2.10.1

Security update: PHP 8.3.36

Upgrade Server 2.10 installations to 2.10.1. The published PHP image uses signed PHP 8.3.36, addressing CVE-2026-109618 and CVE-2026-109619. See the PHP advisory and Server #591. Finite 64 MiB POST/upload limits, disabled session upload progress and disabled automatic POST parsing remain enabled; the existing JSON request limit remains enforced.

Immutable multi-platform index, available from Docker Hub and GHCR:

durableworkflow/server@sha256:4a1819ec6fed7d7bbbadfbc302251f37a226622c99f8950887f2bed5895f83df
ghcr.io/durable-workflow/server@sha256:4a1819ec6fed7d7bbbadfbc302251f37a226622c99f8950887f2bed5895f83df

Source 7a02bbcec4d0f2c470d7556632da9f4d5d15b522; Core 2.9.0 / 2bc1ba0b57df34b74de02427d2225bd8e4dc6322. amd64 child 184bc1ddf2f2776d8025a0fe1818a977d341d5eb3019148d15d0ede1538a0d46; arm64 child 6b0e948ad72af39bbe9d5cb008a6004622004ffe58fed50c84c724c52f3812ca.

The protected image publication passes exact identity, readiness, source-free Compose, database TLS/certificate refusals and alias verification. Independent amd64 CLI/Apache, 64 MiB binary transport/refusals and all six default/named selection originals with normal PHP, Python and Rust packages pass. Full installed-image acceptance. The separate Helm chart 0.2.3 is now published at oci://ghcr.io/durable-workflow/charts/durable-workflow, with appVersion: 2.10.1; its protected anonymous-pull and clean-client install checks pass. An independent anonymous download verifies chart content SHA-256 8392a082c368c02ce2120f86ba08c42c2082cbfa8a3ef9b4dbb1e918df9dd45d. The first cold-build publication failed and remains recorded; no version tag was moved.

For a run blocked by the old select-member cancellation refusal, inspect its history, upgrade, then use the selected-run repair procedure with the original namespace/run identity. Upgrading does not automatically repair it or undo an activity that already executed.

This release also preserves authored select-member cancellation through worker HTTP validation (#583/#585). Native source changes in the generated changelog remain separately qualified source work; this PHP image release does not advertise a native capability or cutover.

What's Changed

• Native takeover: refuse PHP schedules native cannot run yet by @rmcdaniel in #568
• Admit signals before any worker declares a contract, as PHP does by @rmcdaniel in #572
• Run PHP schedule specifications, policies and namespaces natively by @rmcdaniel in #570
• Native schedule list, update and backfill by @rmcdaniel in #573
• Lease a workflow task for PHP's configured 60 seconds by @rmcdaniel in #565
• Native starts without timeouts get no deadline by @rmcdaniel in #574
• Fix main's database parity jobs after #570 and #572 by @rmcdaniel in #576
• Native Waterline reads: run debug view, task queues, streams and list filters by @rmcdaniel in #575
• Project run summaries for open schedule-started runs by @rmcdaniel in #582
• Native operator dashboard, so Waterline's landing page loads by @rmcdaniel in #584
• Native times out runs past an explicit deadline like PHP by @rmcdaniel in #581
• Native describe actions, run list and debug envelope like PHP by @rmcdaniel in #578
• Native accepts PHP's workflow start requests; dw workflow:start works by @rmcdaniel in #588
• Give the optimized native build 4 GiB; show its log on failure by @rmcdaniel in #586
• Native accepts the CLI's signal, update and empty command bodies like PHP by @rmcdaniel in #592
• Native history export bundle, so dw workflow:history-export and Waterline's export work by @rmcdaniel in #594
• Native query responses, admission order and routing refusals like PHP by @rmcdaniel in #580
• Serve operator metrics and health natively by @rmcdaniel in #562
• Rust server: prune expired run history like published PHP by @rmcdaniel in #595
• Require patched PHP images and deliver selection cancellation by @rmcdaniel in #593
• Preserve select member cancellation through worker HTTP validation by @rmcdaniel in #585

Full Changelog: 2.10.0...2.10.1