_sessions
-session.use_strict_mode = 0
+session.use_strict_mode = 1
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies a security weakness and recommends enabling session.use_strict_mode to mitigate session fixation attacks, which is a critical security best practice.

High
Enable strict session mode for security

Enable session.use_strict_mode by setting it to 1 to protect against session
fixation attacks where an attacker could impersonate a user.

bin/php8.3.26/php.ini [1359]

-session.use_strict_mode = 0
+session.use_strict_mode = 1
Suggestion importance[1-10]: 8

__

Why: This is a strong security recommendation that correctly identifies a session fixation vulnerability and provides a valid fix, significantly improving the application's security posture.

Medium
Set session cookie to HttpOnly

Set session.cookie_httponly to On to prevent client-side scripts from accessing
the session cookie, thereby mitigating the risk of session hijacking via XSS
attacks.

bin/php8.3.26/php.ini [1398]

-session.cookie_httponly =
+session.cookie_httponly = On
Suggestion importance[1-10]: 8

__

Why: This is a valid and important security hardening suggestion that helps mitigate the impact of XSS attacks by protecting session cookies, which is a standard best practice.

Medium
Enable strict session mode for security

Enable session.use_strict_mode by setting it to 1 to enhance security against
session fixation attacks.

bin/php8.4.13/php.ini [1343-1346]

 ; vulnerability. It is disabled by default for maximum compatibility, but
 ; enabling it is encouraged.
 ; https://wiki.php.net/rfc/strict_sessions
-session.use_strict_mode = 0
+session.use_strict_mode = 1
Suggestion importance[1-10]: 7

__

Why: The suggestion recommends enabling a security best practice (session.use_strict_mode) to prevent session fixation attacks, which is a valuable improvement even for a development configuration.

Medium
Disable remote file opening for security

Disable allow_url_fopen by setting it to Off to reduce the risk of Server-Side
Request Forgery (SSRF) vulnerabilities, unless remote URL access is explicitly
required.

bin/php8.3.26/php.ini [869]

-allow_url_fopen = On
+allow_url_fopen = Off
Suggestion importance[1-10]: 6

__

Why: This is a valid security hardening suggestion to reduce the attack surface for vulnerabilities like SSRF, but disabling it may break legitimate application functionality that requires fetching remote content.

Low
Possible issue
Fix incorrect Xdebug extension path

Update the zend_extension directive for Xdebug to include the full path to the
extension file, ensuring it loads correctly.

bin/php8.4.13/php.ini [1916-1918]

 [xdebug]
-zend_extension = "xdebug"
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.4.13/ext/php_xdebug.dll"
 xdebug.mode = debug
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies that the zend_extension directive for Xdebug is misconfigured, which would prevent the extension from loading and make the debugger non-functional.

High
Use an absolute path for Xdebug

Use an absolute path for the xdebug zend_extension to ensure it is loaded
reliably.

bin/php8.3.26/php.ini.ber [1950-1953]

 [xdebug]
-zend_extension = "xdebug"
+zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/php_xdebug.dll"
 xdebug.mode = debug
 xdebug.start_with_request = trigger
Suggestion importance[1-10]: 7

__

Why: The suggestion improves the configuration's robustness by recommending an absolute path for the xdebug extension, preventing potential loading issues and aligning it with the explicit path used for opcache.

Medium
General
Enable OPCache for better performance

Enable OPCache by setting opcache.enable to 1 to improve performance in the
development environment.

bin/php8.4.13/php.ini [1729-1731]

 [opcache]
 ; Determines if Zend OPCache is enabled
-opcache.enable=0
+opcache.enable=1
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly points out that enabling opcache would improve performance, and the recommended configuration is suitable for a development environment, providing a good balance of speed and convenience.

Medium
Enable OPCache for better performance

Enable OPCache by setting opcache.enable and opcache.enable_cli to 1 for a
significant performance boost.

bin/php8.3.26/php.ini.ber [1759-1768]

 ; OPCache
 
 zend_extension = "~BEARSAMPP_LIN_PATH~/bin/php/php8.3.26/ext/php_opcache.dll"
 
 [opcache]
 ; Determines if Zend OPCache is enabled
-opcache.enable=0
+opcache.enable=1
 
 ; Determines if Zend OPCache is enabled for the CLI version of PHP
-opcache.enable_cli=0
+opcache.enable_cli=1
Suggestion importance[1-10]: 6

__

Why: The suggestion correctly points out that enabling OPCache can significantly improve performance, which is beneficial even in a development environment, without negatively impacting the development workflow.

Low

@github-actions
Copy link

✅ All PHP extension tests passed

  • win10-amd:
  • win10-intel:
  • win11-amd:
  • win11-intel:

@N6REJ N6REJ merged commit 8c729e6 into main Sep 27, 2025
5 checks passed
@N6REJ N6REJ deleted the september branch September 27, 2025 06:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants