[RobertDWhite]

The current master Dockerfile installs PHP 8.4 without a security floor, and session upload progress remains enabled. This adds a build-time requirement for PHP 8.4.27 or newer and disables session upload progress in the PHP 8.4 conf.d directory, following PHP's October 23 advisory. The existing database test matrix now checks both properties in the running container.

Related to #480. This complements the pending patched-image release; it does not resolve Wallabag's broader PHP compatibility work or replace a new published image. It does not change the release workflow discussed in #481.

Reference: https://www.php.net/archive/2026.php (October 21 critical fixes and October 23 follow-up advisory).

Validation: Python test syntax and git diff checks pass. Full image builds and database integration tests require CI; they have not been run locally.

[Kdecherf]

Hello @RobertDWhite,

I don't see the value of adding a build-time requirement of a minimal php version like this as we rely on the distribution for the packages.

Regarding the third PHP vulnerability yet to be patched and tracked under CVE-2026-115560, we don't default the serialize handler to php_binary nor php_serialize therefore we are not impacted by this vector.