Fix _encodeData regexp

[akurth]

\x was used shorthand for \x00. php v8.3.16 and v8.4.3 seem to not accept that any more. This failing example code demonstrates that:

echo preg_match('/[\x-\x20]+/', "\x00");

[ktomk]

Yes, \x was in use since 2013 and it was \x0 beforehand.. Ref: fca283a#diff-b75de153cd3132d5c0db68f7f65ab7ca328ac5c6cd626e9d3ff698cf0ddd5a6aL1030

How did you test / against which kind of system are you reporting?

IMHO it's OK to restore \x0 (or use \x00 for readability),
but I'm asking because I could not reproduce the issue on my box (8.2.27, 8.3.16, 8.4.3) and also 3v4l.org shows stable behaviour for the pattern: https://3v4l.org/FT4na

[akurth]

Debian unstable
libpcre2 10.45
php 8.3.16 from https://packages.sury.org/php/

I noticed the problem because the Nextcloud News app wasn’t able to pull RSS feeds any more. Error was:

preg_replace_callback(): Compilation failed: digits missing after \\x or in \\x{} or \\o{} or \\N{U+} at offset 3 at /var/www/html/nc/apps/news/vendor/pear/net_url2/Net/URL2.php#1200

[xandris]

caused by a change in libpcre2 10.45:

25. (#478, #504) Disallow \x if not followed by { or a hex digit.

PCRE2Project/pcre2#478
PCRE2Project/pcre2#504

so this depends on if your php links against 10.45

[akurth]

so this depends on if your php links against 10.45

... which is going to happen for many users sooner or later. So this change

1. is future proof
2. doesn’t hurt anyway

Or do I miss something?

[xandris]

so this depends on if your php links against 10.45

... which is going to happen for many users sooner or later. So this change

1. is future proof
2. doesn’t hurt anyway

Or do I miss something?

no i agree with you. i was just explaining why it works on their php 8.3.16 but not ours sorry

[reedy]

so this depends on if your php links against 10.45

... which is going to happen for many users sooner or later. So this change

Debian unstable is currently using 10.45 (testing is on 10.44), so will indeed start causing wider pain down the line

https://tracker.debian.org/pkg/pcre2

Would definitely be useful for this to be merged, and a release tagged for other reasons (#14 which is https://pear.php.net/bugs/bug.php?id=28649)

I have already created https://pear.php.net/bugs/bug.php?id=29032 specifically requesting a new release too...

[gessel]

This seems to impact MediaWiki as well. FreeBSD ports updated devel/pcre2 to 10.45 on
06 Feb 2025 09:40:08. The manifestation of the error in MediaWiki may appear as in this bug: https://phabricator.wikimedia.org/T388285#10616477

[reedy]

It'll impact many things - https://packagist.org/packages/pear/net_url2/dependents?order_by=downloads (never mind direct pear installs etc)

[MatthewVernon]

Debian "trixie" will ship with 10.45 (as that's what's in testing since 2025-02-24).

[ktomk]

Version 2.2.3 of Net_URL2 has been successfully released, and its promotion cycle has started. https://pear.php.net/package/Net_URL2/

Version 2.2.3 of Net_URL2 has been tagged in the upstream repository. https://github.com/ktomk/Net_URL2/releases/tag/v2.2.3

PACKAGIST ORG now has the Version 2.2.3 tag.
https://packagist.org/packages/pear/net_url2

[reedy]

Do we have a rough timeline as to when the official release will be/how long that promotion cycle is?

[ktomk]

@reedy I guess you ask because of the Packagist downstream (Composer)? Because that was just the standard message and related to uploading the package on the Pear website and as written it's unrelated.

Unfortunately right now I can't merge here so I mailed the list, but I can't predict when someone joins in with a helping hand. Maybe @cweiske can help and can reinstate my Github account for the Net_URL2 repo?

@reedy Merged and Packagist has the new tag.

[reedy]

Thanks!