Releases · php/frankenphp

v1.12.1

What's Changed

🐛 Bug Fixes

Fix PHP startup errors when ini files contain environment variables by @henderkes in #2252
Fix sigsev on bind permissions denied by @henderkes in #2251

📖 Documentation

Update README for Windows, other minor changes by @dunglas in #2249
Revise bug report template for improved instructions by @dunglas in #2181
Improve hot reload, add missing features by @dunglas in #2261
Sync all translations with the English ones

New Contributors

@github-actions[bot] made their first contribution in #2206

Full Changelog: v1.12.0...v1.12.1

v1.12.0

v1.11.3

This release restores application stability by reverting the unreliable worker mode INI reset introduced in version 1.11.2, upgrades Caddy to 2.11, and bumps the PHP version included in static binaries to PHP 8.5 to deliver new language features and performance gains, though the MS SQL Server and memcache extensions have been temporarily removed due to 8.5 incompatibility.

What's Changed

🐛 Bug Fixes

Worker: Revert ini reset, keep session fixes (#2139) by @dunglas in #2217
Worker: Always ignore user abort by @AlliBalliBaba in #2189
Metrics: Only report workers ready when actually ready by @withinboredom in #2210
Embed: Fix relative embed paths support by @henderkes in #2199
Fix nomercure tag usage by @tehmaestro in #2212

✨ New Features

Upgrade to Caddy v2.11 by @henderkes in #2214
Update static binaries PHP version to 8.5 by @henderkes in #2168
Packages: Add restart policies to FrankenPHP systemd service by @henderkes in #2191
Embed: Allow to customize the extraction path by @dunglas in #2198

Documentation

Document the extension workers API by @y-l-g in #2055

New Contributors

@tehmaestro made their first contribution in #2212

Full Changelog: v1.11.2...v1.11.3

v1.11.2

Important

Security Update: This release addresses three security vulnerabilities, including a critical path confusion issue allowing arbitrary file execution and a session leak in worker mode. Immediate upgrade is strongly recommended.

Beyond security, this release delivers significant performance improvements by upgrading the compiler to Go 1.26. Users can expect a 10-40% faster Garbage Collector and ~30% faster CGO calls, resulting in significantly reduced latency for PHP applications.

We have also improved stability by addressing race conditions during shutdown, resolving segmentation faults in edge cases (such as early shutdown or specific extension registrations), and refining the handling of $_SERVER and HTTP Basic Auth.

What's Changed

🛡️ Security Fixes

GHSA-g966-83w7-6w38: Path confusion via Unicode casing in CGI path splitting could allow execution of arbitrary files. Fixed by @AbdrrahimDahmani and @dunglas in commit 04fdc0c.
GHSA-r3xh-3r3w-47gp: Fixed a session leak between requests handled by workers. Fixed by @xavierleune in commit 24d6c99.
GHSA-x9p2-77v6-6vhf: Fixed delayed propagation of security fixes in upstream base Docker images. Fixed by @opctim in commit be2d6b9.
Prevent potential cache pollution issues in CI builds by @dunglas in #2164

🐛 Bug Fixes

Ensure $_SERVER['PHP_SELF'] always starts with a slash by @dunglas in #2172
Let PHP handle HTTP Basic Authorization headers natively by @AlliBalliBaba in #2142
Handle symlinking edge cases correctly by @withinboredom in #1660
Prevent segmentation faults on early shutdown by @AlliBalliBaba in #2120
Fix race condition in thread shutdown during drain by @dunglas in #2182
Worker: Initialize $_REQUEST correctly in worker mode by @xavierleune in #2136
Worker: Reset INI settings and $_SESSION if changed during a worker request by @xavierleune in #2139
Ext: Fix segmentation fault when registering multiple extensions by @y-l-g in #2112
Extgen: Make the generator idempotent and avoid touching the original source by @alexandre-daubois in #2011
Extgen: Correctly handle const blocks to declare iota constants by @alexandre-daubois in #2086
Extgen: Use fast ZPP (Zend Parameter Parsing) by @alexandre-daubois in #2088
Static: Don't overwrite SPC_CMD_VAR_FRANKENPHP_XCADDY_MODULES unconditionally by @henderkes in #2135
Embed: Fix relative paths not being resolved correctly by Static PHP CLI when embedding an app by @henderkes in #2093
Embed: Correct path to Composer's installed.json by @Jellyfrog in #2127

