chore(deps): update dunglas/frankenphp docker tag to v1.12.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
dunglas/frankenphp (source)		minor	1.10.1 → 1.12.0
dunglas/frankenphp (source)	stage	minor	1.10.1-php8.4 → 1.12.0-php8.4

---

Release Notes

php/frankenphp (dunglas/frankenphp)

v1.12.0

Compare Source

What's Changed

Official, native Windows support has arrived!

This highly anticipated release brings 100% compatibility, Worker Mode, and Hot Reloading to Windows, delivering up to a 3.6x performance boost over traditional Nginx/PHP-FPM setups. Thanks to new compiler capabilities in Go 1.26, FrankenPHP now links directly against official Visual Studio-compiled PHP binaries for ultimate stability and full extension support.

Huge thanks to Intelligence X and Les-Tilleuls.coop for sponsoring this milestone.

Learn more about the story of the Windows port in this dedicated blog post.

This version also includes some performance optimizations and Caddy 2.11.2.

✨ New Features

• Windows support by @​dunglas, @​henderkes and many other contributors in #​2119, #​2227 and #​2228
• Add configurable max_idle_time for autoscaled threads by @​firecow in #​2225

🚀 Performance Improvements

• Move sandboxed environment to the C side by @​AlliBalliBaba in #​2058
• Refactor CGI strings creation by @​AlliBalliBaba in #​2188
• Use ldflags to set Server header by @​dunglas in #​2221

📖 Documentation

• Spanish translation by @​PhilDaiguille in #​2096
• Improved hardened Docker image by @​AlliBalliBaba in #​2229
• Contributing on Windows by @​dunglas in #​2222

New Contributors

• @​PhilDaiguille made their first contribution in #​2096
• @​firecow made their first contribution in #​2225

Full Changelog: php/frankenphp@v1.11.3...v1.12.0

v1.11.3

Compare Source

This release restores application stability by reverting the unreliable worker mode INI reset introduced in version 1.11.2, upgrades Caddy to 2.11, and bumps the PHP version included in static binaries to PHP 8.5 to deliver new language features and performance gains, though the MS SQL Server and memcache extensions have been temporarily removed due to 8.5 incompatibility.

What's Changed

🐛 Bug Fixes

• Worker: Revert ini reset, keep session fixes (#​2139) by @​dunglas in #​2217
• Worker: Always ignore user abort by @​AlliBalliBaba in #​2189
• Metrics: Only report workers ready when actually ready by @​withinboredom in #​2210
• Embed: Fix relative embed paths support by @​henderkes in #​2199
• Fix nomercure tag usage by @​tehmaestro in #​2212

✨ New Features

• Upgrade to Caddy v2.11 by @​henderkes in #​2214
• Update static binaries PHP version to 8.5 by @​henderkes in #​2168
• Packages: Add restart policies to FrankenPHP systemd service by @​henderkes in #​2191
• Embed: Allow to customize the extraction path by @​dunglas in #​2198

Documentation

• Document the extension workers API by @​y-l-g in #​2055

New Contributors

• @​tehmaestro made their first contribution in #​2212

Full Changelog: v1.11.2...v1.11.3

v1.11.2

Compare Source

[!IMPORTANT]
Security Update: This release addresses three security vulnerabilities, including a critical path confusion issue allowing arbitrary file execution and a session leak in worker mode. Immediate upgrade is strongly recommended.

Beyond security, this release delivers significant performance improvements by upgrading the compiler to Go 1.26. Users can expect a 10-40% faster Garbage Collector and ~30% faster CGO calls, resulting in significantly reduced latency for PHP applications.

We have also improved stability by addressing race conditions during shutdown, resolving segmentation faults in edge cases (such as early shutdown or specific extension registrations), and refining the handling of $_SERVER and HTTP Basic Auth.

