From 98a193fe3c930712cd94be8becfe1701248eb3bc Mon Sep 17 00:00:00 2001 From: Philipp Reinking Date: Thu, 22 Oct 2026 12:33:59 +0200 Subject: [PATCH 1/2] Move the Docker image to PHP 8.5.12 and test on PHP 8.5 Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/ci.yml | 4 ++-- CHANGELOG.md | 1 + Dockerfile | 28 ++++++++++++++-------------- 3 files changed, 17 insertions(+), 16 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 766e04f9..941ed549 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,7 +35,7 @@ jobs: steps: - uses: shivammathur/setup-php@v2 with: - php-version: "8.3" + php-version: "8.5" extensions: bcmath,gd - uses: actions/checkout@v4 @@ -97,7 +97,7 @@ jobs: steps: - uses: shivammathur/setup-php@v2 with: - php-version: "8.3" + php-version: "8.5" extensions: bcmath,gd - uses: actions/checkout@v4 diff --git a/CHANGELOG.md b/CHANGELOG.md index 03b8b241..788940f2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -81,6 +81,7 @@ Lines marked **Upgrade step** need you to act after updating. ### Security +- The Docker image moves to PHP 8.5.12 for the October 2026 PHP security fixes (CVE-2026-109618, CVE-2026-109619). (#296) - The text editor for questions and the completion page now uses tiptap 3, which fixes a moderate advisory in tiptap 2. Texts you wrote before stay as they are. (#226) - Input's UI library, @deck9/ui, no longer pulls in a uuid version with a moderate advisory (GHSA-w5hq-g745-h8pq). Input never used the affected functions. (#231) - The page and `GET /api/user` no longer send a user's internal `salt` to the browser. Nothing in Input used it. The column stays in the database. (#283) diff --git a/Dockerfile b/Dockerfile index 7aee6b55..da88820d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,7 +7,7 @@ RUN composer install --no-scripts --no-autoloader --no-interaction --no-progress # --- -FROM mirror.gcr.io/trafex/php-nginx:3.6.0 AS php_base +FROM mirror.gcr.io/trafex/php-nginx:3.12.0 AS php_base LABEL Maintainer="Philipp Reinking " Description="Input is a no-code application to create simple & clean forms." LABEL org.opencontainers.image.licenses="GNU Affero General Public License v3.0" @@ -24,24 +24,24 @@ ENV LOG_CHANNEL=stderr ENV MAIL_MAILER=log RUN apk add --no-cache \ - php83-exif \ - php83-fileinfo \ - php83-iconv \ - php83-simplexml \ - php83-tokenizer \ - php83-xmlwriter \ - php83-redis \ - php83-pdo \ - php83-pdo_mysql \ - php83-pdo_sqlite \ - php83-bcmath \ - php83-zip \ + php85-exif \ + php85-fileinfo \ + php85-iconv \ + php85-simplexml \ + php85-tokenizer \ + php85-xmlwriter \ + php85-pecl-redis \ + php85-pdo \ + php85-pdo_mysql \ + php85-pdo_sqlite \ + php85-bcmath \ + php85-zip \ sqlite COPY ./scripts/nginx/fastcgi_params /etc/nginx/fastcgi_params COPY ./scripts/nginx/nginx.conf /etc/nginx/nginx.conf COPY ./scripts/nginx/nginx.default.conf /etc/nginx/conf.d/default.conf -COPY ./scripts/php.conf.ini /etc/php83/conf.d/99-input.ini +COPY ./scripts/php.conf.ini /etc/php85/conf.d/99-input.ini USER nobody WORKDIR /var/www/html From 34b770f6afb81bee450f0be07813ae5fad91d1f9 Mon Sep 17 00:00:00 2001 From: Philipp Reinking Date: Thu, 22 Oct 2026 12:34:41 +0200 Subject: [PATCH 2/2] Changelog: upgrade step for a mounted php.ini Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 788940f2..1c9027cc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -81,7 +81,7 @@ Lines marked **Upgrade step** need you to act after updating. ### Security -- The Docker image moves to PHP 8.5.12 for the October 2026 PHP security fixes (CVE-2026-109618, CVE-2026-109619). (#296) +- The Docker image moves to PHP 8.5.12 for the October 2026 PHP security fixes (CVE-2026-109618, CVE-2026-109619). **Upgrade step:** if you mount your own php.ini into /etc/php83/conf.d, move it to /etc/php85/conf.d. (#296) - The text editor for questions and the completion page now uses tiptap 3, which fixes a moderate advisory in tiptap 2. Texts you wrote before stay as they are. (#226) - Input's UI library, @deck9/ui, no longer pulls in a uuid version with a moderate advisory (GHSA-w5hq-g745-h8pq). Input never used the affected functions. (#231) - The page and `GET /api/user` no longer send a user's internal `salt` to the browser. Nothing in Input used it. The column stays in the database. (#283)