🚀 Performance Improvements

Compile with Go 1.26 (includes 10-40% faster garbage collector and 30% faster CGO calls) by @alexandre-daubois and @dunglas in #2178
Various internal optimizations by @dunglas in #2175

✨ New Features

Packages: Add apk repository for Alpine Linux by @henderkes in #2099

Documentation

Note

Translations are now automated using an LLM.

New Contributors

@Jellyfrog made their first contribution in #2127
@xavierleune made their first contribution in #2138
@damienfern made their first contribution in #1900

Full Changelog: v1.11.1...v1.11.2

v1.11.1

What's Changed

fix: crash when using the logger outside of the a request context by @lobre in #2089
fix: frankenphp_log() level parameter must be optional by @dunglas in #2085
fix(caddy): use default patterns when hot_reload is alone by @dunglas in #2081

New Contributors

@lobre made their first contribution in #2089

Full Changelog: v1.11.0...v1.11.1

v1.11.0

What's Changed

feat: hot reloading for PHP apps and sites by @dunglas in #2031
feat: add frankenphp_log() PHP function to emit structured logs by @raphaelcoeffic in #1979
feat(watcher): support for multiple curly braces by @AlliBalliBaba in #2068
feat(ext): expose IsPacked to help dealing with hashmaps and lists in Go code by @alexandre-daubois in #1977
feat(extgen): add support for callable in parameters by @alexandre-daubois in #1731
perf: improve tail latency with goSched by @AlliBalliBaba in #2033
perf: improve uncommon headers parsing performance by upgrading to Otter v2 by @maxm86545 in #2040
fix(ext)!: returns a zend_array directly in types.go by @AlliBalliBaba in #1894
fix(packages): give /var/lib/frankenphp sys_rw_content_t permissions for mercure.db files by @henderkes in #2037
fix(packages): remove deprecated Mercure "transport_url" directive from Caddyfile by @dunglas in #2065
fix(extgen): use REGISTER(_NS)_BOOL_CONSTANT by @alexandre-daubois in #2047
fix(extgen): use RETURN_EMPTY_STRING() when returning empty string by @alexandre-daubois in #2049

New Contributors

@Arkeins made their first contribution in #2059
@krowinski made their first contribution in #2063
@raphaelcoeffic made their first contribution in #1979

Full Changelog: v1.10.1...v1.11.0

v1.10.1

What's Changed

fix: crash when a string is passed for the topics parameter of the mercure_publish() function by @dunglas in #2021
fix: correctly set the Mercure hub for the main worker request by @dunglas in #2026
chore: bump deps by @dunglas in #2023

Full Changelog: v1.10.0...v1.10.1

v1.10.0

What's Changed

New Features

feat: PHP 8.5 support @vinceAmstoutz and @0x346e3730 in #1932 and #2006
feat: new mercure_publish() PHP function to dispatch Mercure updates by @dunglas in #1927
feat: allow using multiple workers with the same file by @AlliBalliBaba in #1856
feat: per-worker max threads by @AlliBalliBaba in #1962
feat: set a custom Server header by @dunglas in #1959
feat(static): add XSL extension to the static binaries by @dunglas in #1998
feat(ext): allow extensions to register custom worker scripts by @withinboredom and @dunglas in #1795, #1884, #1910, #1914, #1915 and #1952
feat(ext): expose GoValue() and PHPValue() functions by @dunglas in #1877 and #1879
feat(ext): support for the mixed type by @dunglas in #1913
feat(ext): allow creating strongly typed slices and maps from PHP values by @dunglas in #1933

