Publish the image on demand after PHP security releases; turn off session upload progress (CVE-2026-109618/109619) (#867)

* ci,docker: allow a manual image rebuild, and turn off session upload progress

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, which allow
unauthenticated remote code execution with Apache mod_php. The images are rebuilt on Sundays only,
so a maintainer needs a way to publish a rebuild right after a base image security release:
add workflow_dispatch to the Docker workflow.

The second advisory also names the session upload progress feature as a way to reach the
vulnerable path. LibreSpeed does not use it, so it is turned off in the image.

* ci: always pull the base image when building

A rebuild after a security release of the php or alpine image should not reuse a cached
older base (the job uses cache-from type=gha).

.github/workflows/docker-publish.yml

@@ -8,6 +8,9 @@ name: Docker
 on:
   schedule:
     - cron: '30 20 * * Sun'
+  # Lets a maintainer rebuild and publish the images right after a security release of the
+  # php or alpine base image (Actions > Docker > Run workflow), instead of waiting for Sunday.
+  workflow_dispatch:
   push:
     branches: ["*"]
     # Publish semver tags as releases.
@@ -129,6 +132,9 @@ jobs:
           file: ${{ matrix.dockerfile }}
           platforms: linux/amd64,linux/arm64,linux/arm/v7
           push: ${{ github.event_name != 'pull_request' }}
+          # Always fetch the base image again, so a rebuild after a security release of php or alpine
+          # does not reuse a cached older base
+          pull: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha

docker/librespeed-php.ini

@@ -3,3 +3,9 @@
 ; empty.php can send its headers. 32M leaves modest headroom.
 
 post_max_size = 32M
+
+; LibreSpeed does not use the session upload progress feature, and PHP's advisory
+; for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) names it as a way to reach the
+; vulnerable code path, recommending it be off if it is not needed. Updating PHP is
+; the real fix; this only removes a feature nobody here uses.
+session.upload_progress.enabled = 0