From 2863c393db87872a536671993b734eeaf511ca6f Mon Sep 17 00:00:00 2001
From: ondj <19149300+ondj@users.noreply.github.com>
Date: Mon, 19 Oct 2026 10:29:45 +0200
Subject: [PATCH 1/3] ci: Update actions version

---
 .github/workflows/check-misp-version.yml |  4 ++--
 .github/workflows/docker-image.yml       | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/check-misp-version.yml b/.github/workflows/check-misp-version.yml
index 11405a8..a8adddc 100644
--- a/.github/workflows/check-misp-version.yml
+++ b/.github/workflows/check-misp-version.yml
@@ -9,11 +9,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Get latest release
         id: release
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           result-encoding: string
           script: |
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 2c8cedf..0d9a5db 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -104,7 +104,7 @@ jobs:
 
       - name: Login to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -112,7 +112,7 @@ jobs:
 
       - name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: nukib
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -136,7 +136,7 @@ jobs:
 
       - name: Upload digest
         if: github.event_name != 'pull_request'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: digests-${{ runner.arch == 'X64' && 'amd64' || 'arm64' }}
           path: ${{ runner.temp }}/digests/*
@@ -159,14 +159,14 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: nukib
           password: ${{ secrets.DOCKERHUB_TOKEN }}

From e1a9258fc3a8ebf759d291efd3adedd1bff60715 Mon Sep 17 00:00:00 2001
From: ondj <19149300+ondj@users.noreply.github.com>
Date: Wed, 21 Oct 2026 08:19:30 +0200
Subject: [PATCH 2/3] extensions: Update simdjson_php

---
 bin/misp_compile_php_extensions.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/misp_compile_php_extensions.sh b/bin/misp_compile_php_extensions.sh
index 46d0c24..1acabe4 100644
--- a/bin/misp_compile_php_extensions.sh
+++ b/bin/misp_compile_php_extensions.sh
@@ -34,7 +34,7 @@ mkdir /build/php-modules/
 # Compile simdjson
 mkdir /tmp/simdjson
 cd /tmp/simdjson
-download_and_check https://github.com/JakubOnderka/simdjson_php/archive/f23334dd151ca6eb7c3aa8b234f1a86bfb231ea3.tar.gz 4efabcba3b4839cf202116f0a878b6bc768e7b0729c317c5c2eb191fd319808d
+download_and_check https://github.com/JakubOnderka/simdjson_php/archive/ab23d7e5f0edd23b49cf1385f52dc6e300a25fd4.tar.gz 4d909d2d727f42fe6323d144550f295df7445f03db41c5dddcecdc3c4e22ba22
 phpize
 CPPFLAGS="$DEFAULT_FLAGS" ./configure --silent
 make -j$NPROC

From 1019d4308521a5c86a1a8ed48a5673e3b882503f Mon Sep 17 00:00:00 2001
From: ondj <19149300+ondj@users.noreply.github.com>
Date: Wed, 21 Oct 2026 08:26:58 +0200
Subject: [PATCH 3/3] security: Possible workaround (not confirmed) for
 CVE-2026-109618 and CVE-2026-109619, but we don't need it anyway

---
 bin/misp_install.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bin/misp_install.sh b/bin/misp_install.sh
index e020321..12e95af 100644
--- a/bin/misp_install.sh
+++ b/bin/misp_install.sh
@@ -29,6 +29,7 @@ sed -e 's/;assert.active = On/assert.active = Off/' -i ${PHP_INI}
 sed -e 's/expose_php = On/expose_php = Off/' -i ${PHP_INI}
 sed -e 's/session.sid_length = 26/session.sid_length = 32/' -i ${PHP_INI}
 sed -e 's/session.use_strict_mode = 0/session.use_strict_mode = 1/' -i ${PHP_INI}
+sed -e 's/;session.upload_progress.enabled = On/session.upload_progress.enabled = Off/' -i ${PHP_INI} # Possible workaround (not confirmed) for CVE-2026-109618 and CVE-2026-109619, but we don't need it anyway
 sed -e 's/pcre.jit=0/pcre.jit=1/' -i ${PHP_INI}
 sed -e 's/opcache.enable_cli=1/opcache.enable_cli=0/' -i /etc/php.d/10-opcache.ini
 # use igbinary serializer for apcu and sessions