Bot Updating Package Versions

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.20
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.22
 
 # set version label
 ARG BUILD_DATE
@@ -12,13 +12,13 @@ LABEL maintainer="aptalca"
 RUN \
   echo "**** install runtime packages ****" && \
   apk add --no-cache \
-    php83-dom \
+    php84-dom \
-    php83-intl \
+    php84-intl \
-    php83-opcache \
+    php84-opcache \
-    php83-pdo_mysql \
+    php84-pdo_mysql \
-    php83-pdo_pgsql \
+    php84-pdo_pgsql \
-    php83-pdo_sqlite \
+    php84-pdo_sqlite \
-    php83-tokenizer && \
+    php84-tokenizer && \
   echo "**** configure nginx ****" && \
   echo 'fastcgi_param  PHP_AUTH_USER      $remote_user; # Heimdall user authorization' >> \
     /etc/nginx/fastcgi_params && \
@@ -26,7 +26,11 @@ RUN \
     /etc/nginx/fastcgi_params && \
   echo "**** configure php opcache ****" && \
   echo 'opcache.validate_timestamps=0' >> \
-    /etc/php83/conf.d/00_opcache.ini && \
+    /etc/php84/conf.d/00_opcache.ini && \
+  echo "**** configure php-fpm to pass env vars ****" && \
+  sed -E -i 's/^;?clear_env ?=.*$/clear_env = no/g' /etc/php84/php-fpm.d/www.conf && \
+  if ! grep -qxF 'clear_env = no' /etc/php84/php-fpm.d/www.conf; then echo 'clear_env = no' >> /etc/php84/php-fpm.d/www.conf; fi && \
+  echo "env[PATH] = /usr/local/bin:/usr/bin:/bin" >> /etc/php84/php-fpm.conf && \
   echo "**** install heimdall ****" && \
   mkdir -p \
     /heimdall && \

Dockerfile.aarch64

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.20
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.22
 
 # set version label
 ARG BUILD_DATE
@@ -12,13 +12,13 @@ LABEL maintainer="aptalca"
 RUN \
   echo "**** install runtime packages ****" && \
   apk add --no-cache \
-    php83-dom \
+    php84-dom \
-    php83-intl \
+    php84-intl \
-    php83-opcache \
+    php84-opcache \
-    php83-pdo_mysql \
+    php84-pdo_mysql \
-    php83-pdo_pgsql \
+    php84-pdo_pgsql \
-    php83-pdo_sqlite \
+    php84-pdo_sqlite \
-    php83-tokenizer && \
+    php84-tokenizer && \
   echo "**** configure nginx ****" && \
   echo 'fastcgi_param  PHP_AUTH_USER      $remote_user; # Heimdall user authorization' >> \
     /etc/nginx/fastcgi_params && \
@@ -26,7 +26,11 @@ RUN \
     /etc/nginx/fastcgi_params && \
   echo "**** configure php opcache ****" && \
   echo 'opcache.validate_timestamps=0' >> \
-    /etc/php83/conf.d/00_opcache.ini && \
+    /etc/php84/conf.d/00_opcache.ini && \
+  echo "**** configure php-fpm to pass env vars ****" && \
+  sed -E -i 's/^;?clear_env ?=.*$/clear_env = no/g' /etc/php84/php-fpm.d/www.conf && \
+  if ! grep -qxF 'clear_env = no' /etc/php84/php-fpm.d/www.conf; then echo 'clear_env = no' >> /etc/php84/php-fpm.d/www.conf; fi && \
+  echo "env[PATH] = /usr/local/bin:/usr/bin:/bin" >> /etc/php84/php-fpm.conf && \
   echo "**** install heimdall ****" && \
   mkdir -p \
     /heimdall && \

