v1.0.30 — Coraza security upgrade

This release upgrades the WAF engine to Coraza 3.8.1, the Caddy connector to
coraza-caddy 2.6.2, and Caddy to 2.11.4. It builds on v1.0.29, retaining
the reputation module and existing site routing. The PHP2Shell mitigation pack
is reserved for the following release; it is not installed or included here.

Coraza 3.8.1 fixes parser ambiguities and memory/CPU exhaustion issues, including
a deeply nested JSON crash. Upstream recommends upgrading from 3.7.x as well.
See the engine release notes
and connector release notes.

Configuration compatibility

The shared backend-generated setup now handles the engine's new error flags:

• Query/path and body arguments above the 1,000 per-source limit receive
  HTTP 400 in blocking mode. Coraza 3.8 otherwise drops the excess arguments
  from inspection; upstream explicitly requires rules acting on
  ARGUMENTS_LIMIT_REACHED in phases 1 and 2.
• Invalid URI parsing and strict multipart parser errors receive HTTP 400.
• Existing JSON processor selection and body-error handling remain in place.

These are engine-upgrade compatibility guards, not the PHP2Shell request-pattern
pack. Legitimate APIs with more than 1,000 arguments per source need review before
upgrading. DetectionOnly still logs without enforcing denies; disabled body
inspection and existing bypass routes retain their limitations. This release
does not establish complete PHP2Shell protection or replace patching PHP.

Upgrade and rollback

Back up your database, deployment settings and rules, and record the previous
image tags/digests before upgrading. From your public deployment checkout:

git pull --ff-only
# Edit .env and set WAF_IMAGE_TAG=1.0.30 (no leading v).
docker compose pull
docker compose up -d
docker compose ps

The release images are ghcr.io/socfortress/waf-caddy:1.0.30,
ghcr.io/socfortress/waf-admin-api:1.0.30 and
ghcr.io/socfortress/waf-admin-ui:1.0.30, for linux/amd64.
Remove temporary local hotfix image / pull_policy: never overrides for these
services, preserving unrelated Compose customizations. Review the effective
images with docker compose config --images before pulling. The latest tag
is mutable; pin 1.0.30 to install this engine-only release. Upgrade Caddy, the optional waf-sandbox service
and the admin API together: the engine flags and generated rules must match.
Verify inside the running WAF:

docker compose exec caddy-waf caddy build-info

The output must contain github.com/corazawaf/coraza/v3 v3.8.1,
github.com/corazawaf/coraza-caddy/v2 v2.6.2 and
github.com/caddyserver/caddy/v2 v2.11.4. Check benign forms, JSON APIs and real
uploads on your own sites after the configuration reload.

To roll back, restore the previous platform image versions together and have
the previous admin API regenerate/reload its configuration. Do not load the new
URI_PARSE_ERROR rules into an older Coraza engine. No database migration is
introduced by this release.

Validation

The release image built successfully for Linux/amd64, matching the publication workflow.
Release qualification used synthetic requests and a static responder, never a
PHP exploit or a production origin. The engine and backend tests ran in the
application source repository; its source is not required to deploy this release. Validation evidence records:

• 43 backend configuration tests passed.
• 22 engine subtests passed; one CRS-version-specific CRM tuning test skipped.
• 56 HTTP outcomes passed on the amd64 image under emulation, with both
  Content-Length and chunked framing, in blocking and detection modes.
• Binary build information confirmed all three pinned versions; the reputation,
  rate-limit and WAF modules remained registered.

These are functional regressions, not performance or complete PHP2Shell
exploit-prevention certification.

The next release will deliver the optional PHP2Shell mitigation pack with scoped
rules, installation instructions and explicit coverage limits. That separate
pack can restrict legitimate multipart uploads and needs site-specific selection.