fix: backport the critical PHP image correction to Server 2.9.12

.github/workflows/release.yml

@@ -33,6 +33,8 @@ jobs:
     name: Build and push Docker image
     runs-on: ubuntu-latest
     environment: dockerhub
+    env:
+      RELEASE_IMAGE_ROLLING_SCOPE: minor
     if: >-
       (github.event_name == 'workflow_dispatch' &&
        github.ref == 'refs/heads/main') ||
@@ -197,7 +199,8 @@ jobs:
 
       - name: Build and push exact image tags
         id: build
-        timeout-minutes: 45
+        # A cold signed PHP source build under ARM emulation exceeds 45 minutes.
+        timeout-minutes: 120
         continue-on-error: true
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7
         with:
@@ -211,6 +214,7 @@ jobs:
           cache-to: ${{ steps.cache.outputs.cache_to }}
           provenance: false
           build-args: |
+            PHP_BUILD_JOBS=4
             PHPREDIS_VERSION=${{ env.PHPREDIS_VERSION }}
             PHPREDIS_COMMIT=${{ env.PHPREDIS_COMMIT }}
             WORKFLOW_PACKAGE_SOURCE=${{ steps.workflow.outputs.source }}
@@ -398,8 +402,11 @@ jobs:
   publish-chart:
     name: Publish matching immutable Helm chart
     needs: publish
+    # This one-time maintenance tag publishes images only. The existing chart
+    # stays immutable; the current main chart supports an explicit image tag.
     if: >-
       always() &&
+      github.ref == 'refs/heads/main' &&
       needs.publish.outputs.exact_publish_outcome == 'success' &&
       github.repository == 'durable-workflow/server' &&
       ((github.event_name == 'workflow_dispatch' &&

.github/workflows/sonar.yml

@@ -2,8 +2,9 @@ name: SonarQube
 
 on:
   push:
-    branches: [main, maintenance/2.9-security]
+    branches: [main]
   pull_request:
+    branches: [main]
 
 permissions:
   contents: read

Dockerfile

@@ -11,7 +11,110 @@ RUN git clone --depth 1 --branch "${PHPREDIS_VERSION}" https://github.com/phpred
          exit 1; \
        fi
 
