php/frankenphp v1.13.1

on GitHub

FrankenPHP 1.13.1 fixes the regressions reported since 1.13.0. Nextcloud and other apps that read $_SERVER['REQUEST_URI'] while booting can run in worker mode again, php-cli exposes $argv like the native CLI again (fixing Symfony Console), and Caddy workers retry failed boots as documented instead of giving up on the first error. It also fixes two process crashes and 500 errors during graceful shutdown. Static builds now include the deepclone extension, which speeds up Symfony's cache. Upgrading is recommended for all 1.13.0 users.

✨ New Features

• Static builds: Add deepclone to the default extensions. It is the native implementation of Symfony's DeepCloner, used by VarExporter::export() (and so the cache.system files) and ArrayAdapter since symfony/var-exporter 8.1, and is several times faster than the PHP polyfill on large object graphs by @soyuka in #2699.

🐛 Bug Fixes

• Workers: Set $_SERVER['REQUEST_URI'] to the script name while booting workers, as in 1.12.7. Nextcloud redirected and exited during boot, so its worker failed with "too many consecutive failures" by @dunglas in #2701. Fixes #2697.
• Workers: max_consecutive_failures now defaults to 6 for workers declared in a Caddyfile or JSON config, as documented. Previously, any boot failure aborted startup without retrying. An explicit 0 still disables retries by @dunglas in #2704.
• CLI: php-cli sets $argv[0] to the script path (or Standard input code with -r) like the native CLI SAPI, instead of the binary name followed by a shifted script path. This broke Symfony Console and other tools reading $argv by @henderkes in #2691. Fixes #2690.
• Graceful shutdown: Keep PHP running until Caddy has stopped all apps, so requests served during shutdown_delay and in-flight requests no longer get HTTP 500 errors by @nesl247 in #2645. Fixes #2644.
• Threads: Fix a segfault of the whole process when restarting an unhealthy thread, a regression since 1.12.4 by @BastienClement in #2696. Fixes #2688.
• Request body: Don't read the request body after the request has finished. With fastcgi_finish_request() or frankenphp_finish_request() over HTTP/2, PHP's shutdown drained the body after the handler returned, which could crash the process by @dunglas in #2702. Fixes #2694.
• Forked processes: Only tie direct children of FrankenPHP to its lifetime, so processes that double-fork no longer kill their grandchildren. This broke the gnupg extension ("could not init keylist"), a regression since 1.12.5 by @dunglas in #2703. Fixes #2689.
• Mercure: Exclude the hub from encode in the sample Caddyfile and document the pattern. Since Caddy 2.11.7 compresses server-sent events, each subscriber held a compression encoder (a few MiB with zstd), and compressing private updates next to attacker-influenced data enables BREACH-style attacks. php-server --mercure isn't affected by @dunglas in #2692.

💖 New Contributors

• @nesl247 made their first contribution in #2645
• @BastienClement made their first contribution in #2696

Full Changelog: v1.13.0...v1.13.1