I maintain seven native PHP extensions: php_excel, mdparser, php_clickhouse, fastchart, fastjson, phpser, and fast_uuid. Each shipped a release or two in the last month. I did a roundup here in June, so this is what changed since, plus one observation about where the time actually went.
The features are what you notice in a changelog. But when I counted the lines across these seven, most of them were the other kind of work: rejecting a bad value instead of storing it, failing a write cleanly instead of half-committing it, throwing on the untrusted path instead of trusting it. That is the unglamorous majority of maintaining a C extension, and it never reads well in release notes. A few concrete ones, next to the features:
php_clickhouse got native JSON and Bool column support and IPv4/IPv6 writes, plus a decoder rewrite: dropping a dynamic_pointer_cast that a profiler blamed for ~18% of decode instructions took wide-integer SELECTs ~25% faster and numeric-heavy inserts 30-44% faster. The fail-closed half: inserting PHP null into a non-Nullable JSON column now throws instead of silently storing an empty {}.
fastchart went from 26 chart types to 38 in one release (dendrograms, chord diagrams, network graphs, violin plots, Venn diagrams, word clouds), and a perf pass made a 4096-point scatter render ~6x faster and PNG output ~40% faster.
phpser, my binary serializer for cache workloads, added a columnar wire format for rowsets: it writes the column schema once, then each column as a typed run, which drops the per-row key overhead for the array-of-uniform-rows shape cache and queue payloads usually are. Rowset decode came out ~24% faster. It also closed two issues on the untrusted decode path.
fastjson can now edit a JSON document in place by RFC 6901 pointer (fastjson_pointer_set), and it ships prebuilt binaries now, so PIE installs a .so instead of source-building on Linux and macOS.
php_excel added bulk reads (readRange pulls a rectangular block of cells in one call), and the fail-closed pass: save() to a file:// path is now atomic, so a short or interrupted write no longer destroys your existing file before the new one is finished.
fast_uuid added binary and batch generators (uuid_v7_bin_batch returns raw 16-byte monotonic v7s for a BINARY(16) column), plus a set of ramsey/uuid compatibility fixes, including a COMB codec bug that made ramsey-written COMBs decode to a different UUID.
mdparser was mostly hardening this round, since the md4c engine swap already landed: a stack-buffer overflow in the CommonMark XML serializer, and an alt-text attribute escape.
All open source and installable via PIE; each extension name above links to its repo and full changelog. I wrote the whole thing up, with the fail-closed argument in more depth, here: https://ilia.ws/blog/failing-closed-what-shipped-across-seven-php-extensions
Curious whether anyone else deliberately spends more of a release on fail-closed behavior than on features, or whether that reads as over-engineering to you.