Jenkinsfile

@@ -218,6 +218,7 @@ pipeline {
           env.META_TAG = 'development-' + env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
           env.EXT_RELEASE_TAG = 'development-version-' + env.EXT_RELEASE_CLEAN
           env.BUILDCACHE = 'docker.io/lsiodev/buildcache,registry.gitlab.com/linuxserver.io/docker-jenkins-builder/lsiodev-buildcache,ghcr.io/linuxserver/lsiodev-buildcache,quay.io/linuxserver.io/lsiodev-buildcache'
+          env.CITEST_IMAGETAG = 'latest'
         }
       }
     }
@@ -243,6 +244,7 @@ pipeline {
           env.EXT_RELEASE_TAG = 'development-version-' + env.EXT_RELEASE_CLEAN
           env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DEV_DOCKERHUB_IMAGE + '/tags/'
           env.BUILDCACHE = 'docker.io/lsiodev/buildcache,registry.gitlab.com/linuxserver.io/docker-jenkins-builder/lsiodev-buildcache,ghcr.io/linuxserver/lsiodev-buildcache,quay.io/linuxserver.io/lsiodev-buildcache'
+          env.CITEST_IMAGETAG = 'develop'
         }
       }
     }
@@ -268,6 +270,7 @@ pipeline {
           env.CODE_URL = 'https://github.com/' + env.LS_USER + '/' + env.LS_REPO + '/pull/' + env.PULL_REQUEST
           env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.PR_DOCKERHUB_IMAGE + '/tags/'
           env.BUILDCACHE = 'docker.io/lsiodev/buildcache,registry.gitlab.com/linuxserver.io/docker-jenkins-builder/lsiodev-buildcache,ghcr.io/linuxserver/lsiodev-buildcache,quay.io/linuxserver.io/lsiodev-buildcache'
+          env.CITEST_IMAGETAG = 'develop'
         }
       }
     }
@@ -290,7 +293,7 @@ pipeline {
                   -v ${WORKSPACE}:/mnt \
                   -e AWS_ACCESS_KEY_ID=\"${S3_KEY}\" \
                   -e AWS_SECRET_ACCESS_KEY=\"${S3_SECRET}\" \
-                  ghcr.io/linuxserver/baseimage-alpine:3.20 s6-envdir -fn -- /var/run/s6/container_environment /bin/bash -c "\
+                  ghcr.io/linuxserver/baseimage-alpine:3.23 s6-envdir -fn -- /var/run/s6/container_environment /bin/bash -c "\
                     apk add --no-cache python3 && \
                     python3 -m venv /lsiopy && \
                     pip install --no-cache-dir -U pip && \
@@ -625,13 +628,16 @@ pipeline {
                     echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                     echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
                     echo $QUAYPASS | docker login quay.io -u $QUAYUSER --password-stdin
+
                     if [[ "${PACKAGE_CHECK}" != "true" ]]; then
+                      declare -A pids
                       IFS=',' read -ra CACHE <<< "$BUILDCACHE"
                       for i in "${CACHE[@]}"; do
                         docker push ${i}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} &
+                        pids[$!]="$i"
                       done
-                      for p in $(jobs -p); do
+                      for p in "${!pids[@]}"; do
-                        wait "$p" || { echo "job $p failed" >&2; exit 1; }
+                        wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* ]] && exit 1; }
                       done
                     fi
                 '''
@@ -691,13 +697,16 @@ pipeline {
                         echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                         echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
                         echo $QUAYPASS | docker login quay.io -u $QUAYUSER --password-stdin
+
                         if [[ "${PACKAGE_CHECK}" != "true" ]]; then
+                          declare -A pids
                           IFS=',' read -ra CACHE <<< "$BUILDCACHE"
                           for i in "${CACHE[@]}"; do
                             docker push ${i}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} &
+                            pids[$!]="$i"
                           done
-                          for p in $(jobs -p); do
+                          for p in "${!pids[@]}"; do
-                            wait "$p" || { echo "job $p failed" >&2; exit 1; }
+                            wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* ]] && exit 1; }
                           done
                         fi
                     '''
@@ -751,12 +760,14 @@ pipeline {
                         echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
                         echo $QUAYPASS | docker login quay.io -u $QUAYUSER --password-stdin
                         if [[ "${PACKAGE_CHECK}" != "true" ]]; then
+                          declare -A pids
                           IFS=',' read -ra CACHE <<< "$BUILDCACHE"
                           for i in "${CACHE[@]}"; do
                             docker push ${i}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} &
+                            pids[$!]="$i"
                           done
-                          for p in $(jobs -p); do
+                          for p in "${!pids[@]}"; do
-                            wait "$p" || { echo "job $p failed" >&2; exit 1; }
+                            wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* ]] && exit 1; }
                           done
                         fi
                     '''
@@ -881,7 +892,7 @@ pipeline {
                     CI_DOCKERENV="LSIO_FIRST_PARTY=true"
                   fi
                 fi
-                docker pull ghcr.io/linuxserver/ci:latest
+                docker pull ghcr.io/linuxserver/ci:${CITEST_IMAGETAG}
                 if [ "${MULTIARCH}" == "true" ]; then
                   docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} --platform=arm64
                   docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
@@ -905,7 +916,9 @@ pipeline {
                 -e WEB_PATH=\"${CI_WEBPATH}\" \
                 -e NODE_NAME=\"${NODE_NAME}\" \
                 -e SYFT_IMAGE_TAG=\"${CI_SYFT_IMAGE_TAG:-${SYFT_IMAGE_TAG}}\" \
-                -t ghcr.io/linuxserver/ci:latest \
+                -e COMMIT_SHA=\"${COMMIT_SHA}\" \
+                -e BUILD_NUMBER=\"${BUILD_NUMBER}\" \
+                -t ghcr.io/linuxserver/ci:${CITEST_IMAGETAG} \
                 python3 test_build.py'''
         }
       }
@@ -931,9 +944,11 @@ pipeline {
                           CACHEIMAGE=${i}
                       fi
                   done
-                  docker buildx imagetools create --prefer-index=false -t ${PUSHIMAGE}:${META_TAG} -t ${PUSHIMAGE}:development -t ${PUSHIMAGE}:${EXT_RELEASE_TAG} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER}
+                  docker buildx imagetools create --prefer-index=false -t ${PUSHIMAGE}:${META_TAG} -t ${PUSHIMAGE}:development -t ${PUSHIMAGE}:${EXT_RELEASE_TAG} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
+                    { if [[ "${PUSHIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; }
                   if [ -n "${SEMVER}" ]; then
-                    docker buildx imagetools create --prefer-index=false -t ${PUSHIMAGE}:${SEMVER} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER}
+                    docker buildx imagetools create --prefer-index=false -t ${PUSHIMAGE}:${SEMVER} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
+                      { if [[ "${PUSHIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; }
