fix(php85): eliminate every deprecation, and fail the build on a new one

bin/mcp-bridge.php

@@ -102,7 +102,6 @@ function mcp_bridge_post($url, array $headers, $payload)
         $body   = curl_exec($ch);
         $status = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
         $err    = (string) curl_error($ch);
-        curl_close($ch);
         return $body === false ? [false, 0, '', ($err ?: 'curl failed')] : [true, $status, (string) $body, ''];
     }
 

composer.json

@@ -14,7 +14,7 @@
     "require": {
         "php": ">=8.1",
         "paragonie/sodium_compat": "^1.21 || ^2.0",
-        "webtigers/tigerzf": "^1.30"
+        "webtigers/tigerzf": "^1.32.2"
     },
     "suggest": {
         "aws/aws-sdk-php": "S3 media storage (Tiger_Media_Storage_S3) + Rekognition moderation + CloudWatch logging",

library/Tiger/Agent/Provider/Anthropic.php

@@ -101,7 +101,6 @@ public function models($apiKey = '')
                 ]);
                 $raw  = curl_exec($ch);
                 $code = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
-                curl_close($ch);
                 $body = json_decode((string) $raw, true);
                 if ($code === 200 && !empty($body['data'])) {
                     $out = [];
@@ -192,7 +191,6 @@ protected function _post(array $payload, $apiKey)
         $raw  = curl_exec($ch);
         $err  = curl_error($ch);
         $code = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
-        curl_close($ch);
 
         if ($raw === false) {
             throw new RuntimeException('Could not reach the AI provider: ' . $err);

library/Tiger/Agent/Provider/Gemini.php

@@ -72,7 +72,6 @@ public function models($apiKey = '')
                 ]);
                 $raw  = curl_exec($ch);
                 $code = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
-                curl_close($ch);
                 $body = json_decode((string) $raw, true);
                 if ($code === 200 && !empty($body['models'])) {
                     $out = [];
@@ -144,7 +143,6 @@ protected function _post($url, array $payload, $apiKey)
         $raw  = curl_exec($ch);
         $err  = curl_error($ch);
         $code = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
-        curl_close($ch);
 
         if ($raw === false) {
             throw new RuntimeException('Could not reach the AI provider: ' . $err);

library/Tiger/Agent/Provider/OpenAiCompatible.php

@@ -108,7 +108,6 @@ public function models($apiKey = '')
                 ]);
                 $raw  = curl_exec($ch);
                 $code = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
-                curl_close($ch);
                 $body = json_decode((string) $raw, true);
                 if ($code === 200 && !empty($body['data'])) {
                     $out = [];
@@ -151,7 +150,6 @@ protected function _post($url, array $payload, array $headers)
         $raw  = curl_exec($ch);
         $err  = curl_error($ch);
         $code = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
-        curl_close($ch);
 
         if ($raw === false) {
             throw new RuntimeException('Could not reach the AI provider: ' . $err);

library/Tiger/Application/Bootstrap.php

@@ -371,8 +371,9 @@ protected function _registerCustomLocales(array $locales)
             return;
         }
         try {
-            $ref = new ReflectionProperty('Zend_Locale', '_localeData');
-            $ref->setAccessible(true);
+            // No setAccessible(): PHP 8.1+ reflection reaches a private static directly, and the call
+            // is deprecated in 8.5.
+            $ref   = new ReflectionProperty('Zend_Locale', '_localeData');
             $data  = $ref->getValue();
             $added = false;
             foreach ($unknown as $l) {

library/Tiger/Cms/vendor/Parsedown.php

@@ -11,6 +11,20 @@
 # For the full license information, view the LICENSE file that was distributed
 # with this source code.
 #
+# ---------------------------------------------------------------------------
+# LOCAL MODIFICATIONS (WebTigers) — keep these when re-vendoring.
+#
+# Upstream 1.7.4 is from 2019 and predates PHP 8.4's deprecation of implicitly
+# nullable parameters. Two signatures declared `array $Block = null`, which PHP
+# 8.4+ reports as deprecated on every markdown render:
+#
+#   blockSetextHeader()  ~line 715   array $Block = null  ->  ?array $Block = null
+#   blockTable()         ~line 853   array $Block = null  ->  ?array $Block = null
+#
+# The types are otherwise unchanged and the behaviour is identical — `?array` is
+# what the implicit form already meant. If you pull a newer Parsedown, re-apply
+# these (or drop them if upstream has fixed it).
+# ---------------------------------------------------------------------------
 #
 
 class Parsedown
@@ -712,7 +726,7 @@ protected function blockRule($Line)
     #
     # Setext
 
-    protected function blockSetextHeader($Line, array $Block = null)
+    protected function blockSetextHeader($Line, ?array $Block = null)
     {
         if ( ! isset($Block) or isset($Block['type']) or isset($Block['interrupted']))
         {
@@ -850,7 +864,7 @@ protected function blockReference($Line)
     #
     # Table
 
-    protected function blockTable($Line, array $Block = null)
+    protected function blockTable($Line, ?array $Block = null)
     {
         if ( ! isset($Block) or isset($Block['type']) or isset($Block['interrupted']))
         {

library/Tiger/Google/Analytics.php

@@ -493,7 +493,8 @@ private static function _http($url, array $opts)
         ]);
         $body = curl_exec($ch);
         $code = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
-        curl_close($ch);
+        // No curl_close(): since PHP 8.0 the handle is an object freed by refcount, so the call has
+        // been a no-op, and 8.5 deprecates it. Letting $ch fall out of scope is the close.
         return ($body !== false && $code >= 200 && $code < 300) ? $body : null;
     }
 
