Docker Laravel v3.0.0

Breaking changes

• PHP 8.5: Applications must update Composer dependencies whose PHP constraints exclude PHP 8.5.
• Fail-fast entrypoint: Composer, npm, Artisan, migration, synchronous seeding, and other setup failures now stop the build or container immediately.
• Deterministic production builds: Build mode uses composer install --no-dev --optimize-autoloader and npm ci. Compatible Composer and npm lock files are required.
• Seeder behavior: ONSTART_SEEDER_WAIT now defaults to true, so seeder failures stop startup by default.
• Custom entrypoints: /entrypoint.sh now receives the container command and all arguments through "$@".
• Healthcheck: The internal NGINX health endpoint has moved to http://127.0.0.1:8081/healthz.

See the v2 to v3 upgrade guide before updating an existing application.

Runtime updates

• Alpine Linux 3.23
• NGINX 1.31
• PHP and PHP-FPM 8.5
• Composer 2.10.2
• Node.js 24.15
• npm 11

Improvements

• Added safe build-only Laravel defaults for cache, sessions, queues, and database connections.
• Composer dependencies are installed deterministically during every derived-image build.
• Custom entrypoint commands and arguments are forwarded correctly.
• Queue workers no longer start without an asynchronous queue connection.
• Inertia SSR retains Node.js runtime dependencies only when explicitly enabled.
• Added local base-image and derived-Laravel regression tests, including repeatable parallel builds.
• Added a Trivy scan for high and critical vulnerabilities to GitHub Actions.

Security

• NGINX version tokens are disabled globally.
• PHP version exposure and the X-Powered-By response header are disabled globally.
• cgi.fix_pathinfo is disabled.
• The healthcheck is isolated from replaceable application NGINX configurations.
• The release image passes the configured Trivy scan with no high or critical findings.

Full details are available in the changelog.