                   fi
                 done
               '''
@@ -958,20 +973,27 @@ pipeline {
                           CACHEIMAGE=${i}
                       fi
                   done
-                  docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:amd64-${META_TAG} -t ${MANIFESTIMAGE}:amd64-development -t ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER}
+                  docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:amd64-${META_TAG} -t ${MANIFESTIMAGE}:amd64-development -t ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
-                  docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:arm64v8-${META_TAG} -t ${MANIFESTIMAGE}:arm64v8-development -t ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} ${CACHEIMAGE}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
+                    { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; }
+                  docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:arm64v8-${META_TAG} -t ${MANIFESTIMAGE}:arm64v8-development -t ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} ${CACHEIMAGE}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || \
+                    { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; }
                   if [ -n "${SEMVER}" ]; then
-                    docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:amd64-${SEMVER} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER}
+                    docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:amd64-${SEMVER} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
-                    docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:arm64v8-${SEMVER} ${CACHEIMAGE}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
+                      { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; }
+                    docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:arm64v8-${SEMVER} ${CACHEIMAGE}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || \
+                      { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; }
                   fi
                 done
                 for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}" "${QUAYIMAGE}"; do
-                  docker buildx imagetools create -t ${MANIFESTIMAGE}:development ${MANIFESTIMAGE}:amd64-development ${MANIFESTIMAGE}:arm64v8-development
+                  docker buildx imagetools create -t ${MANIFESTIMAGE}:development ${MANIFESTIMAGE}:amd64-development ${MANIFESTIMAGE}:arm64v8-development || \
-                  docker buildx imagetools create -t ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG}
+                    { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; }
-
+                  docker buildx imagetools create -t ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG} || \
-                  docker buildx imagetools create -t ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
+                    { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; }
+                  docker buildx imagetools create -t ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} || \
+                    { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; }
                   if [ -n "${SEMVER}" ]; then
-                    docker buildx imagetools create -t ${MANIFESTIMAGE}:${SEMVER} ${MANIFESTIMAGE}:amd64-${SEMVER} ${MANIFESTIMAGE}:arm64v8-${SEMVER}
+                    docker buildx imagetools create -t ${MANIFESTIMAGE}:${SEMVER} ${MANIFESTIMAGE}:amd64-${SEMVER} ${MANIFESTIMAGE}:arm64v8-${SEMVER} || \
+                      { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; }
                   fi
                 done
               '''
@@ -989,23 +1011,41 @@ pipeline {
         environment name: 'EXIT_STATUS', value: ''
       }
       steps {
+        sh '''#! /bin/bash
+              echo "Auto-generating release notes"
+              if [ "$(git tag --points-at HEAD)" != "" ]; then
+                echo "Existing tag points to current commit, suggesting no new LS changes"
+                AUTO_RELEASE_NOTES="No changes"
+              else
+                AUTO_RELEASE_NOTES=$(curl -fsL -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github+json" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/releases/generate-notes  \
+                  -d '{"tag_name":"'${META_TAG}'",\
+                      "target_commitish": "development"}' \
+                  | jq -r '.body' | sed 's|## What.s Changed||')
+              fi
               echo "Pushing New tag for current commit ${META_TAG}"
-        sh '''curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/git/tags \
+              curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/git/tags \
                 -d '{"tag":"'${META_TAG}'",\
                   "object": "'${COMMIT_SHA}'",\
                   "message": "Tagging Release '${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}' to development",\
                   "type": "commit",\
-             "tagger": {"name": "LinuxServer-CI","email": "ci@linuxserver.io","date": "'${GITHUB_DATE}'"}}' '''
+                  "tagger": {"name": "LinuxServer-CI","email": "ci@linuxserver.io","date": "'${GITHUB_DATE}'"}}'
               echo "Pushing New release for Tag"
-        sh '''#! /bin/bash
+              curl -H "Authorization: token ${GITHUB_TOKEN}" -s https://api.github.com/repos/${EXT_USER}/${EXT_REPO}/commits/${EXT_RELEASE_CLEAN} | jq -r '.commit.message' > releasebody.json
-              curl -H "Authorization: token ${GITHUB_TOKEN}" -s https://api.github.com/repos/${EXT_USER}/${EXT_REPO}/commits/${EXT_RELEASE_CLEAN} | jq '.commit.message' | sed 's:^.\\(.*\\).$:\\1:' > releasebody.json
+              jq -n \
-              echo '{"tag_name":"'${META_TAG}'",\
+                --arg tag_name "$META_TAG" \
-                     "target_commitish": "development",\
+                --arg target_commitish "development" \
-                     "name": "'${META_TAG}'",\
+                --arg ci_url "${CI_URL:-N/A}" \
-                     "body": "**CI Report:**\\n\\n'${CI_URL:-N/A}'\\n\\n**LinuxServer Changes:**\\n\\n'${LS_RELEASE_NOTES}'\\n\\n**Remote Changes:**\\n\\n' > start
+                --arg ls_notes "$AUTO_RELEASE_NOTES" \
-              printf '","draft": false,"prerelease": true}' >> releasebody.json
+                --arg remote_notes "$(cat releasebody.json)" \
-              paste -d'\\0' start releasebody.json > releasebody.json.done
+                '{
-              curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/releases -d @releasebody.json.done'''
+                  "tag_name": $tag_name,
+                  "target_commitish": $target_commitish,
+                  "name": $tag_name,
+                  "body": ("**CI Report:**\\n\\n" + $ci_url + "\\n\\n**LinuxServer Changes:**\\n\\n" + $ls_notes + "\\n\\n**Remote Changes:**\\n\\n" + $remote_notes),
+                  "draft": false,
+                  "prerelease": true                }' > releasebody.json.done
+              curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/releases -d @releasebody.json.done
+        '''
       }
     }
     // Add protection to the release branch