-FROM php:8.3-apache AS base
+# Use the signed upstream fix while Docker Official Image publication catches up.
+# Configure options match docker-library/php at f6048b5f6e3c2202ee082665a4ccc0d90de291a3.
+FROM php@sha256:c59c808172ee3672cd334f8f2a5d7b1480a9d7273a368f412b8ee9b4ef418184 AS patched-php
+
+LABEL dev.durable-workflow.php.source.version="8.3.36" \
+      dev.durable-workflow.php.source.sha256="dd54693aa334c5c4d72e9aee96b082c2473750a18a6c1d105789c93a3b1692fd"
+
+ARG PHP_BUILD_JOBS=2
+ENV PHP_VERSION="8.3.36" \
+    PHP_URL="https://www.php.net/distributions/php-8.3.36.tar.xz" \
+    PHP_ASC_URL="https://www.php.net/distributions/php-8.3.36.tar.xz.asc" \
+    PHP_SHA256="dd54693aa334c5c4d72e9aee96b082c2473750a18a6c1d105789c93a3b1692fd"
+
+COPY docker/php-keyring.gpg /tmp/php-keyring.gpg
+
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends \
+        apache2-dev \
+        autoconf \
+        ca-certificates \
+        curl \
+        dpkg-dev \
+        file \
+        g++ \
+        gcc \
+        gnupg \
+        libargon2-dev \
+        libc-dev \
+        libcurl4-openssl-dev \
+        libonig-dev \
+        libreadline-dev \
+        libsodium-dev \
+        libsqlite3-dev \
+        libssl-dev \
+        libxml2-dev \
+        make \
+        pkg-config \
+        re2c \
+        xz-utils \
+        zlib1g-dev; \
+    printf '%s  %s\n' \
+        '43fcb3eaf65536cb0833c229b492c70cfad8562138164dd13673e08925d6c56c' \
+        /tmp/php-keyring.gpg | sha256sum --check -; \
+    curl --proto '=https' --proto-redir '=https' --fail --location --show-error --silent \
+        --output /usr/src/php.tar.xz "${PHP_URL}"; \
+    printf '%s  %s\n' "${PHP_SHA256}" /usr/src/php.tar.xz | sha256sum --check -; \
+    curl --proto '=https' --proto-redir '=https' --fail --location --show-error --silent \
+        --output /tmp/php.tar.xz.asc "${PHP_ASC_URL}"; \
+    export GNUPGHOME="$(mktemp -d)"; \
+    gpg --batch --import /tmp/php-keyring.gpg; \
+    gpg --batch --verify /tmp/php.tar.xz.asc /usr/src/php.tar.xz; \
+    gpgconf --kill all; \
+    rm -rf "${GNUPGHOME}" /usr/src/php; \
+    mkdir -p /usr/src/php; \
+    tar --extract --file /usr/src/php.tar.xz --xz --strip-components=1 --directory /usr/src/php; \
+    cd /usr/src/php; \
+    gnu_arch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+    deb_multiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+    export CFLAGS="${PHP_CFLAGS}" CPPFLAGS="${PHP_CPPFLAGS}" LDFLAGS="${PHP_LDFLAGS}" \
+        PHP_BUILD_PROVIDER='https://github.com/docker-library/php' PHP_UNAME='Linux - Docker'; \
+    ./configure \
+        --build="${gnu_arch}" \
+        --sysconfdir="${PHP_INI_DIR%/php}" \
+        --with-config-file-path="${PHP_INI_DIR}" \
+        --with-config-file-scan-dir="${PHP_INI_DIR}/conf.d" \
+        --enable-option-checking=fatal --with-mhash --with-pic \
+        --enable-mbstring --enable-mysqlnd --with-password-argon2 --with-sodium=shared \
+        --with-pdo-sqlite=/usr --with-sqlite3=/usr --with-curl --with-iconv \
+        --with-openssl --with-readline --with-zlib --disable-phpdbg --with-pear \
+        --with-libdir="lib/${deb_multiarch}" --disable-cgi --with-apxs2; \
+    make -j "${PHP_BUILD_JOBS}"; \
+    make install; \
+    cp php.ini-development php.ini-production "${PHP_INI_DIR}/"; \
+    strip --strip-all /usr/local/bin/php /usr/lib/apache2/modules/libphp.so; \
+    test "$(php -r 'echo PHP_VERSION;')" = "${PHP_VERSION}"; \
+    rm -rf /usr/src/php /var/lib/apt/lists/* /tmp/php.tar.xz.asc /tmp/php-keyring.gpg
+
+FROM php@sha256:c59c808172ee3672cd334f8f2a5d7b1480a9d7273a368f412b8ee9b4ef418184 AS base
+
+# Replace every PHP runtime/build artifact, including the Apache module and
+# extension sources used below. A changed image environment is not a PHP update.
+COPY --from=patched-php /usr/local/bin/php /usr/local/bin/php
+COPY --from=patched-php /usr/local/bin/php-config /usr/local/bin/php-config
+COPY --from=patched-php /usr/local/bin/phpize /usr/local/bin/phpize
+COPY --from=patched-php /usr/local/lib/php/ /usr/local/lib/php/
+COPY --from=patched-php /usr/local/include/php/ /usr/local/include/php/
+COPY --from=patched-php /usr/lib/apache2/modules/libphp.so /usr/lib/apache2/modules/libphp.so
+COPY --from=patched-php /usr/src/php.tar.xz /usr/src/php.tar.xz
+COPY --from=patched-php /usr/local/etc/php/php.ini-development /usr/local/etc/php/php.ini-development
+COPY --from=patched-php /usr/local/etc/php/php.ini-production /usr/local/etc/php/php.ini-production
+
+ENV PHP_VERSION="8.3.36" \
+    PHP_URL="https://www.php.net/distributions/php-8.3.36.tar.xz" \
+    PHP_ASC_URL="https://www.php.net/distributions/php-8.3.36.tar.xz.asc" \
+    PHP_SHA256="dd54693aa334c5c4d72e9aee96b082c2473750a18a6c1d105789c93a3b1692fd"
+
+LABEL dev.durable-workflow.php.source.version="8.3.36" \
+      dev.durable-workflow.php.source.sha256="dd54693aa334c5c4d72e9aee96b082c2473750a18a6c1d105789c93a3b1692fd"
+
+# Both web and CLI roles require the fixed PHP runtime, including cached builds.
+RUN php -r 'if (PHP_MAJOR_VERSION !== 8 || PHP_MINOR_VERSION !== 3 || PHP_VERSION_ID < 80336) { \
+    fwrite(STDERR, "Patched PHP 8.3.36 or later on the 8.3 line is required; found ".PHP_VERSION.PHP_EOL); \
+    exit(1); }'
 
