Date
- Fixed leak on double DatePeriod::__construct() call.
GD
- Upgrade libgd. (CVE-2026-9672)
PGSQL
- Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543)
Phar
- Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)