From 98bea7aab763650e5bd232592f99a3e02fdb5ad4 Mon Sep 17 00:00:00 2001
From: Jay Rogers <jaydrogers@users.noreply.serversideup.net>
Date: Thu, 5 Nov 2026 15:28:29 +0000
Subject: [PATCH] Upgrade FrankenPHP to 1.13.5 and match upstream's runtime
 image

FrankenPHP 1.13.5 is a security release covering 17 advisories, including
GHSA-j99q-3wr8-xj43, and ships Caddy 2.11.9. Upstream's Dockerfiles, Go, and
watcher versions are unchanged.

Set GODEBUG=cgocheck=0 and install mailcap in the final image, as upstream
does. Without /etc/mime.types, Caddy served fonts and other static files
with a sniffed content type.
---
 docs/content/data/env-vars.yml                 | 8 ++++++++
 scripts/conf/php-versions-base-config.yml      | 2 +-
 scripts/tests/image/fixtures/public/font.woff2 | 1 +
 scripts/tests/image/frankenphp.sh              | 8 ++++++++
 src/variations/frankenphp/Dockerfile           | 5 +++--
 5 files changed, 21 insertions(+), 3 deletions(-)
 create mode 100644 scripts/tests/image/fixtures/public/font.woff2

diff --git a/docs/content/data/env-vars.yml b/docs/content/data/env-vars.yml
index e2b70780..92e8f6b6 100644
--- a/docs/content/data/env-vars.yml
+++ b/docs/content/data/env-vars.yml
@@ -378,6 +378,14 @@ variables:
     reference:
       label: frankenphp
       url: https://frankenphp.dev/docs/config/#caddyfile-config
+  - name: GODEBUG
+    default: "cgocheck=0"
+    variations:
+      - frankenphp
+    description: Go runtime settings for FrankenPHP. `cgocheck=0` skips Go's pointer checks on every call into PHP, like the official FrankenPHP images.
+    reference:
+      label: GODEBUG
+      url: https://go.dev/doc/godebug
   - name: HEALTHCHECK_PATH
     default: "/healthcheck"
     variations:
diff --git a/scripts/conf/php-versions-base-config.yml b/scripts/conf/php-versions-base-config.yml
index f01ef9a9..da1765c7 100644
--- a/scripts/conf/php-versions-base-config.yml
+++ b/scripts/conf/php-versions-base-config.yml
@@ -19,7 +19,7 @@ dependencies:
   # renovate: datasource=github-releases depName=renatomefi/php-fpm-healthcheck
   PHP_FPM_HEALTHCHECK_VERSION: v0.6.0
   # renovate: datasource=github-releases depName=php/frankenphp
-  FRANKENPHP_VERSION: 1.13.4
+  FRANKENPHP_VERSION: 1.13.5
   # Go and watcher follow FrankenPHP rather than their own releases, so bump them in the
   # same pull request as FRANKENPHP_VERSION. Go matches GO_VERSION in FrankenPHP's
   # docker-bake.hcl at that tag. FrankenPHP downloads the latest watcher release when it
diff --git a/scripts/tests/image/fixtures/public/font.woff2 b/scripts/tests/image/fixtures/public/font.woff2
new file mode 100644
index 00000000..0077df5e
--- /dev/null
+++ b/scripts/tests/image/fixtures/public/font.woff2
@@ -0,0 +1 @@
+serversideup-php-font
diff --git a/scripts/tests/image/frankenphp.sh b/scripts/tests/image/frankenphp.sh
index 975d6f62..5fad03b3 100644
--- a/scripts/tests/image/frankenphp.sh
+++ b/scripts/tests/image/frankenphp.sh
@@ -23,3 +23,11 @@ test_starts_with_every_caddy_auto_https_value() {
         expect_body --https / "serversideup-php-ok:${php_version}"
     done
 }
+
+# Caddy reads MIME types from /etc/mime.types (mailcap). Without it, Go's small built-in
+# table has no entry for fonts, so browsers get a sniffed type and may refuse to load them.
+test_serves_static_files_with_their_mime_type() {
+    local content_type
+    content_type=$(curl --silent --max-time 5 --output /dev/null --write-out '%{content_type}' "http://127.0.0.1:${host_port}/font.woff2" || true)
+    [ "$content_type" = "font/woff2" ] || fail "Expected /font.woff2 to be served as font/woff2, got ${content_type:-<empty>}"
+}
diff --git a/src/variations/frankenphp/Dockerfile b/src/variations/frankenphp/Dockerfile
index b4b0b910..31eb9be0 100644
--- a/src/variations/frankenphp/Dockerfile
+++ b/src/variations/frankenphp/Dockerfile
@@ -69,7 +69,6 @@ ARG BUILD_DEPENDENCY_PACKAGES_ALPINE="\
     libstdc++ \
     libxml2-dev \
     linux-headers \
-    mailcap \
     oniguruma-dev \
     openssl-dev \
     readline-dev \
@@ -88,7 +87,6 @@ ARG BUILD_DEPENDENCY_PACKAGES_DEBIAN="\
     libsqlite3-dev \
     libssl-dev \
     libxml2-dev \
-    mailcap \
     zlib1g-dev"
 
 COPY --from=golang-image /usr/local/go /usr/local/go
@@ -160,9 +158,11 @@ RUN if cat /etc/os-release | grep -q 'debian'; then \
 FROM common AS final
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     libstdc++ \
+    mailcap \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
     libstdc++6 \
+    mailcap \
     procps \
     zip"
 ARG DEPENDENCY_PHP_EXTENSIONS='opcache pcntl pdo_mysql pdo_pgsql redis zip'
@@ -204,6 +204,7 @@ LABEL org.opencontainers.image.title="serversideup/php (frankenphp)" \
     COMPOSER_MAX_PARALLEL_HTTP=24 \
     DISABLE_DEFAULT_CONFIG=false \
     FRANKENPHP_CONFIG="" \
+    GODEBUG="cgocheck=0" \
     LOG_OUTPUT_LEVEL=info \
     HEALTHCHECK_PATH="/healthcheck" \
     PHP_DATE_TIMEZONE="UTC" \