php · dunglas · Jan 9, 2026 · Jan 10, 2026 · Jan 10, 2026 · Jan 10, 2026
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
@@ -208,15 +208,15 @@ jobs:
           VARIANT: ${{ matrix.variant }}
       - name: Upload builder metadata
         if: fromJson(needs.prepare.outputs.push)
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: metadata-builder-${{ matrix.variant }}-${{ steps.prepare.outputs.sanitized_platform }}
           path: /tmp/metadata/builder/*
           if-no-files-found: error
           retention-days: 1
       - name: Upload runner metadata
         if: fromJson(needs.prepare.outputs.push)
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: metadata-runner-${{ matrix.variant }}-${{ steps.prepare.outputs.sanitized_platform }}
           path: /tmp/metadata/runner/*

diff --git a/.github/workflows/static.yaml b/.github/workflows/static.yaml
@@ -170,7 +170,7 @@ jobs:
           METADATA: ${{ steps.build.outputs.metadata }}
       - name: Upload metadata
         if: fromJson(needs.prepare.outputs.push) && !matrix.debug && !matrix.mimalloc
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: metadata-static-builder-musl-${{ steps.prepare.outputs.sanitized_platform }}
           path: /tmp/metadata/*
@@ -188,7 +188,7 @@ jobs:
           PLATFORM: ${{ matrix.platform }}
       - name: Upload artifact
         if: ${{ !fromJson(needs.prepare.outputs.push) }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: frankenphp-linux-${{ matrix.platform == 'linux/amd64' && 'x86_64' || 'aarch64' }}${{ matrix.debug && '-debug' || '' }}${{ matrix.mimalloc && '-mimalloc' || '' }}
           path: frankenphp-linux-${{ matrix.platform == 'linux/amd64' && 'x86_64' || 'aarch64' }}${{ matrix.debug && '-debug' || '' }}${{ matrix.mimalloc && '-mimalloc' || '' }}
@@ -320,7 +320,7 @@ jobs:
           METADATA: ${{ steps.build.outputs.metadata }}
       - name: Upload metadata
         if: fromJson(needs.prepare.outputs.push)
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: metadata-static-builder-gnu-${{ steps.prepare.outputs.sanitized_platform }}
           path: /tmp/metadata-gnu/*
@@ -344,7 +344,7 @@ jobs:
           PLATFORM: ${{ matrix.platform }}
       - name: Upload artifact
         if: ${{ !fromJson(needs.prepare.outputs.push) }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: frankenphp-linux-${{ matrix.platform == 'linux/amd64' && 'x86_64' || 'aarch64' }}-gnu-files
           path: gh-output/*
@@ -448,12 +448,12 @@ jobs:
           ref: ${{ needs.prepare.outputs.ref }}
           persist-credentials: false
       - uses: actions/setup-go@v6
-        with:
+        with: # zizmor: ignore[cache-poisoning]
           go-version: "1.25"
           cache-dependency-path: |
             go.sum
             caddy/go.sum
-          cache: false
+          cache: ${{ github.event_name != 'release' }}
       - name: Set FRANKENPHP_VERSION
         run: |
           if [ "${GITHUB_REF_TYPE}" == "tag" ]; then
@@ -475,7 +475,7 @@ jobs:
           NO_COMPRESS: ${{ github.event_name == 'pull_request' && '1' || '' }}
       - name: Upload logs
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           path: dist/static-php-cli/log
           name: static-php-cli-log-${{ matrix.platform }}-${{ github.sha }}
@@ -485,7 +485,7 @@ jobs:
           subject-path: ${{ github.workspace }}/dist/frankenphp-mac-*
       - name: Upload artifact
         if: github.ref_type == 'branch'
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: frankenphp-mac-${{ matrix.platform }}
           path: dist/frankenphp-mac-${{ matrix.platform }}

diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
@@ -35,6 +35,7 @@ jobs:
     env:
       GOMAXPROCS: 10
       LIBRARY_PATH: ${{ github.workspace }}/watcher/target/lib
+      GOFLAGS: "-tags=nobadger,nomysql,nopgx"
     steps:
       - uses: actions/checkout@v6
         with:
@@ -69,7 +70,7 @@ jobs:
         run: ./frankenphp.test -test.v
       - name: Run Caddy module tests
         working-directory: caddy/
-        run: go test -tags nobadger,nomysql,nopgx -race -v ./...
+        run: go test -race -v ./...
       - name: Run Fuzzing Tests
         working-directory: caddy/
         run: go test -fuzz FuzzRequest -fuzztime 20s
@@ -100,6 +101,8 @@ jobs:
       fail-fast: false
       matrix:
         php-versions: ["8.3", "8.4", "8.5"]
+    env:
+      XCADDY_GO_BUILD_FLAGS: "-tags=nobadger,nomysql,nopgx"
     steps:
       - uses: actions/checkout@v6
         with:
@@ -141,6 +144,7 @@ jobs:
     runs-on: macos-latest
     env:
       HOMEBREW_NO_AUTO_UPDATE: 1
+      GOFLAGS: "-tags=nowatcher,nobadger,nomysql,nopgx"
     steps:
       - uses: actions/checkout@v6
         with:
@@ -172,4 +176,4 @@ jobs:
         run: go test -tags nowatcher -race -v ./...
       - name: Run Caddy module tests
         working-directory: caddy/
-        run: go test -tags nowatcher,nobadger,nomysql,nopgx -race -v ./...
+        run: go test -race -v ./...
diff --git a/.github/workflows/windows.yaml b/.github/workflows/windows.yaml
@@ -0,0 +1,185 @@
+name: Build Windows release
+
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "docker-bake.hcl"
+      - "vcpkg.json"
+      - ".github/workflows/static.yaml"
+      - "**cgo.go"
+      - "**Dockerfile"
+      - "**.c"
+      - "**.h"
+      - "**.sh"
+      - "**.stub.php"
+  push:
+    branches:
+      - main
+    tags:
+      - v*.*.*
+  workflow_dispatch:
+    inputs:
+      #checkov:skip=CKV_GHA_7
+      version:
+        description: "FrankenPHP version"
+        required: false
+        type: string
+  schedule:
+    - cron: "0 8 * * *"
+
+permissions:
+  contents: read
+
+env:
+  GOTOOLCHAIN: local
+  GOFLAGS: "-ldflags=-extldflags=-fuse-ld=lld -tags=nobadger,nomysql,nopgx"
+  PHP_DOWNLOAD_BASE: "https://windows.php.net/downloads/releases"
+  CC: clang
+  CXX: clang++
+
+jobs:
+  build:
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: powershell
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+        with:
+          path: frankenphp
+          persist-credentials: false
+
+      - name: Set FRANKENPHP_VERSION
+        run: |
+          if ($env:GITHUB_REF_TYPE -eq "tag") {
+            $frankenphpVersion = $env:GITHUB_REF_NAME.Substring(1)
+          } elseif ($env:GITHUB_EVENT_NAME -eq "schedule") {
+            $frankenphpVersion = $env:GITHUB_REF
+          } else {
+            $frankenphpVersion = $env:GITHUB_SHA
+          }
+
+          echo "FRANKENPHP_VERSION=$frankenphpVersion" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with: # zizmor: ignore[cache-poisoning]
+          go-version: "1.26.0-rc.1"
+          cache-dependency-path: |
+            frankenphp/go.sum
+            frankenphp/caddy/go.sum
+          cache: ${{ github.event_name != 'release' }}
+          check-latest: true
+
+      - name: Install Vcpkg Libraries
+        working-directory: frankenphp
+        run: "vcpkg install"
+
+      - name: Download Watcher
+        run: |
+          $latestTag = gh release list --repo e-dant/watcher --limit 1 --exclude-drafts --exclude-pre-releases --json tagName --jq '.[0].tagName'
+          Write-Host "Latest Watcher version: $latestTag"
+
+          gh release download $latestTag --repo e-dant/watcher --pattern "*x86_64-pc-windows-msvc.tar" -O watcher.tar
+
+          tar -xf "watcher.tar" -C "$env:GITHUB_WORKSPACE"
+          Rename-Item -Path "$env:GITHUB_WORKSPACE\x86_64-pc-windows-msvc" -NewName "watcher"
+
+          # See https://github.com/e-dant/watcher/issues/108
+          New-Item -Path .\watcher\wtr -ItemType Directory -Force
+          Move-Item -Path .\watcher\watcher-c.h -Destination .\watcher\wtr\watcher-c.h
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Download PHP
+        run: |
+          $webContent = Invoke-WebRequest -Uri $env:PHP_DOWNLOAD_BASE -UseBasicParsing
+          $links = $webContent.Links.Href | Where-Object { $_ -match "php-\d+\.\d+\.\d+-Win32-vs17-x64\.zip$" }
