[dependabot]

Bumps maxmind-db/reader from 1.13.1 to 1.14.0.

Release notes

Sourced from maxmind-db/reader's releases.

1.14.0

• Bounded the resources that the pure PHP decoder spends on a single lookup. A crafted database could nest data-section pointers to shared targets so that decoding one record cost exponential time and memory, or point many times at one large value so that the decoder copied far more data than the file holds. The decoder now follows the Reader Resource Limits section of the MaxMind DB specification. Each lookup is limited to 65,536 values, 512 levels of nesting, and 2 MiB of string and bytes payload.
  • Exceeding a limit throws an InvalidDatabaseException.
  • Opening a database whose metadata exceeds a limit throws the same exception.
  • A scalar that declares more than 16 bytes, the width of the widest fixed-width type, is rejected as invalid data.
• The bundled libmaxminddb used by --with-maxminddb-bundled builds of the extension now applies the same decoder limits. The extension throws an InvalidDatabaseException when a lookup exceeds them.
• The pure PHP reader is about 40% faster on City lookups. It no longer seeks before a read that continues where the last one ended, and it checks read lengths with strlen() instead of ftell().
• The Windows build configuration now accepts either libmaxminddb.lib or maxminddb.lib when building the extension. The lib prefix was removed in libmaxminddb 1.6.0, but the libmaxminddb that PHP publishes for Windows builds is still 1.5.0, which uses the prefixed name. Pull request by Jean-Baptiste Nahan. GitHub #231.
• Replaced XtOffsetOf() with offsetof(). The XtOffsetOf() alias has been removed in PHP 8.6. Pull request by Remi Collet. GitHub #252.
• The extension can now be built from a bundled copy of libmaxminddb, on both Unix-like systems and Windows, by passing --with-maxminddb-bundled to configure (or to configure.bat on Windows). This produces an extension that does not depend on a system libmaxminddb, which is a prerequisite for distributing precompiled builds; on Windows it also replaces the 1.5.0 import library that PHP publishes for Windows builds. The default is unchanged: without the flag, the extension links against a system libmaxminddb as before. GitHub #265.
• The conflict constraint on ext-maxminddb in composer.json is again updated when a release is cut. The substitution that maintains it stopped matching in April 2024, when the constraint's separator changed from a comma to ||, so the constraint has read <1.11.1 through four releases. Users of the C extension should note the effect of reviving it: ext-maxminddb is a Composer platform package, so this release conflicts with an older compiled extension and composer update will require upgrading the two together. GitHub #266.

Changelog

Sourced from maxmind-db/reader's changelog.

1.14.0 (2026-09-10)

• Bounded the resources that the pure PHP decoder spends on a single lookup. A crafted database could nest data-section pointers to shared targets so that decoding one record cost exponential time and memory, or point many times at one large value so that the decoder copied far more data than the file holds. The decoder now follows the Reader Resource Limits section of the MaxMind DB specification. Each lookup is limited to 65,536 values, 512 levels of nesting, and 2 MiB of string and bytes payload.
  • Exceeding a limit throws an InvalidDatabaseException.
  • Opening a database whose metadata exceeds a limit throws the same exception.
  • A scalar that declares more than 16 bytes, the width of the widest fixed-width type, is rejected as invalid data.
• The bundled libmaxminddb used by --with-maxminddb-bundled builds of the extension now applies the same decoder limits. The extension throws an InvalidDatabaseException when a lookup exceeds them.
• The pure PHP reader is about 40% faster on City lookups. It no longer seeks before a read that continues where the last one ended, and it checks read lengths with strlen() instead of ftell().
• The Windows build configuration now accepts either libmaxminddb.lib or maxminddb.lib when building the extension. The lib prefix was removed in libmaxminddb 1.6.0, but the libmaxminddb that PHP publishes for Windows builds is still 1.5.0, which uses the prefixed name. Pull request by Jean-Baptiste Nahan. GitHub #231.
• Replaced XtOffsetOf() with offsetof(). The XtOffsetOf() alias has been removed in PHP 8.6. Pull request by Remi Collet. GitHub #252.
• The extension can now be built from a bundled copy of libmaxminddb, on both Unix-like systems and Windows, by passing --with-maxminddb-bundled to configure (or to configure.bat on Windows). This produces an extension that does not depend on a system libmaxminddb, which is a prerequisite for distributing precompiled builds; on Windows it also replaces the 1.5.0 import library that PHP publishes for Windows builds. The default is unchanged: without the flag, the extension links against a system libmaxminddb as before. GitHub #265.
• The conflict constraint on ext-maxminddb in composer.json is again updated when a release is cut. The substitution that maintains it stopped matching in April 2024, when the constraint's separator changed from a comma to ||, so the constraint has read <1.11.1 through four releases. Users of the C extension should note the effect of reviving it: ext-maxminddb is a Composer platform package, so this release conflicts with an older compiled extension and composer update will require upgrading the two together. GitHub #266.

Commits

• f3c92f6 Bumped version to 1.14.0
• 4b9cc91 Escape release notes as XML before packaging
• f4c7ccb Set release date and copyright year
• 7960f26 Merge pull request #281 from maxmind/greg/stf-1488
• 87b1147 Clarify decoder limit and stream comments
• 8e829f5 Declare the PHP 8 test polyfill directly
• 109614d Use section-neutral decoder limit errors
• 8451e5b Test decoder state reset between calls
• b5759a9 Test a string exactly one byte over the payload limit
• bca4e14 Reject nested lookups on the same reader
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Assignees

The following users could not be added as assignees: Hackmastr. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.