[rfay]

The Issue

Follows #16.

PHP 8.6.0RC4 includes the fix for CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"); its NEWS has the same entry as 8.5.12. DDEV's 8.6 packages from deb.sury.org don't have the fix yet, and this add-on couldn't build 8.6:

• Release candidates aren't in php.net/distributions, so the download returned 404.
• static-php-cli 2.8.5 only knows PHP up to 8.5, and building 8.6 failed in three places: patching, configure, and compiling APCu.

Also, the tests built only 8.3.19, so the versions people use most (8.4, 8.5, and now 8.6) weren't covered. The tests also assumed the router uses port 443.

How This PR Solves The Issue

Building PHP 8.6:

• If php.net/distributions/php-<version>.tar.gz isn't found, look up the download URL in php.net's pre-release list. Only the current pre-release is listed there.
• Skip static-php-cli's micro SAPI patches by setting SPC_MICRO_PATCHES="". static-php-cli applies its PHP 8.0 micro patches to versions it doesn't know, and they fail on 8.6. We don't build the micro SAPI, so this is skipped for all versions.
• For PHP 8.6 and later, override static-php-cli's configure command to use --enable-pic, because PHP 8.6 rejects --with-pic.
• For PHP 8.6 and later, build APCu from commit ebbcd3d1 on master. The latest release, 5.1.28, fails to compile because php_verror() changed in PHP 8.6; master fixed this in July.
• When bin/spc build fails, print the end of static-php-cli's shell log, which it otherwise doesn't show. That's how the configure and APCu errors were found.

Tests:

• The workflow matrix runs one PHP minor version per job: 8.1, 8.4, 8.5 and 8.6 on DDEV HEAD, plus 8.5 on DDEV stable, for 5 jobs. Each job builds the newest release of its minor version, or the current pre-release for 8.6, so the tests don't need updating for new releases. 8.1 is included as an old version because static-php-cli doesn't build PHP 7.x.
• Each test sets php_version to match. DDEV v1.25.4 doesn't accept 8.6, so it falls back to 8.5, which only changes which php.ini is used.
• The release test runs only in the 8.5 jobs. The CI action runs it only on scheduled and manual runs.
• The tests get the project URL from ddev describe -j, so they work with a non-default router port.
• To run another version locally: STATIC_PHP_TEST_MINOR=8.6 bats ./tests/test.bats.

README and install prompt:

• Document building pre-releases.
• Explain that static-php-cli doesn't support PHP 7.x and that 8.0/8.1 are best-effort.
• Replace the 7.4 and 8.0 examples with current versions.

Manual Testing Instructions

ddev config --php-version=8.6   # or 8.5 with DDEV v1.25.4
ddev dotenv set .ddev/.env.php-patch-build --static-php-version=8.6.0RC4
ddev add-on get https://github.com/rfay/ddev-php-patch-build/tarball/refs/pull/17/head
ddev restart
ddev php -v     # PHP 8.6.0RC4
ddev php -m     # no warnings; apcu and Zend OPcache present

Tested by hand on arm64 (Apple Silicon, OrbStack, DDEV HEAD) with 8.6.0RC4:

• The CLI and php-fpm run 8.6.0RC4, both loading DDEV's php.ini plus a .ddev/php override.
• php -m shows no warnings, and every default extension is present.
• APCu stores and fetches values, and mysqli connects to MariaDB.

Automated Testing Overview

The 5 matrix jobs described above. CI is the first run of:

• The 8.1 build. static-php-cli supports 8.1 only best-effort; if it fails, 8.2 is the fallback.
• The 8.4 build, and 8.5 with micro patches turned off.
• The rewritten test file. The local bats run was stopped before it finished.

Release/Deployment Notes

• 8.6.0RC4 stops resolving once RC5 or 8.6.0 is released, because php.net only lists the current pre-release. Users then need to update --static-php-version. The tests always pick the newest version.
• The APCu commit pin should be replaced with the next APCu release when there is one.
• CI now runs 5 build jobs instead of 2, each about 10-15 minutes, including the daily scheduled run.

🤖 Generated with Claude Code