Possible workaround

.github/workflows/check-misp-version.yml

@@ -9,11 +9,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Get latest release
         id: release
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           result-encoding: string
           script: |

.github/workflows/docker-image.yml

@@ -104,15 +104,15 @@ jobs:
 
       - name: Login to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: nukib
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -136,7 +136,7 @@ jobs:
 
       - name: Upload digest
         if: github.event_name != 'pull_request'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: digests-${{ runner.arch == 'X64' && 'amd64' || 'arm64' }}
           path: ${{ runner.temp }}/digests/*
@@ -159,14 +159,14 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: nukib
           password: ${{ secrets.DOCKERHUB_TOKEN }}

bin/misp_compile_php_extensions.sh

@@ -34,7 +34,7 @@ mkdir /build/php-modules/
 # Compile simdjson
 mkdir /tmp/simdjson
 cd /tmp/simdjson
-download_and_check https://github.com/JakubOnderka/simdjson_php/archive/f23334dd151ca6eb7c3aa8b234f1a86bfb231ea3.tar.gz 4efabcba3b4839cf202116f0a878b6bc768e7b0729c317c5c2eb191fd319808d
+download_and_check https://github.com/JakubOnderka/simdjson_php/archive/ab23d7e5f0edd23b49cf1385f52dc6e300a25fd4.tar.gz 4d909d2d727f42fe6323d144550f295df7445f03db41c5dddcecdc3c4e22ba22
 phpize
 CPPFLAGS="$DEFAULT_FLAGS" ./configure --silent
 make -j$NPROC

bin/misp_install.sh

@@ -29,6 +29,7 @@ sed -e 's/;assert.active = On/assert.active = Off/' -i ${PHP_INI}
 sed -e 's/expose_php = On/expose_php = Off/' -i ${PHP_INI}
 sed -e 's/session.sid_length = 26/session.sid_length = 32/' -i ${PHP_INI}
 sed -e 's/session.use_strict_mode = 0/session.use_strict_mode = 1/' -i ${PHP_INI}
+sed -e 's/;session.upload_progress.enabled = On/session.upload_progress.enabled = Off/' -i ${PHP_INI} # Possible workaround (not confirmed) for CVE-2026-109618 and CVE-2026-109619, but we don't need it anyway
 sed -e 's/pcre.jit=0/pcre.jit=1/' -i ${PHP_INI}
 sed -e 's/opcache.enable_cli=1/opcache.enable_cli=0/' -i /etc/php.d/10-opcache.ini
 # use igbinary serializer for apcu and sessions