fix(docker): PHP 镜像升级至 swoole-8.4.27 修复 CVE-2026-109618/109619

.github/workflows/tests.yml

@@ -66,7 +66,7 @@ jobs:
       - name: Run PHPUnit in DooTask PHP image
         run: |
           docker run --rm --network host -v "$GITHUB_WORKSPACE":/var/www -w /var/www \
-            kuaifan/php:swoole-8.4 sh -c '
+            kuaifan/php:swoole-8.4.27 sh -c '
               composer install --prefer-dist --no-interaction &&
               cp .env.example .env &&
               sed -i "s/^DB_HOST=.*/DB_HOST=127.0.0.1/" .env &&

docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   php:
     container_name: "dootask-php-${APP_ID}"
-    image: "kuaifan/php:swoole-8.4"
+    image: "kuaifan/php:swoole-8.4.27"
     shm_size: 2G
     ulimits:
       core:

docker/php/php.ini

@@ -1518,7 +1518,8 @@ session.sid_bits_per_character = 5
 ; Development Value: On
 ; Production Value: On
 ; http://php.net/session.upload-progress.enabled
-;session.upload_progress.enabled = On
+; 关闭以缓解 CVE-2026-109619（项目使用 Laravel session，不依赖此功能）
+session.upload_progress.enabled = Off
 
 ; Cleanup the progress information as soon as all POST data has been read
 ; (i.e. upload completed).