README.md

@@ -80,7 +80,7 @@ This image now supports password protection through htpasswd. Run the following
 To help you get started creating a container from this image you can either use docker-compose or the docker cli.
 
 >[!NOTE]
->Unless a parameter is flaged as 'optional', it is *mandatory* and a value must be provided.
+>Unless a parameter is flagged as 'optional', it is *mandatory* and a value must be provided.
 
 ### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose))
 
@@ -94,6 +94,7 @@ services:
       - PUID=1000
       - PGID=1000
       - TZ=Etc/UTC
+      - ALLOW_INTERNAL_REQUESTS=false #optional
     volumes:
       - /path/to/heimdall/config:/config
     ports:
@@ -110,6 +111,7 @@ docker run -d \
   -e PUID=1000 \
   -e PGID=1000 \
   -e TZ=Etc/UTC \
+  -e ALLOW_INTERNAL_REQUESTS=false `#optional` \
   -p 80:80 \
   -p 443:443 \
   -v /path/to/heimdall/config:/config \
@@ -128,6 +130,7 @@ Containers are configured using parameters passed at runtime (such as those abov
 | `-e PUID=1000` | for UserID - see below for explanation |
 | `-e PGID=1000` | for GroupID - see below for explanation |
 | `-e TZ=Etc/UTC` | specify a timezone to use, see this [list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List). |
+| `-e ALLOW_INTERNAL_REQUESTS=false` | By default, Heimdall blocks lookup requests to private or reserved IP addresses, if your instance is not exposed to the internet, or is behind some level of authentication, you can set this to `true` to allow requests to private IP addresses. |
 | `-v /config` | Persistent config files |
 
 ## Environment variables from files (Docker secrets)
@@ -292,6 +295,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **17.07.25:** - Rebase to Alpine 3.22, enable PHP environment passthrough.
 * **27.06.24:** - Rebase to Alpine 3.20. Existing users should update their nginx confs to avoid http2 deprecation warnings.
 * **07.03.24:** - Enable the opcache and disable file revalidation.
 * **06.03.24:** - Existing users should update: site-confs/default.conf - Cleanup default site conf.

