Move the Docker image to PHP 8.5.12 (BITS-384)

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: "8.3"
+          php-version: "8.5"
           extensions: bcmath,gd
 
       - uses: actions/checkout@v4
@@ -97,7 +97,7 @@ jobs:
     steps:
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: "8.3"
+          php-version: "8.5"
           extensions: bcmath,gd
 
       - uses: actions/checkout@v4

CHANGELOG.md

@@ -81,6 +81,7 @@ Lines marked **Upgrade step** need you to act after updating.
 
 ### Security
 
+-   The Docker image moves to PHP 8.5.12 for the October 2026 PHP security fixes (CVE-2026-109618, CVE-2026-109619). **Upgrade step:** if you mount your own php.ini into /etc/php83/conf.d, move it to /etc/php85/conf.d. (#296)
 -   The text editor for questions and the completion page now uses tiptap 3, which fixes a moderate advisory in tiptap 2. Texts you wrote before stay as they are. (#226)
 -   Input's UI library, @deck9/ui, no longer pulls in a uuid version with a moderate advisory (GHSA-w5hq-g745-h8pq). Input never used the affected functions. (#231)
 -   The page and `GET /api/user` no longer send a user's internal `salt` to the browser. Nothing in Input used it. The column stays in the database. (#283)

Dockerfile

@@ -7,7 +7,7 @@ RUN composer install --no-scripts --no-autoloader --no-interaction --no-progress
 
 # ---
 
-FROM mirror.gcr.io/trafex/php-nginx:3.6.0 AS php_base
+FROM mirror.gcr.io/trafex/php-nginx:3.12.0 AS php_base
 
 LABEL Maintainer="Philipp Reinking <philipp@deck9.co>" Description="Input is a no-code application to create simple & clean forms."
 LABEL org.opencontainers.image.licenses="GNU Affero General Public License v3.0"
@@ -24,24 +24,24 @@ ENV LOG_CHANNEL=stderr
 ENV MAIL_MAILER=log
 
 RUN apk add --no-cache \
-    php83-exif \
-    php83-fileinfo \
-    php83-iconv \
-    php83-simplexml \
-    php83-tokenizer \
-    php83-xmlwriter \
-    php83-redis \
-    php83-pdo \
-    php83-pdo_mysql \
-    php83-pdo_sqlite \
-    php83-bcmath \
-    php83-zip \
+    php85-exif \
+    php85-fileinfo \
+    php85-iconv \
+    php85-simplexml \
+    php85-tokenizer \
+    php85-xmlwriter \
+    php85-pecl-redis \
+    php85-pdo \
+    php85-pdo_mysql \
+    php85-pdo_sqlite \
+    php85-bcmath \
+    php85-zip \
     sqlite
 
 COPY ./scripts/nginx/fastcgi_params /etc/nginx/fastcgi_params
 COPY ./scripts/nginx/nginx.conf /etc/nginx/nginx.conf
 COPY ./scripts/nginx/nginx.default.conf /etc/nginx/conf.d/default.conf
-COPY ./scripts/php.conf.ini /etc/php83/conf.d/99-input.ini
+COPY ./scripts/php.conf.ini /etc/php85/conf.d/99-input.ini
 
 USER nobody
 WORKDIR /var/www/html