2.9.12

Security update: PHP 8.3.36

Upgrade Server 2.9 installations to 2.9.12. This release fixes the published image's exposure to CVE-2026-109618 and CVE-2026-109619 by building the signed PHP 8.3.36 release. See the PHP advisory and Server #591.

Pin either registry to the immutable multi-platform index:

durableworkflow/server@sha256:8ab0fa04a0e00f34e5a6054937dcfb26012772c635d354a814f71d0bd934f15e
ghcr.io/durable-workflow/server@sha256:8ab0fa04a0e00f34e5a6054937dcfb26012772c635d354a814f71d0bd934f15e

Source 471c8fad733a5ee89b66a9abfd897656c7fb4555. amd64 child 015a0eb291e23976cea487b5e18d0b374ae70ed60f51ef243d8360c7c4cd7e29; arm64 child f3b7337c9ff53797dcbf0b3c6d9b9b9d02430aa360a08aba8c7d4f21778aefb4.

The narrow backport retains Core 2.8.0, dependencies, application/schema and existing chart bytes from 2.9.11. Only the 2.9 image alias advances. It retains finite 64 MiB POST/upload limits, disabled session upload progress and disabled automatic POST parsing; the existing JSON request limit remains enforced.

Protected publication passes exact identity, readiness, Compose, database TLS and refusal checks. Independent amd64 CLI/Apache, 64 MiB binary transport, request refusals and normal PHP SDK workflow/activity checks pass. Exact acceptance and remaining scope. Historical version tags are unchanged.

What's Changed

• fix: backport the critical PHP image correction to Server 2.9.12 by @rmcdaniel in #603

Full Changelog: 2.9.11...2.9.12