package_versions.txt

@@ -1,11 +1,12 @@
 NAME                                VERSION           TYPE           
 Hidden Input                        1, 0, 0, 0        binary          
-alpine-baselayout                   3.6.5-r0               apk             
+acl-libs                            2.3.2-r1          apk             
-alpine-baselayout-data              3.6.5-r0               apk             
+alpine-baselayout                   3.7.0-r0          apk             
-alpine-keys                         2.4-r1                 apk             
+alpine-baselayout-data              3.7.0-r0          apk             
-alpine-release                      3.20.6-r0              apk             
+alpine-keys                         2.5-r0            apk             
-apache2-utils                       2.4.62-r0              apk             
+alpine-release                      3.22.3-r0         apk             
-apk-tools                           2.14.4-r1              apk             
+apache2-utils                       2.4.66-r0         apk             
+apk-tools                           2.14.9-r3         apk             
 apr                                 1.7.5-r0          apk             
 apr-util                            1.6.3-r1          apk             
 argon2-libs                         20190702-r5       apk             
@@ -13,37 +14,37 @@ aws/aws-crt-php                     v1.2.7                 php-composer
 aws/aws-sdk-php                     3.349.3           php-composer    
 barryvdh/laravel-ide-helper         v3.5.5            php-composer    
 barryvdh/reflection-docblock        v2.3.1            php-composer    
-bash                                5.2.26-r0              apk             
+bash                                5.2.37-r0         apk             
 brick/math                          0.12.3            php-composer    
 brotli-libs                         1.1.0-r2          apk             
-busybox                             1.36.1-r29             apk             
+busybox                             1.37.0-r20        apk             
-busybox-binsh                       1.36.1-r29             apk             
+busybox-binsh                       1.37.0-r20        apk             
-c-ares                              1.33.1-r0              apk             
+c-ares                              1.34.6-r0         apk             
-ca-certificates                     20241121-r1            apk             
+ca-certificates                     20250911-r0       apk             
-ca-certificates-bundle              20241121-r1            apk             
+ca-certificates-bundle              20250911-r0       apk             
 carbonphp/carbon-doctrine-types     3.2.0             php-composer    
-catatonit                           0.2.0-r0               apk             
+catatonit                           0.2.1-r0          apk             
 clue/stream-filter                  v1.7.0            php-composer    
-composer                            2.8.10                 binary          
+composer                            2.9.5             binary          
 composer/class-map-generator        1.6.1             php-composer    
 composer/pcre                       3.3.2             php-composer    
-coreutils                           9.5-r2                 apk             
+coreutils                           9.7-r1            apk             
-coreutils-env                       9.5-r2                 apk             
+coreutils-env                       9.7-r1            apk             
-coreutils-fmt                       9.5-r2                 apk             
+coreutils-fmt                       9.7-r1            apk             
-coreutils-sha512sum                 9.5-r2                 apk             
+coreutils-sha512sum                 9.7-r1            apk             
-curl                                8.12.1-r0              apk             
+curl                                8.14.1-r2         apk             
 dflydev/dot-access-data             v3.0.3            php-composer    
 doctrine/inflector                  2.0.10            php-composer    
 doctrine/lexer                      3.0.1             php-composer    
 dragonmantank/cron-expression       v3.4.0            php-composer    
 egulias/email-validator             4.0.4             php-composer    
+enshrined/svg-sanitize              0.21.0            php-composer    
 fakerphp/faker                      v1.24.1           php-composer    
 filp/whoops                         2.18.3            php-composer    
-findutils                           4.9.0-r5               apk             
+findutils                           4.10.0-r0         apk             
 fruitcake/php-cors                  v1.3.0            php-composer    
-git                                 2.45.4-r0              apk             
+git                                 2.49.1-r0         apk             
-git-init-template                   2.45.4-r0              apk             
+git-init-template                   2.49.1-r0         apk             
-gmp                                 6.3.0-r1               apk             
 graham-campbell/bounded-cache       v3.0.0            php-composer    
 graham-campbell/github              v12.8.0           php-composer    
 graham-campbell/manager             v5.2.0            php-composer    
@@ -53,9 +54,9 @@ guzzlehttp/promises                 2.2.0                  php-composer
 guzzlehttp/psr7                     2.7.1             php-composer    
 guzzlehttp/uri-template             v1.0.4            php-composer    
 hamcrest/hamcrest-php               v2.1.1            php-composer    
-icu-data-en                         74.2-r1                apk             
+icu-data-en                         76.1-r1           apk             
-icu-libs                            74.2-r1                apk             
+icu-libs                            76.1-r1           apk             
-jq                                  1.7.1-r0               apk             
+jq                                  1.8.1-r0          apk             
 knplabs/github-api                  v3.16.0           php-composer    
 laravel/framework                   v11.45.1          php-composer    
 laravel/prompts                     v0.3.6            php-composer    
@@ -71,51 +72,50 @@ league/flysystem-local              3.30.0                 php-composer
 league/mime-type-detection          1.16.0            php-composer    
 league/uri                          7.5.1             php-composer    
 league/uri-interfaces               7.5.0             php-composer    
-libacl                              2.3.2-r0               apk             
+libapk2                             2.14.9-r3         apk             
-libattr                             2.5.2-r0               apk             
+libattr                             2.5.2-r2          apk             
