Switch mimalloc to the v3 line

[dunglas]

What does this PR do?

Switches mimalloc from the v2 line to the v3 line. bin/spc download mimalloc now fetches v3.5.4.

Why:

• mimalloc's README lists v3 as the recommended version and v2 as "stable, legacy".
• The v2 pin comes from Add mimalloc support for macOS and Linux #663 (March 2025), when v3 was still in beta.
• [^3] was added in mimalloc v2.2.3 is bugged on musl #692 to skip v2.2.3, which was broken on musl. In its current form, v2\.\d\.[^3], it also skips every other v2.x.3 release.

The new pattern v3\.\d+\.\d+$ only matches stable vX.Y.Z tags, so it skips the win-m4 tag and pre-releases such as v3.0.2-beta. The CMake options set in src/Package/Library/mimalloc.php (MI_BUILD_SHARED, MI_BUILD_OBJECT, MI_INSTALL_TOPLEVEL, MI_LIBC_MUSL) all exist in v3.5.4.

Testing

I tested with FrankenPHP static builds (php/frankenphp#2618): PHP 8.5.11 ZTS with bcmath,ctype,curl,filter,mbstring,opcache,openssl,pdo_sqlite,session,sqlite3,tokenizer,zlib.

• macOS arm64, spc run from this branch.
• Linux arm64 musl, FrankenPHP's static-builder-musl image with the nightly spc and custom-url pointing to the v3.5.4 tarball.

On both, MIMALLOC_VERBOSE=1 prints v3.5.4, release at startup.

spc v3 currently doesn't put libmimalloc.a on the frankenphp link line: SPCConfigUtil::configForResolvedBuild() only covers the frankenphp package closure, and mimalloc isn't in it. The binary builds, but it uses the system allocator. For these tests I added the archive with frankenphp_LDFLAGS. This PR doesn't change that.

Runtime tests, run on both binaries. None of them crashed or printed mimalloc errors:

• php-cli running an allocation-heavy script (random-size strings, cyclic objects, large strings, big hash tables), with and without USE_ZEND_ALLOC=0. With USE_ZEND_ALLOC=0, peak RSS was 233 MB with mimalloc vs 371 MB with the system allocator on macOS, and 251 MB vs 469 MB on musl.
• Caddy with 32 PHP threads, in classic mode and in worker mode (24 workers), 3 minutes each under ab -k -c 64. No failed connections, no non-2xx responses, and RSS stayed flat:
  • macOS: classic 2.52M requests (14.0k req/s, RSS 190-240 MB), worker 2.47M (13.7k req/s, RSS 205-260 MB).
  • musl: classic 1.28M (7.1k req/s, RSS 400-430 MB), worker 1.25M (7.0k req/s, RSS 545-580 MB). For comparison, classic mode with musl's allocator served 7.3k req/s at about 240 MB RSS.

Not tested: glibc builds and x86_64.

Checklist before merging

• If you modified *.php or *.yml, run them locally to ensure your changes are valid:
  • composer cs-fix (no PHP changes)
  • composer analyse (no PHP changes)
  • composer test
  • bin/spc dev:lint-config (only flags config/pkg/lib/lcms2.yml, which is already unsorted on v3)

[github-actions]

StaticPHP Test Bot

Detected: Extensions: none | Libraries: mimalloc | Targets: none
Active labels: none
Available labels: need-test (gate), test/linux test/windows test/macos (platform), test/tier2 (extra arch), test/php-83 test/php-84 (PHP version), sapi/frankenphp (extra FrankenPHP SAPI build)
Config: Linux x86_64 + Windows x86_64 + macOS arm64 | PHP 8.5 NTS

[crazywhalecc]

Well, it seems our test process doesn't cover mimalloc. It isn't directly depended upon by any target.

[crazywhalecc]

Change is simple, absolutely good for me, but still not tested though. I'll leave this to @henderkes .

[henderkes]

Works, merging