[PhilReinking]

What changed

The Docker image moves from trafex/php-nginx:3.6.0 (PHP 8.3.9, Alpine 3.20, end of life) to 3.12.0 (PHP 8.5.12, Alpine 3.24). PHP 8.5.12 has the fixes for two remote code execution bugs (CVE-2026-109618, CVE-2026-109619). There is no trafex tag with a fixed 8.3. CI now tests on PHP 8.5. The php83-* packages are php85-*; Redis is php85-pecl-redis. The php.ini goes to /etc/php85/conf.d/. Changelog line added.

Tested

Built the image. php -v prints 8.5.12.

php -m old (ghcr.io/deck9/input:main) against new: nothing lost. Two modules are new, both part of PHP 8.5: lexbor and uri.

Started the image with a throwaway MariaDB 11: all migrations ran, nginx, php-fpm, queue worker and scheduler run. /login on a fresh install answers 302 to /register (no users yet), and /register answers 200. The custom php.ini applies (upload_max_filesize 8M).

Not tested

The PHP tests on PHP 8.5 run in CI only. I did not run them by hand. Nothing in the image was tried with S3 or Redis.

After merge

Self-hosters who mount their own php.ini must use /etc/php85/conf.d/ (the old path was /etc/php83/). The PM releases v2.2.1 with an image tag.

Part of BITS-384

🤖 Generated with Claude Code

[PhilReinking]

Looks good at 34b770f. I built the image from this head (on arm64, so that build works too) and checked it by hand.

• php -v: PHP 8.5.12. mirror.gcr.io/trafex/php-nginx:3.12.0 resolves.
• php -m, ghcr.io/deck9/input:main (8.3.9) vs new: nothing lost, only lexbor and uri added. redis loads, from php85-pecl-redis 6.3.0.
• No php83 left in the image or in scripts/. /usr/bin/php points to php85, supervisor runs php-fpm85, our ini is read from /etc/php85/conf.d (post_max_size 9M, upload_max_filesize 8M).
• With MariaDB 11: 49 migrations ran, nginx, php-fpm, queue worker and scheduler started, /login 302 to /register, which returns 200.
• The changelog line and its upgrade step are correct.

One thing to fix in a follow-up (not in this diff): config/database.php:62 uses PDO::MYSQL_ATTR_SSL_CA, which PHP 8.5 marks as deprecated. Every artisan call that loads the config without the cache prints PHP Deprecated: Constant PDO::MYSQL_ATTR_SSL_CA is deprecated since 8.5, for example optimize:clear in start-container.sh on each start, so self-hosters see it in their logs. The Laravel 13 skeleton uses (PHP_VERSION_ID >= 80500 ? \Pdo\Mysql::ATTR_SSL_CA : \PDO::MYSQL_ATTR_SSL_CA).