Release notes from frankenphp

v1.12.1

2026-03-17T08:23:10Z

What's Changed

🐛 Bug Fixes

Fix PHP startup errors when ini files contain environment variables by @henderkes in #2252
Fix sigsev on bind permissions denied by @henderkes in #2251

📖 Documentation

Update README for Windows, other minor changes by @dunglas in #2249
Revise bug report template for improved instructions by @dunglas in #2181
Improve hot reload, add missing features by @dunglas in #2261
Sync all translations with the English ones

New Contributors

@github-actions[bot] made their first contribution in #2206

Full Changelog: v1.12.0...v1.12.1

caddy/v1.12.1

2026-03-10T09:49:03Z

Version 1.12.1

v1.12.0

2026-03-10T08:18:54Z

What's Changed

Official, native Windows support has arrived!

This highly anticipated release brings 100% compatibility, Worker Mode, and Hot Reloading to Windows, delivering up to a 3.6x performance boost over traditional Nginx/PHP-FPM setups. Thanks to new compiler capabilities in Go 1.26, FrankenPHP now links directly against official Visual Studio-compiled PHP binaries for ultimate stability and full extension support.

Huge thanks to Intelligence X and Les-Tilleuls.coop for sponsoring this milestone.

Learn more about the story of the Windows port in this dedicated blog post.

This version also includes some performance optimizations and Caddy 2.11.2.

✨ New Features

Windows support by @dunglas, @henderkes and many other contributors in #2119, #2227 and #2228
Add configurable max_idle_time for autoscaled threads by @firecow in #2225

🚀 Performance Improvements

Move sandboxed environment to the C side by @AlliBalliBaba in #2058
Refactor CGI strings creation by @AlliBalliBaba in #2188
Use ldflags to set Server header by @dunglas in #2221

📖 Documentation

Spanish translation by @PhilDaiguille in #2096
Improved hardened Docker image by @AlliBalliBaba in #2229
Contributing on Windows by @dunglas in #2222

New Contributors

@PhilDaiguille made their first contribution in #2096
@firecow made their first contribution in #2225

Full Changelog: v1.11.3...v1.12.0

caddy/v1.12.0

2026-03-06T15:48:45Z

Version 1.12.0

v1.11.3

2026-03-06T02:04:53Z

This release restores application stability by reverting the unreliable worker mode INI reset introduced in version 1.11.2, upgrades Caddy to 2.11, and bumps the PHP version included in static binaries to PHP 8.5 to deliver new language features and performance gains, though the MS SQL Server and memcache extensions have been temporarily removed due to 8.5 incompatibility.

What's Changed

🐛 Bug Fixes

Worker: Revert ini reset, keep session fixes (#2139) by @dunglas in #2217
Worker: Always ignore user abort by @AlliBalliBaba in #2189
Metrics: Only report workers ready when actually ready by @withinboredom in #2210
Embed: Fix relative embed paths support by @henderkes in #2199
Fix nomercure tag usage by @tehmaestro in #2212

✨ New Features

Upgrade to Caddy v2.11 by @henderkes in #2214
Update static binaries PHP version to 8.5 by @henderkes in #2168
Packages: Add restart policies to FrankenPHP systemd service by @henderkes in #2191
Embed: Allow to customize the extraction path by @dunglas in #2198

Documentation

Document the extension workers API by @y-l-g in #2055

New Contributors

@tehmaestro made their first contribution in #2212

Full Changelog: v1.11.2...v1.11.3

caddy/v1.11.3

2026-02-23T15:47:48Z

Version 1.11.3

v1.11.2

2026-02-20T01:47:49Z

Important

Security Update: This release addresses three security vulnerabilities, including a critical path confusion issue allowing arbitrary file execution and a session leak in worker mode. Immediate upgrade is strongly recommended.

Beyond security, this release delivers significant performance improvements by upgrading the compiler to Go 1.26. Users can expect a 10-40% faster Garbage Collector and ~30% faster CGO calls, resulting in significantly reduced latency for PHP applications.

We have also improved stability by addressing race conditions during shutdown, resolving segmentation faults in edge cases (such as early shutdown or specific extension registrations), and refining the handling of $_SERVER and HTTP Basic Auth.

What's Changed

🛡️ Security Fixes

GHSA-g966-83w7-6w38: Path confusion via Unicode casing in CGI path splitting could allow execution of arbitrary files. Fixed by @AbdrrahimDahmani and @dunglas in commit 04fdc0c.
GHSA-r3xh-3r3w-47gp: Fixed a session leak between requests handled by workers. Fixed by @xavierleune in commit 24d6c99.
GHSA-x9p2-77v6-6vhf: Fixed delayed propagation of security fixes in upstream base Docker images. Fixed by @opctim in commit be2d6b9.
Prevent potential cache pollution issues in CI builds by @dunglas in #2164

🐛 Bug Fixes

Ensure $_SERVER['PHP_SELF'] always starts with a slash by @dunglas in #2172
Let PHP handle HTTP Basic Authorization headers natively by @AlliBalliBaba in #2142
Handle symlinking edge cases correctly by @withinboredom in #1660
Prevent segmentation faults on early shutdown by @AlliBalliBaba in #2120
Fix race condition in thread shutdown during drain by @dunglas in #2182
Worker: Initialize $_REQUEST correctly in worker mode by @xavierleune in #2136
Worker: Reset INI settings and $_SESSION if changed during a worker request by @xavierleune in #2139
Ext: Fix segmentation fault when registering multiple extensions by @y-l-g in #2112
Extgen: Make the generator idempotent and avoid touching the original source by @alexandre-daubois in #2011
Extgen: Correctly handle const blocks to declare iota constants by @alexandre-daubois in #2086
Extgen: Use fast ZPP (Zend Parameter Parsing) by @alexandre-daubois in #2088
Static: Don't overwrite SPC_CMD_VAR_FRANKENPHP_XCADDY_MODULES unconditionally by @henderkes in #2135
Embed: Fix relative paths not being resolved correctly by Static PHP CLI when embedding an app by @henderkes in #2093
Embed: Correct path to Composer's installed.json by @Jellyfrog in #2127

🚀 Performance Improvements

Compile with Go 1.26 (includes 10-40% faster garbage collector and 30% faster CGO calls) by @alexandre-daubois and @dunglas in #2178
Various internal optimizations by @dunglas in #2175

✨ New Features

Packages: Add apk repository for Alpine Linux by @henderkes in #2099

Documentation

Note

Translations are now automated using an LLM.

New Contributors

@Jellyfrog made their first contribution in #2127
@xavierleune made their first contribution in #2138
@damienfern made their first contribution in #1900

Full Changelog: v1.11.1...v1.11.2

caddy/v1.11.2

2026-02-12T09:58:03Z

Version 1.11.2

v1.11.1

2026-02-12T02:23:58Z

What's Changed

fix: crash when using the logger outside of the a request context by @lobre in #2089
fix: frankenphp_log() level parameter must be optional by @dunglas in #2085
fix(caddy): use default patterns when hot_reload is alone by @dunglas in #2081

New Contributors

@lobre made their first contribution in #2089

Full Changelog: v1.11.0...v1.11.1

caddy/v1.11.1

2025-12-20T08:16:24Z

Version 1.11.1