# Known limitations of the inherited EL7 profile

**PHP 7.4.33, RPM release `20261021.1.el7.rocketsky`.**

## Behaviour of the security mitigations

The adopted Remi security patch series immediately terminates a PHP worker when
the PHP memory limit is exhausted. Registered shutdown functions do not run in
this failure case. PHP-FPM starts replacement workers. Session upload progress
is disabled in the PHP code; ordinary file uploads remain available. Applications
must account for these changes in progress displays and cleanup after memory
errors. Check the complete RPM release: the PHP micro version remains 7.4.33.

## Existing GD failures

The normal packages retain external GD 2.3.3, as used by Remi's EL7 profile.
Seventeen GD regression cases produced identical output with the original
vendor-signed Remi `7.4.33-15.el7.remi` packages and the candidate in both NTS and
ZTS. The completed final package check reproduced those exact documented outcomes.

This set includes `ext/gd/tests/bug65148.phpt`, which triggers an **existing
segmentation fault** during a particular image rotation. This is a real
functional defect. The PHP update does not repair the inherited GD library
profile. These cases are recorded as existing failures, not passing tests.
New deviations block release; the memory-exhaustion and upload regression
checks have no such baseline exception.

Test image-processing features used by your application before returning the
server to public traffic. The exact cases and output hashes are recorded in the
[GD baseline evidence](../provenance/php74-gd-baseline.json).

## ICU and provider-dependent behaviour

The inherited ICU 73 library has a known calendar-field issue documented in
[upstream issue #11128](https://github.com/php/php-src/issues/11128). The relevant
test skips the affected ICU versions and is not counted as a passing assertion.
Date-format expectations also reflect ICU/CLDR narrow non-breaking spaces;
those test-data adjustments do not change PHP's implementation.

This profile retains Remi's Sodium-backed Argon2 provider. Its handling of the
`threads` option differs from the standalone Argon2 provider. Provider-specific
tests check successful password verification and reject incorrect passwords;
they do not claim identical option validation across providers.

## Interactive CLI limitation

The upstream `sapi/cli/tests/017.phpt` test exercises piped input to the
interactive `php -a` shell using libedit. An unchanged original, vendor-signed
Remi `7.4.33-15.el7.remi` executable also reached the test harness's normal
60-second inactivity timeout in the isolated native environment. The candidate
had an intermittent timeout too, while subsequent unchanged checks passed.

The original and candidate stopped at different snippets, and their parent
module profiles differed. This is evidence of an existing interactive CLI
limitation; it is not an identical-output baseline or proof that its precise
cause has been fixed. This test does not exercise PHP-FPM request handling.
Applications or automation that use `php -a` with piped input should account for
the observed behaviour. The separate PHP-FPM, memory-exhaustion, upload and
upgrade checks remain mandatory release gates. The original test and process
observations are recorded in the [CLI comparison evidence](../provenance/php74-cli017-original-comparison.json).

The shipped CentOS libedit source (`3.0-12.20121213cvs.el7`) contains the
wide-character EOF loop described in the [upstream libedit report](https://mail-index.netbsd.org/netbsd-bugs/2013/05/26/msg033127.html),
and its source package does not apply the later EOF check. This is a plausible
explanation for the interactive hangs; no stack trace established causation in
these runs. The shared libedit package is unchanged by this PHP release.

## Package layout and validation scope

JSON and XMLRPC are PHP 7.4 core packages (`php-json` and `php-xmlrpc`). The five
separately built PECL extensions are APCu, igbinary, Imagick, mcrypt and ZIP.
The PHP 8 XMLRPC prerelease package is not used for this branch.

Fresh core tests cover the recompiled SAPIs after the upstream Zend preload
cleanup backport: 16,336 recorded NTS cases and 4,331 recorded cases in the
selected ZTS suite. Both retain the 17 documented GD failures; the earlier
interactive CLI timeout remains separately documented above. The unchanged
CLI test passed in the completed final check. The actual exported RPM payload
was checked against the tested binaries and modules.

The five PECL extensions completed ten NTS/ZTS suites against the final core:
**1,452 cases, 1,248 passed, 194 skipped, 10 warnings and zero failed tests**.
The warnings are five Imagick tests that pass despite their upstream
expected-failure markers, reported once for each variant. The complete harness
summaries and JUnit reports are bound in the
[PECL build evidence](../provenance/php74-pecl-build.json).

The native 20-package update preserved all six representative operator
configuration files. Final CLI/CGI/FPM checks passed, including ordinary uploads,
disabled upload progress despite an enabled INI setting, immediate worker
termination without shutdown callbacks on memory exhaustion, replacement of
that worker, and a successful subsequent request. GD/Imagick WebP round trips
passed with both library loading orders; final APCu/igbinary serialization
passed in NTS and ZTS. The [native release gate](../provenance/php74-native-release-gate.json)
records the exact package and executable hashes.

The signed YUM upgrade of all 20 representative packages and a clean installation
of the complete 49-package PHP family passed, including dependency resolution,
signatures and installed payload verification. The same 20-package upgrade
also passed against the public HTTPS repository. The [publication record](../provenance/php74-publication.json)
binds those results and the public download checksums. These tests do not
represent exhaustive application compatibility or exploit testing.