 libbsd                              0.12.2-r0         apk             
 libbz2                              1.0.8-r6          apk             
-libcrypto3                          3.3.4-r0               apk             
+libcrypto3                          3.5.5-r0          apk             
-libcurl                             8.12.1-r0              apk             
+libcurl                             8.14.1-r2         apk             
-libedit                             20240517.3.1-r0        apk             
+libedit                             20250104.3.1-r1   apk             
-libexpat                            2.7.0-r0               apk             
+libexpat                            2.7.5-r0          apk             
-libgcc                              13.2.1_git20240309-r1  apk             
+libgcc                              14.2.0-r6         apk             
 libidn2                             2.3.7-r0          apk             
-libintl                             0.22.5-r0              apk             
+libintl                             0.24.1-r0         apk             
 libmd                               1.1.0-r0          apk             
-libncursesw                         6.4_p20240420-r2       apk             
+libncursesw                         6.5_p20250503-r0  apk             
-libpq                               16.9-r0                apk             
+libpq                               17.9-r0           apk             
-libproc2                            4.0.4-r0               apk             
+libproc2                            4.0.4-r3          apk             
-libpsl                              0.21.5-r1              apk             
+libpsl                              0.21.5-r3         apk             
-libssl3                             3.3.4-r0               apk             
+libssl3                             3.5.5-r0          apk             
-libstdc++                           13.2.1_git20240309-r1  apk             
+libstdc++                           14.2.0-r6         apk             
-libunistring                        1.2-r0                 apk             
+libunistring                        1.3-r0            apk             
-libuuid                             2.40.1-r1              apk             
+libuuid                             2.41-r9           apk             
-libxml2                             2.12.10-r0             apk             
+libxml2                             2.13.9-r0         apk             
-libzip                              1.10.1-r0              apk             
+libzip                              1.11.4-r0         apk             
-linux-pam                           1.6.0-r0               apk             
+linux-pam                           1.7.0-r4          apk             
 logrotate                           3.21.0-r1         apk             
 mockery/mockery                     1.6.12            php-composer    
 monolog/monolog                     3.9.0             php-composer    
 mtdowling/jmespath.php              2.8.0             php-composer    
-musl                                1.2.5-r1               apk             
+musl                                1.2.5-r10         apk             
-musl-utils                          1.2.5-r1               apk             
+musl-utils                          1.2.5-r10         apk             
 myclabs/deep-copy                   1.13.3            php-composer    
-nano                                8.0-r0                 apk             
+nano                                8.4-r0            apk             
-ncurses-terminfo-base               6.4_p20240420-r2       apk             
+ncurses-terminfo-base               6.5_p20250503-r0  apk             
 nesbot/carbon                       3.10.1            php-composer    
-netcat-openbsd                      1.226-r0               apk             
+netcat-openbsd                      1.229.1-r0        apk             
 nette/schema                        v1.3.2            php-composer    
 nette/utils                         v4.0.7            php-composer    
-nghttp2-libs                        1.62.1-r0              apk             
+nghttp2-libs                        1.65.0-r0         apk             
-nginx                               1.26.3-r0              apk             
+nginx                               1.28.3-r0         apk             
 nikic/php-parser                    v5.5.0            php-composer    
 nunomaduro/collision                v8.5.0            php-composer    
 nunomaduro/termwind                 v2.3.1            php-composer    
-oniguruma                           6.9.9-r0               apk             
+oniguruma                           6.9.10-r0         apk             
-openssl                             3.3.4-r0               apk             
+openssl                             3.5.5-r0          apk             
-pcre                                8.45-r3                apk             
+pcre2                               10.46-r0          apk             
-pcre2                               10.43-r0               apk             
 phar-io/manifest                    2.0.4             php-composer    
 phar-io/version                     3.2.1             php-composer    
 php-http/cache-plugin               2.0.1             php-composer    
@@ -125,30 +125,30 @@ php-http/httplug                    2.4.1                  php-composer
 php-http/message                    1.16.2            php-composer    
 php-http/multipart-stream-builder   1.4.2             php-composer    
 php-http/promise                    1.3.1             php-composer    
-php83                               8.3.15-r0              apk             
+php84                               8.4.16-r0         apk             
-php83-common                        8.3.15-r0              apk             
+php84-common                        8.4.16-r0         apk             
-php83-ctype                         8.3.15-r0              apk             
+php84-ctype                         8.4.16-r0         apk             
-php83-curl                          8.3.15-r0              apk             
+php84-curl                          8.4.16-r0         apk             
-php83-dom                           8.3.15-r0              apk             
+php84-dom                           8.4.16-r0         apk             
-php83-fileinfo                      8.3.15-r0              apk             
+php84-fileinfo                      8.4.16-r0         apk             
-php83-fpm                           8.3.15-r0              apk             
+php84-fpm                           8.4.16-r0         apk             
-php83-iconv                         8.3.15-r0              apk             
+php84-iconv                         8.4.16-r0         apk             
-php83-intl                          8.3.15-r0              apk             
+php84-intl                          8.4.16-r0         apk             
