* SECURITY UPDATE: out-of-bounds reads in the mysqlnd wire-protocol parser - debian/patches/php-8.1-CVE-2025-1218.patch: check that a packet still holds the bytes a field needs before decoding it, in ext/mysqlnd/mysqlnd_wireprotocol.c, ext/mysqlnd/mysqlnd_wireprotocol.h and ext/mysqlnd/mysqlnd_ps_codec.c. BAIL_IF_NO_MORE_DATA, which only noticed an overread after the fact, is replaced by BAIL_IF_NOT_ENOUGH_DATA_EX(n); php_mysqlnd_net_field_length() and its _ll variant take the remaining packet size and reject lengths whose payload is not present; the auth-plugin-data branches use memchr() instead of trusting a NUL terminator; and the TIME/DATE/DATETIME readers stop decoding fixed offsets out of a shorter declared length. The ext/mysqlnd/mysqlnd_ps.c hunk releases the connection reference and the execute command buffer on the prepare-EOF failure path that the above makes reachable. The prepare_read and sha256_pk_request_response_read changes are hardening, not memory-safety fixes. Also adds ext/mysqli/tests/fake_server.inc support and 38 ghsa-r6x9-5r99-36j7-*.phpt regression tests. - CVE-2025-1218