Repository navigation
Upgrade FrankenPHP to v1.13.1 and skip compression for the Mercure hub - #718
Merged
Merged
Conversation
Contributor
Images for PR #718
Try it: docker run --rm -v "$PWD:/var/www/html" -p 8080:8080 serversideup/php-dev:718-8.5-fpm-nginxEvery image is on Docker Hub as All images with sizesSizes are compressed, per architecture.
Updated on every push to this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrades the FrankenPHP variation to v1.13.1, which fixes the regressions reported against 1.13.0 (#715). It also stops the Caddyfile from compressing the Mercure hub, matching the fix upstream made in their sample Caddyfile in the same release.
Why
1.13.0 broke several things that our users can run into:
fastcgi_finish_request()over HTTP/2 could crash the process. PHP's shutdown read the request body after the handler had returned (#2694). This is the same path as v5.0.0-beta3 FrankenPHP crashes on HTTP/2 when PHP keeps running after fastcgi_finish_request() #712.php-clipassed the wrong$argv, which broke Symfony Console and other tools that read it (#2690).Mercure is no longer compressed
Caddy 2.11.7, which shipped with FrankenPHP 1.13.0, now compresses server-sent events. Our
php-app-commonblock runsencode zstd br gzipon every path. WithMERCURE_ENABLED=true, each subscriber held its own compression encoder (a few MiB each with zstd). Compressing private updates next to data an attacker can influence also opens the door to BREACH-style attacks. This PR uses the same matcher as upstream's fix in #2692:Everything other than the hub is still compressed.
A failed extension install now fails the build
The first CI run on this PR published FrankenPHP images without
redisandzip. pecl.php.net returned504 Gateway Timeoutwhile the build was downloadingredis. The lastRUNstep of the FrankenPHP Dockerfile joined its commands with;, so the build ignored the failed install and saved the image anyway. The cli, fpm, fpm-apache, and fpm-nginx Dockerfiles already fail on this.That step now chains its commands with
&&like the other variations. This bug dates back to64ed90d(August 2025). The newscripts/test-image.shextension check is what caught it.Changes
src/variations/frankenphp/Dockerfile:FRANKENPHP_VERSIONgoes from1.13.0to1.13.1.GOLANG_VERSIONstays at1.27, which matchesGO_VERSIONin upstream'sdocker-bake.hclat thev1.13.1tag. The finalRUNstep uses&&instead of;.src/variations/frankenphp/etc/frankenphp/Caddyfile: skipencodefor/.well-known/mercure.How to test
scripts/dev.sh --variation frankenphp --version 8.4 --os bookwormscripts/test-image.shagainst it.docker run --rm serversideup/php:8.4-frankenphp-bookworm frankenphp versionreportsFrankenPHP v1.13.1.MERCURE_ENABLED=true, request/.well-known/mercurewithAccept-Encoding: zstd, br, gzipand confirm the response has noContent-Encodingheader, while/is still compressed.Notes for reviewers
CI is the first full build and test of this change. The local build stalled on package downloads and didn't finish.