+
+          if (-not $links) { throw "Could not find PHP zip files at $env:PHP_DOWNLOAD_BASE" }
+
+          $latestFile = $links | Sort-Object { if ($_ -match '(\d+\.\d+\.\d+)') { [version]$matches[1] } } | Select-Object -Last 1
+
+          $version = if ($latestFile -match '(\d+\.\d+\.\d+)') { $matches[1] }
+          Write-Host "Detected latest PHP version: $version"
+
+          "PHP_VERSION=$version" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+          $phpZip = "php-$version-Win32-vs17-x64.zip"
+          $develZip = "php-devel-pack-$version-Win32-vs17-x64.zip"
+
+          $dirName = "frankenphp-$env:FRANKENPHP_VERSION-php-$version-Win32-vs17-x64"
+
+          echo "DIR_NAME=$dirName" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+          Invoke-WebRequest -Uri "$env:PHP_DOWNLOAD_BASE/$phpZip" -OutFile "$env:TEMP\php.zip"
+          Expand-Archive -Path "$env:TEMP\php.zip" -DestinationPath "$env:GITHUB_WORKSPACE\$dirName"
+
+          Invoke-WebRequest -Uri "$env:PHP_DOWNLOAD_BASE/$develZip" -OutFile "$env:TEMP\php-devel.zip"
+          Expand-Archive -Path "$env:TEMP\php-devel.zip" -DestinationPath "$env:GITHUB_WORKSPACE\php-devel"
+
+      - name: Prepare env
+        run: |
+          $vcpkgRoot = "$env:GITHUB_WORKSPACE\frankenphp\vcpkg_installed\x64-windows"
+          $watcherRoot = "$env:GITHUB_WORKSPACE\watcher"
+          $phpBin = "$env:GITHUB_WORKSPACE\$env:DIR_NAME"
+          $phpDevel = "$env:GITHUB_WORKSPACE\php-devel\php-$env:PHP_VERSION-devel-vs17-x64"
+
+          echo "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\Llvm\bin" | Out-File -FilePath $env:GITHUB_PATH -Append
+          echo "$vcpkgRoot\bin" | Out-File -FilePath $env:GITHUB_PATH -Append
+          echo "$watcherRoot" | Out-File -FilePath $env:GITHUB_PATH -Append
+          echo "$phpBin" | Out-File -FilePath $env:GITHUB_PATH -Append
+
+          echo "CGO_CFLAGS=-I$vcpkgRoot\include -I$watcherRoot -I$phpDevel\include -I$phpDevel\include\main -I$phpDevel\include\TSRM -I$phpDevel\include\Zend -I$phpDevel\include\ext" | Out-File -FilePath $env:GITHUB_ENV -Append
+          echo "CGO_LDFLAGS=-L$vcpkgRoot\lib -lbrotlienc -L$watcherRoot -llibwatcher-c -L$phpBin -L$phpDevel\lib -lphp8ts -lphp8embed" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      - name: Build FrankenPHP
+        run: |
+          $customVersion = "FrankenPHP $env:FRANKENPHP_VERSION PHP $env:PHP_VERSION Caddy"
+          go build "-X 'github.com/caddyserver/caddy/v2.CustomVersion=$customVersion'"
+        working-directory: frankenphp\caddy\frankenphp
+
+      - name: Create Zip Archive
+        run: |
+          Copy-Item frankenphp\caddy\frankenphp\frankenphp.exe $env:DIR_NAME
+          Copy-Item watcher\libwatcher-c.dll $env:DIR_NAME
+          Copy-Item frankenphp\vcpkg_installed\x64-windows\bin\brotlienc.dll $env:DIR_NAME
+          Copy-Item frankenphp\vcpkg_installed\x64-windows\bin\brotlidec.dll $env:DIR_NAME
+          Copy-Item frankenphp\vcpkg_installed\x64-windows\bin\brotlicommon.dll $env:DIR_NAME
+          Copy-Item frankenphp\vcpkg_installed\x64-windows\bin\pthreadVC3.dll $env:DIR_NAME
+
+          Compress-Archive -Path $env:DIR_NAME -DestinationPath "$env:DIR_NAME.zip"
+
+      - name: Upload Artifact
+        if: github.event_name != 'release'
+        uses: actions/upload-artifact@v6
+        with:
+          name: ${{ env.DIR_NAME }}.zip
+          path: ${{ env.DIR_NAME }}.zip
+          compression-level: 0
+          if-no-files-found: error
+
+      - name: Upload Release Asset
+        if: github.event_name == 'release'
+        run: gh release upload $env:GITHUB_EVENT_RELEASE_TAG_NAME "$env:DIR_NAME.zip" --clobber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
+
+      - name: Run Tests
+        run: |
+          "opcache.enable=0`r`nopcache.enable_cli=0" | Out-File php.ini
+          $env:PHPRC = Get-Location
+
+          go test ./...
+          #cd caddy
+          #go test ./...
+        working-directory: ${{ github.workspace }}\frankenphp
diff --git a/caddy/frankenphp/cbrotli.go b/caddy/frankenphp/cbrotli.go
@@ -0,0 +1,5 @@
+//go:build !nobrotli
+
+package main
+
+import _ "github.com/dunglas/caddy-cbrotli"
diff --git a/caddy/frankenphp/main.go b/caddy/frankenphp/main.go
@@ -5,7 +5,6 @@ import (
 