Fixes

fix: catch panics on invalid status code by @AlliBalliBaba in #1920
fix: actually exit when exit() is called in a worker script by @AlliBalliBaba in #1946
fix: fail immediately on missing worker file by @AlliBalliBaba in #1963
fix: release but don't free CLI streams by @SpencerMalone in #1906
fix: added missing decrement for the "ready" WaitGroup counter by @arturmelanchyk in #1890
fix(packages): prevent frankenphp trust from failing in RPM packages #1846 by @henderkes in #1870
fix(packages): add patchelf installation in static-gnu Dockerfile by @kranack in #1899

Misc

refactor: rely on context.Context for log/slog and others by @dunglas in #1969
ci: delegate entirely to Static PHP CLI to build static binaries by @henderkes in #1968
ci: add back ARMv6 build by @dunglas in #1999

New Contributors

@y-l-g made their first contribution in #1849
@florentdrousset made their first contribution in #1882
@arturmelanchyk made their first contribution in #1890
@Slamdunk made their first contribution in #1897
@SpencerMalone made their first contribution in #1906
@kranack made their first contribution in #1899
@michalkleiner made their first contribution in #1935
@Fabsolute made their first contribution in #1991
@0x346e3730 made their first contribution in #2006

Full Changelog: v1.9.1...v1.10.0

v1.9.1

What's Changed

feat(docker): Debian Trixie Docker images by @alexandre-daubois in #1777
feat(static): add memcache and memcached to static build by @henderkes in #1825
fix: don't flush env between requests by @AlliBalliBaba in #1814
fix: free request context if php_request_startup() errors by @AlliBalliBaba in #1842
fix: better error handling in C code by @alexandre-daubois in #1766
fix(caddy): prevent a crash because of an invalid configuration by @WeidiDeng in #1774
fix(ext): support filename other than ext.go and keep local vars on generation by @alexandre-daubois in #1818
fix(ext): better zval handling to avoid leaks with arrays by @alexandre-daubois in #1780
fix(ext) make go arrays more consistent with PHP arrays by @AlliBalliBaba in #1800
fix(ext): register extensions in cli mode by @withinboredom in #1798
fix(packages): add WorkingDirectory in the RedHat package service to make mercure.db file work without absolute paths by @henderkes in #1835
fix(builder): missing iconv extension in the builder Docker image by @henderkes in #1793
chore: upgrade to Caddy 0.20.2 by @alexandre-daubois
chore: upgrade to Go 1.25 by @dunglas in #1811
chore: bump other deps by @alexandre-daubois and @dunglas
perf: cleanup context by @AlliBalliBaba in #1816
docs: add Brazilian Portuguese translation by @adielcristo in #1645
docs: Add Japanese translation for documentation by @demouth in #1740

New Contributors

@dertuxmalwieder made their first contribution in #1765
@WeidiDeng made their first contribution in #1774
@bram-pkg made their first contribution in #1802
@adielcristo made their first contribution in #1645

Full Changelog: v1.9.0...v1.9.1

v1.9.0

What's Changed

feat(extgen): add support for //export_php:namespace by @alexandre-daubois in #1721
feat(extgen): add support for arrays as parameters and return types by @alexandre-daubois in #1724
feat(static): add password-argon2 to static binary by @henderkes in #1732
feat(static): add pdo_sqlsrv extension to static binary by @mano-lis in #1750
fix: allow headers without whitespace after colon. by @AlliBalliBaba in #1741
fix: remove system include locations from frankenphp.go for compatibility with Zig by @henderkes in #1734
fix(caddy): forwards php_server root to try_files by @AlliBalliBaba in #1729
chore: upgrade Mercure to v0.20 by @dunglas in #1751
chore: bump deps by @dunglas in #1746

New Contributors

@mano-lis made their first contribution in #1750

Full Changelog: v1.8.0...v1.9.0