This is a fourth security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official alternative Docker images (Alpine) (our default Docker images based on Debian were already fixed).
Note that our rolling-release channel (*edge*) is recommended for faster security patches.
Bug fixes highlights :
- PHP CVE-2026-109618, CVE-2026-109619 php#2026-10-21-5
This release has been made by @Alkarex, @Frenzie and newcomer @icco
Full changelog:
- Security
- Docker alternative image (Alpine 3.24) updated with PHP 8.5.12 and Apache 2.4.69 #9475
- Docker: disable PHP
session.upload_progress.enabledfor additional security #9476 - I18n
- Improve Dutch #9479
Tracked CVEs
- CVE-2026-109618
- CVE-2026-109619