 	// plug in Caddy modules here.
 	_ "github.com/caddyserver/caddy/v2/modules/standard"
-	_ "github.com/dunglas/caddy-cbrotli"
 	_ "github.com/dunglas/frankenphp/caddy"
 	_ "github.com/dunglas/mercure/caddy"
 	_ "github.com/dunglas/vulcain/caddy"

diff --git a/caddy/go.mod b/caddy/go.mod
@@ -62,7 +62,7 @@ require (
 	github.com/dunglas/skipfilter v1.0.0 // indirect
 	github.com/dunglas/vulcain v1.2.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/e-dant/watcher/watcher-go v0.0.0-20251208164151-f88ec3b7e146 // indirect
+	github.com/e-dant/watcher v0.0.0-20260110212511-0b8aea576c24 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect

diff --git a/caddy/go.sum b/caddy/go.sum
@@ -158,8 +158,8 @@ github.com/dunglas/vulcain/caddy v1.2.1/go.mod h1:8QrmLTfURmW2VgjTR6Gb9a53FrZjsp
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/e-dant/watcher/watcher-go v0.0.0-20251208164151-f88ec3b7e146 h1:h3vVM6X45PK0mAk8NqiYNQGXTyhvXy1HQ5GhuQN4eeA=
-github.com/e-dant/watcher/watcher-go v0.0.0-20251208164151-f88ec3b7e146/go.mod h1:sVUOkwtftoj71nnJRG2S0oWNfXFdKpz/M9vK0z06nmM=
+github.com/e-dant/watcher v0.0.0-20260110212511-0b8aea576c24 h1:azdbL1jat1ReH6wQrP+cawhsyXRLFRuCo0hGBUQHnv4=
+github.com/e-dant/watcher v0.0.0-20260110212511-0b8aea576c24/go.mod h1:PmV4IVmBJVqT2NcfTGN4+sZ+qGe3PA0qkphAtOHeFG0=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=

diff --git a/cgi.go b/cgi.go
@@ -8,8 +8,8 @@ package frankenphp
 // #cgo noescape frankenphp_register_variables_from_request_info
 // #cgo noescape frankenphp_register_variable_safe
 // #cgo noescape frankenphp_register_single
-// #include <php_variables.h>
 // #include "frankenphp.h"
+// #include <php_variables.h>
 import "C"
 import (
 	"context"

diff --git a/cgo.go b/cgo.go
@@ -1,9 +1,11 @@
 package frankenphp
 
 // #cgo darwin pkg-config: libxml-2.0
-// #cgo CFLAGS: -Wall -Werror
+// #cgo unix CFLAGS: -Wall -Werror
 // #cgo linux CFLAGS: -D_GNU_SOURCE
-// #cgo LDFLAGS: -lphp -lm -lutil
+// #cgo unix LDFLAGS: -lphp -lm -lutil
 // #cgo linux LDFLAGS: -ldl -lresolv
 // #cgo darwin LDFLAGS: -Wl,-rpath,/usr/local/lib -liconv -ldl
+// #cgo windows CFLAGS: -D_WINDOWS -DWINDOWS=1 -DZEND_WIN32=1 -DPHP_WIN32=1 -DWIN32 -D_MBCS -D_USE_MATH_DEFINES -DNDebug -DNDEBUG -DZEND_DEBUG=0 -DZTS=1 -DFD_SETSIZE=256
+// #cgo windows LDFLAGS: -lpthreadVC3
 import "C"