fix(security): releease v4.4.7 (#12257)

2026-11-06 13:10:37 -04:00 · 2026-10-21 16:18:27 +02:00
parent b12d1386f3 eeda30719f
commit ff642008f1
7 changed files with 29 additions and 14 deletions
@@ -30,7 +30,8 @@ jobs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Reject releases outside the production branch
-        if: ${{ github.ref_name != 'main' }}
+        # tmp: allow the 4.4.7 security release from fix/v4.4.7
+        if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'fix/v') }}
        run: |
          echo "Stable releases must run from main, not ${{ github.ref_name }}."
          exit 1
@@ -312,6 +312,7 @@ class SyncCdn extends Command
        $install_script_location = "$parent_dir/scripts/install.sh";
        $upgrade_script_location = "$parent_dir/scripts/upgrade.sh";
        $upgrade_postgres_script_location = "$parent_dir/scripts/upgrade-postgres.sh";
+        $patch_script_location = "$parent_dir/scripts/patch.sh";
        $production_env_location = "$parent_dir/.env.production";
        $service_template_location = "$parent_dir/templates/$service_template";
        $versions_location = "$parent_dir/$versions";
@@ -346,6 +347,7 @@ class SyncCdn extends Command
                    $install_script_location => 'json/coolify/install.sh',
                    $upgrade_script_location => 'json/coolify/upgrade.sh',
                    $upgrade_postgres_script_location => 'json/coolify/upgrade-postgres.sh',
+                    $patch_script_location => 'json/coolify/patch.sh',
                    $service_template_location => 'json/coolify/service-templates-latest.json',
                ];
            }
@@ -5,7 +5,7 @@ $sshCommandTimeout = (int) env('SSH_COMMAND_TIMEOUT', 3600);

 return [
    'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.4.6',
+        'version' => env('COOLIFY_VERSION') ?: '4.4.7',
        'helper_version' => '1.0.17',
        'self_hosted' => env('SELF_HOSTED', true),
        'autoupdate' => env('AUTOUPDATE'),
@@ -1,14 +1,15 @@
 # Versions
-# https://hub.docker.com/r/serversideup/php/tags?name=8.4-fpm-nginx-alpine
-# Pinned: v5 moved user bundles to /etc/s6-overlay/user-bundles.d and breaks startup (#12141)
-ARG SERVERSIDEUP_PHP_VERSION=8.4-fpm-nginx-alpine-v4.5.1
+# Temporary: serversideup/php v4.5.1 (8.4-fpm-nginx-alpine) rebuilt on the patched PHP 8.4 release
+ARG SERVERSIDEUP_PHP_IMAGE=ghcr.io/coollabsio/serversideup-php:8.4-fpm-nginx-alpine-v4.5.1-hotfix
 # https://github.com/cloudflare/cloudflared/releases
-ARG CLOUDFLARED_VERSION=2026.7.3
+ARG CLOUDFLARED_VERSION=2026.10.3
 # https://www.postgresql.org/support/versioning/
 # Note: We are using version 18 of the postgres client (while still using postgres 15 for the postgres server) as version 15 has been removed from Alpine 3.23+ https://pkgs.alpinelinux.org/packages?name=postgresql*-client&branch=v3.23&repo=&arch=x86_64&origin=&flagged=&maintainer=
 ARG POSTGRES_VERSION=18
 # https://nginx.org/en/linux_packages.html
 ARG NGINX_VERSION=1.31.2-r1
+# https://nodejs.org/en/about/previous-releases
+ARG NODE_VERSION=24.22.1
 # https://pecl.php.net/package/uv
 ARG PHP_UV_VERSION=0.3.0

@@ -19,7 +20,7 @@ ARG GROUP_ID=9999
 # =================================================================
 # Stage 1: Composer dependencies
 # =================================================================
-FROM serversideup/php:${SERVERSIDEUP_PHP_VERSION} AS base
+FROM ${SERVERSIDEUP_PHP_IMAGE} AS base