What's Changed

🛡️ Security Fixes

• GHSA-g966-83w7-6w38: Path confusion via Unicode casing in CGI path splitting could allow execution of arbitrary files. Fixed by @​AbdrrahimDahmani and @​dunglas in commit 04fdc0c.
• GHSA-r3xh-3r3w-47gp: Fixed a session leak between requests handled by workers. Fixed by @​xavierleune in commit 24d6c99.
• GHSA-x9p2-77v6-6vhf: Fixed delayed propagation of security fixes in upstream base Docker images. Fixed by @​opctim in commit be2d6b9.
• Prevent potential cache pollution issues in CI builds by @​dunglas in #​2164

🐛 Bug Fixes

• Ensure $_SERVER['PHP_SELF'] always starts with a slash by @​dunglas in #​2172
• Let PHP handle HTTP Basic Authorization headers natively by @​AlliBalliBaba in #​2142
• Handle symlinking edge cases correctly by @​withinboredom in #​1660
• Prevent segmentation faults on early shutdown by @​AlliBalliBaba in #​2120
• Fix race condition in thread shutdown during drain by @​dunglas in #​2182
• Worker: Initialize $_REQUEST correctly in worker mode by @​xavierleune in #​2136
• Worker: Reset INI settings and $_SESSION if changed during a worker request by @​xavierleune in #​2139
• Ext: Fix segmentation fault when registering multiple extensions by @​y-l-g in #​2112
• Extgen: Make the generator idempotent and avoid touching the original source by @​alexandre-daubois in #​2011
• Extgen: Correctly handle const blocks to declare iota constants by @​alexandre-daubois in #​2086
• Extgen: Use fast ZPP (Zend Parameter Parsing) by @​alexandre-daubois in #​2088
• Static: Don't overwrite SPC_CMD_VAR_FRANKENPHP_XCADDY_MODULES unconditionally by @​henderkes in #​2135
• Embed: Fix relative paths not being resolved correctly by Static PHP CLI when embedding an app by @​henderkes in #​2093
• Embed: Correct path to Composer's installed.json by @​Jellyfrog in #​2127

🚀 Performance Improvements

• Compile with Go 1.26 (includes 10-40% faster garbage collector and 30% faster CGO calls) by @​alexandre-daubois and @​dunglas in #​2178
• Various internal optimizations by @​dunglas in #​2175

✨ New Features

• Packages: Add apk repository for Alpine Linux by @​henderkes in #​2099

Documentation

• Hot reloading
• Structured logging
• WordPress integration
• Improved performance docs

[!NOTE]
Translations are now automated using an LLM.

New Contributors

• @​Jellyfrog made their first contribution in #​2127
• @​xavierleune made their first contribution in #​2138
• @​damienfern made their first contribution in #​1900

Full Changelog: php/frankenphp@v1.11.1...v1.11.2

v1.11.1

Compare Source

What's Changed

• fix: crash when using the logger outside of the a request context by @​lobre in #​2089
• fix: frankenphp_log() level parameter must be optional by @​dunglas in #​2085
• fix(caddy): use default patterns when hot_reload is alone by @​dunglas in #​2081

New Contributors

• @​lobre made their first contribution in #​2089

Full Changelog: php/frankenphp@v1.11.0...v1.11.1

v1.11.0

Compare Source

What's Changed

• feat: hot reloading for PHP apps and sites by @​dunglas in #​2031
• feat: add frankenphp_log() PHP function to emit structured logs by @​raphaelcoeffic in #​1979
• feat(watcher): support for multiple curly braces by @​AlliBalliBaba in #​2068
• feat(ext): expose IsPacked to help dealing with hashmaps and lists in Go code by @​alexandre-daubois in #​1977
• feat(extgen): add support for callable in parameters by @​alexandre-daubois in #​1731
• perf: improve tail latency with goSched by @​AlliBalliBaba in #​2033
• perf: improve uncommon headers parsing performance by upgrading to Otter v2 by @​maxm86545 in #​2040
• fix(ext)!: returns a zend_array directly in types.go by @​AlliBalliBaba in #​1894
• fix(packages): give /var/lib/frankenphp sys_rw_content_t permissions for mercure.db files by @​henderkes in #​2037
• fix(packages): remove deprecated Mercure "transport_url" directive from Caddyfile by @​dunglas in #​2065
• fix(extgen): use REGISTER(_NS)_BOOL_CONSTANT by @​alexandre-daubois in #​2047
• fix(extgen): use RETURN_EMPTY_STRING() when returning empty string by @​alexandre-daubois in #​2049

New Contributors

• @​Arkeins made their first contribution in #​2059
• @​krowinski made their first contribution in #​2063
• @​raphaelcoeffic made their first contribution in #​1979

Full Changelog: php/frankenphp@v1.10.1...v1.11.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.