 COPY --from=phpredis-source /phpredis /usr/src/php/ext/redis
 

composer.json

@@ -48,7 +48,7 @@
     },
     "extra": {
         "durable-workflow": {
-            "product-train": "2.9.11"
+            "product-train": "2.9.12"
         },
         "laravel": {
             "dont-discover": []

docker-compose.dedicated-matching.yml

@@ -32,13 +32,13 @@ name: durable-workflow-server
 # daemon reports `shape: dedicated`.
 
 # Generated by scripts/ci/sync-source-release.mjs. Do not edit the fallback.
-x-server-image: &server-image ${DW_SERVER_IMAGE:-durableworkflow/server:${DW_SERVER_TAG:-2.9.11}}
+x-server-image: &server-image ${DW_SERVER_IMAGE:-durableworkflow/server:${DW_SERVER_TAG:-2.9.12}}
 
 x-server-environment: &server-environment
   APP_NAME: "Durable Workflow Server"
   APP_ENV: ${APP_ENV:-local}
   DW_SERVER_KEY: ${DW_SERVER_KEY:-}
-  APP_VERSION: ${APP_VERSION:-${DW_SERVER_TAG:-2.9.11}}
+  APP_VERSION: ${APP_VERSION:-${DW_SERVER_TAG:-2.9.12}}
   APP_DEBUG: ${APP_DEBUG:-false}
   DB_CONNECTION: mysql
   DB_HOST: mysql

docker-compose.memo-rolling.yml

@@ -49,14 +49,14 @@ services:
     command: ["server-bootstrap"]
     environment:
       <<: *runtime-environment
-      APP_VERSION: ${APP_VERSION:-2.9.11}
+      APP_VERSION: ${APP_VERSION:-2.9.12}
 
   successor:
     image: ${DW_MEMO_SUCCESSOR_IMAGE:-durable-workflow/server-memo-rolling:local}
     ports: !override []
     environment:
       <<: *runtime-environment
-      APP_VERSION: ${APP_VERSION:-2.9.11}
+      APP_VERSION: ${APP_VERSION:-2.9.12}
       DW_SERVER_ID: memo-successor
       DW_SERVER_TOPOLOGY_SHAPE: standalone_server
       DW_SERVER_PROCESS_CLASS: server_http_node

docker-compose.published.yml

@@ -1,13 +1,13 @@
 name: durable-workflow-server
 
 # Generated by scripts/ci/sync-source-release.mjs. Do not edit the fallback.
-x-server-image: &server-image ${DW_SERVER_IMAGE:-durableworkflow/server:${DW_SERVER_TAG:-2.9.11}}
+x-server-image: &server-image ${DW_SERVER_IMAGE:-durableworkflow/server:${DW_SERVER_TAG:-2.9.12}}
 