-php83-mbstring                      8.3.15-r0              apk             
+php84-mbstring                      8.4.16-r0         apk             
-php83-mysqlnd                       8.3.15-r0              apk             
+php84-mysqlnd                       8.4.16-r0         apk             
-php83-opcache                       8.3.15-r0              apk             
+php84-opcache                       8.4.16-r0         apk             
-php83-openssl                       8.3.15-r0              apk             
+php84-openssl                       8.4.16-r0         apk             
-php83-pdo                           8.3.15-r0              apk             
+php84-pdo                           8.4.16-r0         apk             
-php83-pdo_mysql                     8.3.15-r0              apk             
+php84-pdo_mysql                     8.4.16-r0         apk             
-php83-pdo_pgsql                     8.3.15-r0              apk             
+php84-pdo_pgsql                     8.4.16-r0         apk             
-php83-pdo_sqlite                    8.3.15-r0              apk             
+php84-pdo_sqlite                    8.4.16-r0         apk             
-php83-phar                          8.3.15-r0              apk             
+php84-phar                          8.4.16-r0         apk             
-php83-session                       8.3.15-r0              apk             
+php84-session                       8.4.16-r0         apk             
-php83-simplexml                     8.3.15-r0              apk             
+php84-simplexml                     8.4.16-r0         apk             
-php83-tokenizer                     8.3.15-r0              apk             
+php84-tokenizer                     8.4.16-r0         apk             
-php83-xml                           8.3.15-r0              apk             
+php84-xml                           8.4.16-r0         apk             
-php83-xmlwriter                     8.3.15-r0              apk             
+php84-xmlwriter                     8.4.16-r0         apk             
-php83-zip                           8.3.15-r0              apk             
+php84-zip                           8.4.16-r0         apk             
 phpoption/phpoption                 1.9.3             php-composer    
 phpunit/php-code-coverage           10.1.16           php-composer    
 phpunit/php-file-iterator           4.1.0             php-composer    
@@ -156,8 +156,8 @@ phpunit/php-invoker                 4.0.0                  php-composer
 phpunit/php-text-template           3.0.1             php-composer    
 phpunit/php-timer                   6.0.0             php-composer    
 phpunit/phpunit                     10.5.47           php-composer    
-popt                                1.19-r3                apk             
+popt                                1.19-r4           apk             
-procps-ng                           4.0.4-r0               apk             
+procps-ng                           4.0.4-r3          apk             
 psr/cache                           3.0.0             php-composer    
 psr/clock                           1.0.0             php-composer    
 psr/container                       2.0.2             php-composer    
@@ -171,8 +171,8 @@ psy/psysh                           v0.12.9                php-composer
 ralouphie/getallheaders             3.0.3             php-composer    
 ramsey/collection                   2.1.1             php-composer    
 ramsey/uuid                         4.9.0             php-composer    
-readline                            8.2.10-r0              apk             
+readline                            8.2.13-r1         apk             
-scanelf                             1.3.7-r2               apk             
+scanelf                             1.3.8-r1          apk             
 sebastian/cli-parser                2.0.1             php-composer    
 sebastian/code-unit                 2.0.0             php-composer    
 sebastian/code-unit-reverse-lookup  3.0.0             php-composer    
@@ -188,17 +188,17 @@ sebastian/object-reflector          3.0.0                  php-composer
 sebastian/recursion-context         5.0.0             php-composer    
 sebastian/type                      4.0.0             php-composer    
 sebastian/version                   4.0.1             php-composer    
-shadow                              4.15.1-r0              apk             
+shadow                              4.17.3-r0         apk             
-skalibs                             2.14.1.1-r0            apk             
+skalibs-libs                        2.14.4.0-r0       apk             
 spatie/backtrace                    1.7.4             php-composer    
 spatie/error-solutions              1.1.3             php-composer    
 spatie/flare-client-php             1.10.1            php-composer    
 spatie/ignition                     1.15.1            php-composer    
 spatie/laravel-html                 3.12.0            php-composer    
 spatie/laravel-ignition             2.9.1             php-composer    
-sqlite-libs                         3.45.3-r2              apk             
+sqlite-libs                         3.49.2-r1         apk             
 squizlabs/php_codesniffer           3.13.2            php-composer    
-ssl_client                          1.36.1-r29             apk             
+ssl_client                          1.37.0-r20        apk             
 symfony/cache                       v7.3.1            php-composer    
 symfony/cache-contracts             v3.6.0            php-composer    
 symfony/clock                       v7.3.0            php-composer    
@@ -235,11 +235,11 @@ symfony/var-exporter                v7.3.0                 php-composer
 symfony/yaml                        v7.3.1            php-composer    
 theseer/tokenizer                   1.2.3             php-composer    
 tijsverkoyen/css-to-inline-styles   v2.3.0            php-composer    
-tzdata                              2025b-r0               apk             
+tzdata                              2026a-r0          apk             
-utmps-libs                          0.1.2.2-r1             apk             
+utmps-libs                          0.1.3.1-r0        apk             
 vlucas/phpdotenv                    v5.6.2            php-composer    
 voku/portable-ascii                 2.0.3             php-composer    
 webmozart/assert                    1.11.0            php-composer    
-xz-libs                             5.6.2-r1               apk             
+xz-libs                             5.8.1-r0          apk             
-zlib                                1.3.1-r1               apk             
+zlib                                1.3.1-r2          apk             
-zstd-libs                           1.5.6-r0               apk             
+zstd-libs                           1.5.7-r0          apk             

