1.14.0

• Bounded the resources that the pure PHP decoder spends on a single lookup. A
  crafted database could nest data-section pointers to shared targets so that
  decoding one record cost exponential time and memory, or point many times at
  one large value so that the decoder copied far more data than the file holds.
  The decoder now follows the Reader Resource Limits section of the MaxMind DB
  specification. Each lookup is limited to 65,536 values, 512 levels of
  nesting, and 2 MiB of string and bytes payload.
  • Exceeding a limit throws an InvalidDatabaseException.
  • Opening a database whose metadata exceeds a limit throws the same
    exception.
  • A scalar that declares more than 16 bytes, the width of the widest
    fixed-width type, is rejected as invalid data.
• The bundled libmaxminddb used by --with-maxminddb-bundled builds of the
  extension now applies the same decoder limits. The extension throws an
  InvalidDatabaseException when a lookup exceeds them.
• The pure PHP reader is about 40% faster on City lookups. It no longer seeks
  before a read that continues where the last one ended, and it checks read
  lengths with strlen() instead of ftell().
• The Windows build configuration now accepts either libmaxminddb.lib or
  maxminddb.lib when building the extension. The lib prefix was removed
  in libmaxminddb 1.6.0, but the libmaxminddb that PHP publishes for Windows
  builds is still 1.5.0, which uses the prefixed name. Pull request by
  Jean-Baptiste Nahan. GitHub #231.
• Replaced XtOffsetOf() with offsetof(). The XtOffsetOf() alias has
  been removed in PHP 8.6. Pull request by Remi Collet. GitHub #252.
• The extension can now be built from a bundled copy of libmaxminddb, on
  both Unix-like systems and Windows, by passing --with-maxminddb-bundled
  to configure (or to configure.bat on Windows). This produces an
  extension that does not depend on a system libmaxminddb, which is a
  prerequisite for distributing precompiled builds; on Windows it also
  replaces the 1.5.0 import library that PHP publishes for Windows builds.
  The default is unchanged: without the flag, the extension links against a
  system libmaxminddb as before. GitHub #265.
• The conflict constraint on ext-maxminddb in composer.json is again
  updated when a release is cut. The substitution that maintains it stopped
  matching in April 2024, when the constraint's separator changed from a comma
  to ||, so the constraint has read <1.11.1 through four releases. Users of
  the C extension should note the effect of reviving it: ext-maxminddb is a
  Composer platform package, so this release conflicts with an older compiled
  extension and composer update will require upgrading the two together.
  GitHub #266.