 x-server-environment: &server-environment
   APP_NAME: "Durable Workflow Server"
   APP_ENV: ${APP_ENV:-local}
   DW_SERVER_KEY: ${DW_SERVER_KEY:-}
-  APP_VERSION: ${APP_VERSION:-${DW_SERVER_TAG:-2.9.11}}
+  APP_VERSION: ${APP_VERSION:-${DW_SERVER_TAG:-2.9.12}}
   APP_DEBUG: ${APP_DEBUG:-false}
   LOG_CHANNEL: ${LOG_CHANNEL:-stderr}
   LOG_LEVEL: ${LOG_LEVEL:-info}

docker-compose.small-cluster.yml

@@ -12,7 +12,7 @@ x-server-build: &server-build
 x-server-environment: &server-environment
   APP_NAME: "Durable Workflow Server"
   APP_ENV: testing
-  APP_VERSION: ${APP_VERSION:-2.9.11}
+  APP_VERSION: ${APP_VERSION:-2.9.12}
   APP_DEBUG: "false"
   DW_SERVER_KEY: ${DW_SERVER_KEY:-base64:5Zt4nUhlCm3DD0nLXZJQdHiwPfb56yGo9gNV/g3jYbY=}
   DB_CONNECTION: ${DW_SMALL_CLUSTER_DB:-mysql}

docker-compose.yml

@@ -15,7 +15,7 @@ services:
       DW_SERVER_KEY: "${DW_SERVER_KEY:-}"
       DW_SERVER_TOPOLOGY_SHAPE: standalone_server
       DW_SERVER_PROCESS_CLASS: server_http_node
-      APP_VERSION: "${APP_VERSION:-2.9.11}"
+      APP_VERSION: "${APP_VERSION:-2.9.12}"
       APP_DEBUG: "false"
       DB_CONNECTION: mysql
       DB_HOST: mysql
@@ -62,7 +62,7 @@ services:
       APP_NAME: "Durable Workflow Server"
       APP_ENV: local
       DW_SERVER_KEY: "${DW_SERVER_KEY:-}"
-      APP_VERSION: "${APP_VERSION:-2.9.11}"
+      APP_VERSION: "${APP_VERSION:-2.9.12}"
       APP_DEBUG: "false"
       DB_CONNECTION: mysql
       DB_HOST: mysql
@@ -124,7 +124,7 @@ services:
       DW_SERVER_KEY: "${DW_SERVER_KEY:-}"
       DW_SERVER_TOPOLOGY_SHAPE: standalone_server
       DW_SERVER_PROCESS_CLASS: worker_node
-      APP_VERSION: "${APP_VERSION:-2.9.11}"
+      APP_VERSION: "${APP_VERSION:-2.9.12}"
       DB_CONNECTION: mysql
       DB_HOST: mysql
       DB_PORT: 3306
@@ -178,7 +178,7 @@ services:
       DW_SERVER_KEY: "${DW_SERVER_KEY:-}"
       DW_SERVER_TOPOLOGY_SHAPE: standalone_server
       DW_SERVER_PROCESS_CLASS: scheduler_node
-      APP_VERSION: "${APP_VERSION:-2.9.11}"
+      APP_VERSION: "${APP_VERSION:-2.9.12}"
       DB_CONNECTION: mysql
       DB_HOST: mysql
       DB_PORT: 3306

docker/php-custom.ini

@@ -4,7 +4,11 @@ expose_php = Off
 ; The API enforces separate bounded JSON and binary transport limits. PHP must
 ; not consume/discard POST bodies or emit warnings before that boundary runs.
 enable_post_data_reading = Off
-post_max_size = 0
+; Keep the default 64 MiB binary transport usable. The API applies its stricter
+; JSON and per-route limits; it does not accept PHP multipart file uploads.
+post_max_size = 64M
+upload_max_filesize = 64M
+session.upload_progress.enabled = Off
 display_errors = Off
 display_startup_errors = Off
 log_errors = On