readme-vars.yml

@@ -30,6 +30,9 @@ param_usage_include_ports: true
 param_ports:
   - {external_port: "80", internal_port: "80", port_desc: "http gui"}
   - {external_port: "443", internal_port: "443", port_desc: "https gui"}
+opt_param_usage_include_env: true
+opt_param_env_vars:
+  - {env_var: "ALLOW_INTERNAL_REQUESTS", env_value: "false", desc: "By default, Heimdall blocks lookup requests to private or reserved IP addresses, if your instance is not exposed to the internet, or is behind some level of authentication, you can set this to `true` to allow requests to private IP addresses."}
 # application setup block
 app_setup_block_enabled: true
 app_setup_block: |
@@ -56,8 +59,9 @@ init_diagram: |
     init-nginx-end -> init-config
     init-os-end -> init-config
     init-config -> init-config-end
+    init-crontab-config -> init-config-end
     init-heimdall-config -> init-config-end
-    init-os-end -> init-crontab-config
+    init-config -> init-crontab-config
     init-mods-end -> init-custom-files
     init-adduser -> init-device-perms
     base -> init-envfile
@@ -65,25 +69,19 @@ init_diagram: |
     init-nginx-end -> init-heimdall-config
     init-php -> init-keygen
     base -> init-migrations
-    base -> init-mods
     init-config-end -> init-mods
-    init-version-checks -> init-mods
-    init-mods -> init-mods-end
     init-mods-package-install -> init-mods-end
     init-mods -> init-mods-package-install
     init-samples -> init-nginx
-    init-permissions -> init-nginx-end
+    init-version-checks -> init-nginx-end
-    base -> init-os-end
     init-adduser -> init-os-end
     init-device-perms -> init-os-end
     init-envfile -> init-os-end
-    init-migrations -> init-os-end
     init-keygen -> init-permissions
     init-nginx -> init-php
     init-folders -> init-samples
     init-custom-files -> init-services
-    init-mods-end -> init-services
+    init-permissions -> init-version-checks
-    init-config-end -> init-version-checks
     init-services -> svc-cron
     svc-cron -> legacy-services
     init-services -> svc-nginx
@@ -94,11 +92,12 @@ init_diagram: |
     svc-queue -> legacy-services
   }
   Base Images: {
-    "baseimage-alpine-nginx:3.20" <- "baseimage-alpine:3.20"
+    "baseimage-alpine-nginx:3.22" <- "baseimage-alpine:3.22"
   }
   "heimdall:development" <- Base Images
 # changelog
 changelogs:
+  - {date: "17.07.25:", desc: "Rebase to Alpine 3.22, enable PHP environment passthrough."}
   - {date: "27.06.24:", desc: "Rebase to Alpine 3.20. Existing users should update their nginx confs to avoid http2 deprecation warnings."}
   - {date: "07.03.24:", desc: "Enable the opcache and disable file revalidation."}
   - {date: "06.03.24:", desc: "Existing users should update: site-confs/default.conf - Cleanup default site conf."}