Yes, strange for a bug fix to be top of a list of features, however...

I don't agree that it's "not the most eventful" release:- libsodium being included into the core is a big tick in the box in terms of maturing as a language; modern - secure - cryptography out of the box.

I'm surprised PHP hasn't had this for a while. Isn't PHP nearly 20 years old? Is it common for web languages to grow so old before they get crypto in the standard library?

You are right, of course, but nonetheless this is a significant step forward for the language (and the ecosystem as a whole).

I do hope that - just like yourself, I am sure - the next significant step is more organically and proactively developed, and not treated (at least in the wider communtity's eyes) as a belated addition to a bewildered leviathan.

> PHP 7.2: The First Programming Language to Add Modern Cryptography to its Standard Library

https://dev.to/paragonie/php-72-the-first-programming-langua...

Ok, but that's different from including crypto at all. I'm surprised Go uses those algorithms in its standard library TLS stack, but they're not made available as part of the standard crypto packages...

OpenSSL and Mcrypt have been available for the longest time, I don't know if that counts if we word-lawyer "Standard Library" but it definitely felt like that way.

How comes a bug fix has an RFC?

It's a long-standing and documented issue; there wasn't the will to fix it. In that sense it's “not” a bug.

It's also, well, just complicated and potentially controversial enough (significant performance decrease!) to warrant one.