@@ -511,7 +512,6 @@ private static function _probeReport($token)
         ]);
         $body = curl_exec($ch);
         $code = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
-        curl_close($ch);
         return [$code, $body === false ? '' : (string) $body];
     }
 

library/Tiger/Location/Adapter/Aws.php

@@ -210,7 +210,6 @@ protected function _signedPost(
         ]);
         $respBody = curl_exec($ch);
         $code     = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
-        curl_close($ch);
 
         if ($code < 200 || $code >= 300 || $respBody === false) {
             return null;

library/Tiger/Media/Image.php

@@ -89,9 +89,10 @@ public static function variants($sourcePath, $mime, array $presets, $quality = 9
             if ($tmp !== false && self::_save($dst, $mime, $tmp, $quality)) {
                 $out[$name] = ['path' => $tmp, 'width' => $nw, 'height' => $nh, 'mime' => (string) $mime];
             }
-            imagedestroy($dst);
+            // No imagedestroy(): since PHP 8.0 a GD handle is a GdImage OBJECT freed by refcount, so
+            // the call has been a no-op (8.5 deprecates it). The memory is released at the same points
+            // it always was — $dst when the next iteration reassigns it, $src when this scope ends.
         }
-        imagedestroy($src);
         return $out;
     }
 

library/Tiger/Recaptcha.php

@@ -141,7 +141,6 @@ protected static function _post($url, array $params)
             ]);
             $body = curl_exec($ch);
             $ok   = ($body !== false && curl_getinfo($ch, CURLINFO_HTTP_CODE) >= 200 && curl_getinfo($ch, CURLINFO_HTTP_CODE) < 300);
-            curl_close($ch);
             return $ok ? $body : null;
         }
 

modules/register/services/Registration.php

@@ -169,7 +169,6 @@ private function _registry(string $service, string $method, array $params): ?arr
         ]);
         $body = curl_exec($ch);
         $code = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
-        curl_close($ch);
         if ($body === false || $code !== 200) { return null; }
         $j = json_decode((string) $body, true);
         if (!is_array($j) || (int) ($j['result'] ?? 0) !== 1) { return null; }

phpunit.xml

@@ -13,9 +13,11 @@
          colors="true"
          failOnRisky="true"
          failOnWarning="true"
+         failOnDeprecation="true"
          beStrictAboutOutputDuringTests="true"
          beStrictAboutTestsThatDoNotTestAnything="true"
          displayDetailsOnTestsThatTriggerWarnings="true"
+         displayDetailsOnTestsThatTriggerDeprecations="true"
          displayDetailsOnTestsThatTriggerErrors="true">
 
     <testsuites>

tests/Integration/Ally/BootstrapTest.php

@@ -39,7 +39,6 @@ protected function tearDown(): void
     private function registered(): array
     {
         $p = new ReflectionProperty(Tiger_Admin_Nav::class, '_items');
-        $p->setAccessible(true);
         $items = [];
         foreach ((array) $p->getValue() as $item) {
             $items[$item['key'] ?? ''] = $item;
@@ -54,7 +53,6 @@ public function it_registers_the_accessibility_sidebar_item(): void
 
         $bootstrap = (new \ReflectionClass(Ally_Bootstrap::class))->newInstanceWithoutConstructor();
         $m = new ReflectionMethod(Ally_Bootstrap::class, '_initAdminNav');
-        $m->setAccessible(true);
         $m->invoke($bootstrap);
 
         $items = $this->registered();

tests/Integration/Ally/ScanServiceTest.php

@@ -209,7 +209,6 @@ public function scan_reports_a_render_failure_for_a_broken_page(): void
         // buffering) — swap Tiger_Log's logger for a null writer so the diagnostic line doesn't count as
         // unexpected test output under strict mode. Restored after.
         $logProp = new \ReflectionProperty(\Tiger_Log::class, '_log');
-        $logProp->setAccessible(true);
         $prior = $logProp->getValue();
         $logProp->setValue(null, (new \Zend_Log())->addWriter(new \Zend_Log_Writer_Null()));
         try {

tests/Integration/Seo/BootstrapTest.php

@@ -44,14 +44,12 @@ private function bootstrap(): Seo_Bootstrap
     private function invoke(string $method): void
     {
         $m = new ReflectionMethod(Seo_Bootstrap::class, $method);
-        $m->setAccessible(true);
         $m->invoke($this->bootstrap());
     }
 
     private function resetProviders(): void
     {
         $p = new ReflectionProperty(Tiger_Sitemap::class, '_providers');
-        $p->setAccessible(true);
         $p->setValue(null, []);
     }
 

tests/Integration/Seo/ControllersTest.php

@@ -77,14 +77,12 @@ protected function tearDown(): void
     private function resetProviders(): void
     {
         $p = new ReflectionProperty(Tiger_Sitemap::class, '_providers');
-        $p->setAccessible(true);
         $p->setValue(null, []);
     }
 
     private function resetSiteOrg(): void
     {
         $p = new ReflectionProperty(\Tiger_Model_Org::class, '_siteOrgId');
-        $p->setAccessible(true);
         $p->setValue(null, null);
     }
 

tests/Integration/Seo/SchemaServiceExtraTest.php

@@ -64,7 +64,6 @@ protected function tearDown(): void
     private function resetLatch(): void
     {
         $p = new ReflectionProperty(Seo_Service_Schema::class, '_emitted');
-        $p->setAccessible(true);
         $p->setValue(null, false);
     }
 

tests/Integration/Seo/SchemaServiceTest.php

@@ -65,7 +65,6 @@ protected function tearDown(): void
     private function resetLatch(): void
     {
         $p = new ReflectionProperty(Seo_Service_Schema::class, '_emitted');
-        $p->setAccessible(true);
         $p->setValue(null, false);
     }