Skip to content

Repository navigation

v1.2.2

Choose a tag to compare

View all tags
@LucaGiardi20 LucaGiardi20 released this 22 Oct 08:53
· 341 commits to main since this release
v1.2.2
f963a88
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Released 2026-10-22 from release/1.2.2 (PR #250).

Security patch release. It ships the Docker hardening for the critical PHP RCEs CVE-2026-109618 / CVE-2026-109619. Read the security notice for impact and mitigations.

Security

  • Official Docker image built on php:8.4.27-fpm-bookworm, with a hardened php.ini (session.upload_progress.enabled=0, session.use_strict_mode=1, body/multipart limits matching nginx 100M). Composer php constraint raised to ^8.4.27 (#216, #248)
  • AI collection-import webhook: timing-safe HMAC-SHA256 over the raw body (hash_equals), fail-closed when AI_WEBHOOK_TOKEN is unset outside local, and 401 on mismatch (#185, #214)

Fixed

  • externa:install keeps or generates APP_KEY, migrates the minimal profile without Redis, and can be re-run with --force (#245, #249)

Upgrade notes

  • Docker: pull ghcr.io/qiick-io/externa-core:1.2.2 (or latest). Source installs: run PHP 8.4.27+ (or 8.5.12+) and disable session.upload_progress.
  • Webhook signers must sign the raw request body only (sha256= + HMAC-SHA256). Set AI_WEBHOOK_TOKEN in every non-local environment. Invalid signatures now return 401 (was 403).

Full changelog: CHANGELOG.md · Docs: https://docs.externa.qiick.io/

Assets 2
Loading