Update dunglas/frankenphp Docker tag to v1.12.3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
dunglas/frankenphp (source)	stage	patch	1.12.2-php8-alpine → 1.12.3-php8-alpine

---

Release Notes

php/frankenphp (dunglas/frankenphp)

v1.12.3

Compare Source

This release fixes CVE-2026-45062 (high, CVSS 8.1): unsafe Unicode handling in CGI path splitting let an attacker have a non-.php file executed as PHP via a crafted URL, in any deployment where attacker-controlled file names land on the served filesystem. All users on v1.11.2 through v1.12.2 should upgrade.

It also brings a ~7-8% Hello World throughput bump from a refreshed PGO profile, configurable per-thread request limits, persistent-zval helpers for sharing state across threads, a cross-platform force-kill primitive for stuck PHP threads, correct SCRIPT_NAME / PHP_SELF / PATH_INFO server variables, and a long series of frankenphp extension-init (extgen) generator fixes by @​alexandre-daubois.

Released binaries now carry SLSA build-provenance attestations — verify with gh attestation verify <binary> --owner php or gh attestation verify oci://docker.io/dunglas/frankenphp@sha256:... --owner php.

🔒 Security

• Unsafe Unicode handling in CGI path splitting allowed execution of non-PHP files (GHSA-3g8v-8r37-cgjm / CVE-2026-45062). Reported by @​KC1zs4.

🚀 Features

• Configurable max_requests for PHP threads by @​nicolas-grekas in #​2292
• Persistent-zval helpers (deep-copy zval trees across threads) by @​nicolas-grekas in #​2366
• Cross-platform force-kill primitive for stuck PHP threads by @​nicolas-grekas in #​2365
• Release binaries now ship with SLSA build-provenance attestations by @​dunglas in #​2418

🐛 Fixes

• Set $_SERVER variables SCRIPT_NAME, PHP_SELF, and PATH_INFO correctly by @​henderkes in #​2317
• Fix dead forked pthread_fork children by @​henderkes in #​2332
• Fix upstream BC break on INI_INT() macro by @​zeriyoshi in #​2387
• Caddy: reject invalid split_path at provision time by @​alexandre-daubois in #​2350
• extgen parser hardening by @​alexandre-daubois: better error handling (#​2370), emit warnings to stderr (#​2374), reset iota per const block (#​2375), escape control chars in C string literals (#​2377), extract Go function bodies via go/ast (#​2379), symmetric Go type compatibility check (#​2380)

⚡ Performance and Internal Improvements

• Use PGO to improve FrankenPHP's Go performance (7-8% Hello World throughput) by @​henderkes in #​2361
• perf(extgen): hoist const block regexes out of parser loop by @​alexandre-daubois in #​2378
• refactor: add drain() seam to threadHandler interface by @​nicolas-grekas in #​2367
• refactor(extgen): share signature and parameter parsing helpers by @​alexandre-daubois in #​2376

📝 Documentation

• Improve worker docs, add internals docs by @​dunglas in #​2334
• Add SEO frontmatter, llms.txt, and code-block hygiene by @​dunglas in #​2394
• Fix migration guide menu entry by @​alexandre-daubois in #​2373
• Adjust volume mount path in migrate.md by @​francislavoie in #​2337
• Fix Laravel trusted proxies URL by @​mtmn in #​2359
• Update wording in extensions documentation by @​SpencerMalone in #​2338

💖 New Contributors

• @​zeriyoshi made their first contribution in #​2387
• @​mtmn made their first contribution in #​2359

---

Need help adopting FrankenPHP, hardening a PHP application against issues like CVE-2026-45062, or squeezing more performance out of your workers? Les-Tilleuls.coop — the team behind FrankenPHP — provides professional support, consulting, custom development, and training. Get in touch: contact@les-tilleuls.coop.

Full Changelog: php/frankenphp@v1.12.2...v1.12.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.