crypt() will now raise an E_NOTICE error if the salt parameter is omitted.

substr_compare() will now accept 0 for its length parameter.

unserialize() will now fail if passed serialised data that has been manipulated to attempt to instantiate an object without calling its constructor.

Uploads using the @file syntax are now only supported if the CURLOPT_SAFE_UPLOAD option is set to false. CURLFile should be used instead.

The source parameter of mcrypt_create_iv() now defaults to MCRYPT_DEV_URANDOM instead of MCRYPT_DEV_RANDOM.

stream_socket_enable_crypto() now allows the crypto_type parameter to be optional if the stream's SSL context includes the new crypto_type option.

pg_insert(), pg_select(), pg_update() and pg_delete() are no longer experimental.

pg_send_execute(), pg_send_prepare(), pg_send_query() and pg_send_query_params() will no longer block until query write completion if the underlying socket stream for the database connection is set to non-blocking mode.

ReflectionClass::newInstanceWithoutConstructor() now allows non-final internal classes to be instantiated.

XMLReader::getAttributeNs() and XMLReader::getAttributeNo() now return null if the attribute could not be found, like XMLReader::getAttribute().