 USER root

@@ -49,10 +50,15 @@ RUN --mount=type=cache,target=/tmp/cache \

 USER www-data

+# Temporary: the node:24.22.1 multi-arch manifest is not published yet, pull the per-arch image instead
+FROM amd64/node:${NODE_VERSION}-alpine3.24 AS nodejs-amd64
+FROM arm64v8/node:${NODE_VERSION}-alpine3.24 AS nodejs-arm64
+FROM nodejs-${TARGETARCH} AS nodejs
+
 # =================================================================
 # Stage 2: Frontend assets compilation
 # =================================================================
-FROM node:24-alpine AS static-assets
+FROM nodejs AS static-assets

 WORKDIR /app
 COPY package*.json vite.config.js postcss.config.cjs ./
@@ -69,12 +75,15 @@ FROM quay.io/minio/aistor/mc:RELEASE.2026-09-06T02-44-40Z AS minio-client
 # =================================================================
 # Stage 4: Terminal dependencies (match the production Node.js ABI and libc)
 # =================================================================
-FROM serversideup/php:${SERVERSIDEUP_PHP_VERSION} AS terminal-dependencies
+FROM ${SERVERSIDEUP_PHP_IMAGE} AS terminal-dependencies

 USER root

 RUN apk upgrade && \
-    apk add --no-cache nodejs npm make g++ python3
+    apk add --no-cache make g++ python3
+COPY --from=nodejs /usr/local/bin/node /usr/local/bin/node
+COPY --from=nodejs /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/npm
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm
 COPY docker/coolify-terminal/package*.json /terminal/
 RUN --mount=type=cache,target=/root/.npm \
    npm ci --prefix /terminal && \
@@ -87,7 +96,7 @@ COPY docker/coolify-terminal/terminal-utils.js /terminal/terminal-utils.js
 # =================================================================
 # Final Stage: Production image
 # =================================================================
-FROM serversideup/php:${SERVERSIDEUP_PHP_VERSION}
+FROM ${SERVERSIDEUP_PHP_IMAGE}

 ARG USER_ID
 ARG GROUP_ID
@@ -130,7 +139,7 @@ RUN --mount=type=cache,target=/var/cache/apk \
    apk upgrade && \
    apk add --no-cache \
    postgresql${POSTGRES_VERSION}-client \
-    nodejs \
+    libstdc++ \
    openssh-client \
    git \
    git-lfs \
@@ -189,6 +198,7 @@ COPY --chown=www-data:www-data versions.json ./versions.json
 RUN composer dump-autoload

 # Install terminal WebSocket server dependencies
+COPY --from=nodejs /usr/local/bin/node /usr/local/bin/node
 COPY --from=terminal-dependencies --chown=www-data:www-data /terminal /terminal

 # Configure Nginx and S6 overlay
@@ -1,7 +1,7 @@
 {
    "coolify": {
        "v4": {
-            "version": "4.4.6"
+            "version": "4.4.7"
        },
        "nightly": {
            "version": "4.5-rc.1"
@@ -97,6 +97,7 @@ SH);
        'install.sh',
        'upgrade.sh',
        'upgrade-postgres.sh',
+        ...($environment === 'production' ? ['patch.sh'] : []),
        'service-templates-latest.json',
    ];
    $allTargets = array_map(fn (string $file) => "$targetDirectory/$file", $allBasenames);
@@ -179,6 +180,7 @@ it('purges the CDN files from the Cloudflare cache', function (string $environme
            'install.sh',
            'upgrade.sh',
            'upgrade-postgres.sh',
+            ...($environment === 'production' ? ['patch.sh'] : []),
            'service-templates-latest.json',
        ]))->all());
 })->with([
@@ -1,7 +1,7 @@
 {
    "coolify": {
        "v4": {
-            "version": "4.4.6"
+            "version": "4.4.7"
        },
        "nightly": {
            "version": "4.5-rc.1"