beromir/Servas v1.1.2

on GitHub

This release fixes a critical PHP security issue and hardens how the Docker image is built. Updating is recommended for everyone.

Security

• The Docker image now runs on PHP 8.4.27, which fixes a critical security issue. The base image is pinned to dunglas/frankenphp:php8.4.27-alpine instead of the moving php8.4-alpine tag.
• PHP session upload progress is turned off (session.upload_progress.enabled = Off) to mitigate CVE-2026-109618 and CVE-2026-109619. Servas uses Laravel's own session handling, so nothing changes for you.

Maintenance

• Updated the PHP (Composer) and JavaScript (npm) dependencies.
• The Docker build now uses Node.js 24.22 to build the frontend assets.
• Supply-chain hardening for installs:
  • npm skips packages released less than 3 days ago (min-release-age=3).
  • npm install scripts are disabled (ignore-scripts=true).
  • Composer plugins and scripts are disabled during the image build.

Upgrading

Pull the new image and restart the containers:

docker compose pull
docker compose up -d