Changelog #

24.3.3 #

2026-09-22

⚠️ Security release (stable)

FLAT 24.3.3 is a security release addressing vulnerabilities found in libxml2, libxslt, Symfony/YAML and the Ubuntu 24.04 base image, notably in libcurl and Apache. We encourage all users to update to this release.

New #

• Documentation: Security Notes about known vulnerabilities

Updated #

• PHP 8.3.33
• libxml2 2.13.9: backported security fixes for CVE-2025-10911, CVE-2026-86139, CVE-2026-86142, CVE-2026-86143, CVE-2026-86144
• libxslt 1.1.43: backported security fixes for CVE-2025-7424, CVE-2025-10911, CVE-2025-11731
• Symfony Yaml 7.4.18: CVE-2026-45304, CVE-2026-45305, CVE-2026-45133
• libcurl: CVE-2026-8932
• Apache: CVE-2026-43951

Removed #

• PHP extensions not required for production operation: pcntl, pcov, phar, posix, tokenizer, xml

24.3.2 #

2026-06-17

⚠️ Security release (stable)

FLAT 24.3.2 is a security release primarily addressing vulnerabilities found in PHP, libxml2 and the Ubuntu 24.04 base image, notably in Apache httpd, libcurl, and OpenSSL. We encourage all users to update to this release.

Updated #

• PHP 8.3.31: CVE-2026-6735
• Mozilla Server Side TLS 5.8
• zipstream-php 3.2.2

Fixed #

• libxml2 2.13.9: backported security fixes for CVE-2026-6732 and other issues
• html-parse and xml-parse() functions: introduced parse size limit via $FLAT_MAX_PARSE_SIZE environment variable

24.3.1 #

2026-03-18

⚠️ Security release (stable)

The FLAT 24.3.1 security release comprises minor component updates, including fixes for known vulnerabilities. We encourage all users to update to this release.

New #

• set the upstream User-Agent header via $FLAT_USER_AGENT environment variable

Updated #

• libcurl: CVE-2026-1965, CVE-2026-3783, CVE-2026-3784
• PHP 8.3.30
• APCu 5.1.28
• Symfony Yaml 7.3.8
• zipstream-php 3.2.1
• xmlseclibs 3.1.5: CVE-2025-66578, CVE-2026-32313

Fixed #

• flaw in XML canonicalization: CVE-2025-66578

24.3.0 #

2025-11-27

Feature release (stable)

FLAT 24.3.0 is a stable release providing minor updates to third-party libraries and components. It also includes new Swagger properties for Basic Authentication and CORS.

To further increase code quality, some features are now considered deprecated and will be removed in a future release. See the deprecation guide on how to migrate away from them.

New #

• x-flat-basicauth Swagger property for Basic Authentication
• max-age property in x-flat-cors to set up CORS caching
• environment variable $FLAT_STRICT_DEPRECATIONS
• log level deprecation

Updated #

• PHP 8.3.28
• libxml2 2.13.9: CVE-2025-6021, CVE-2025-6170, CVE-2025-7425
• APCu 5.1.27
• php-enum 4.7.2
• raphf 2.0.2
• Symfony Yaml 7.3.5
• zipstream-php 3.2.0

Deprecated #

• auth action
• regex action
• other undocumented actions and functions

24.2.1 #

2025-08-07

⚠️ Security release (stable)

FLAT 24.2.1 is a security release addressing multiple vulnerabilities in two of its main components. We encourage all users to update to this latest release.

Updated #

• Apache httpd: CVE-2025-23048, CVE-2024-43204, CVE-2024-42516, CVE-2024-47252, CVE-2025-49630, CVE-2025-49812, CVE-2025-53020
• PHP 8.3.24
• APCu 5.1.26

Fixed #

• /beam.fit source code exposed

Removed #

• libxml2 Schematron support: CVE-2025-49794, CVE-2025-49795, CVE-2025-49796

24.2.0 #

2025-07-08

Feature release (stable)

FLAT 24.2.0 is a stable release bringing new features and some minor component updates. It also includes some code cleanup, bug fixes, and refactoring.

The TLS/SSL configuration provided now disables all TLS versions except 1.2 and 1.3. If you offload SSL processing, e.g. to your load balancer, you should not be affected by this change.

Updated #

• PHP 8.3.23
• libxml2 2.13.8
• Mozilla Server Side TLS 5.7.1
• psr7 1.8.2
• phpunit 11.3.6 (test images only)

New #

• Apache configuration via environment variables
• environment variable PHPFPM to specify the hostname of the PHP-FPM container
• xpath attribute in dump action to select which nodes to dump

Fixed #

• invalid JSON in PHP-FPM logs

Removed #

• support for TLS 1.1 and earlier for client connections
• undocumented obsolete features and legacy code

24.1.2 #

2025-04-11

Bug fix release (stable)

Updated #

• PHP 8.3.20
• libxml2 2.13.7
• libxslt 1.1.43
• zipstream-php 3.1.2

Fixed #

• Boolean values of $env variables disappear
• invalid internal files paths
• handling of invalid UTF-8 characters in functions

24.1.1 #

2025-01-31

Bug fix release (stable)

Updated #

• PHP 8.3.16
• pecl_http 4.2.6
• json-schema 6.0.0
• xmlseclibs 3.1.3
• Symfony Yaml 7.0.8
• parity 3.0.1
• php-enum 4.7.1
• Composer 2.8.4

Fixed #

• erroneously altered numeric client parameters (regression #160)

24.1.0 #

2024-11-25

Feature release (stable)

FLAT 24.1.0 features both major and minor updates of its main libraries. Therefore some XML processing behavior changed slightly, see below.

TLS/SSL is now disabled by default in the web server. If you require virtual hosts that can handle TLS/SSL, you now have to set the environment variable SSL to 1. If you are offloading SSL processing, e.g. to your load balancer, you should not be affected by this change.

Updated #

• PHP 8.3.13
• libxml2 2.13.5
• libxslt 1.1.42
• APCu 5.1.24

New #

• FLAT’s Swagger dialect now allows example fields directly below request parameters to ease API documentation.
• switched to modern and more resource efficient event MPM
• made TLS/SSL optional via SSL environment variable

Fixed #

• XPath expressions containing non-UTF-8 characters are now considered invalid.
• XML include elements which could not be resolved are now removed from their document.
• stabilize TLS tests by badssl test via local container
• For HTML output, pretty printing is disabled to better match the document structure of the original document.

Removed #

• unnecessary modules from Apache web server configuration

24.0.2 #

2024-10-04

⚠️ Security release (stable)

Updated #

• libxml2 2.12.9: CVE-2024-40896
• PHP 8.3.12: CVE-2024-8925, CVE-2024-8926, CVE-2024-8927, CVE-2024-9026
• libxslt 1.1.42
• APCu 5.1.24

Fixed #

• CVE-2024-39884, CVE-2024-40725

24.0.1 #

2024-07-01

Bug fix release (stable)

FLAT 24.0.1 features minor updates, enhancements and bug fixes.

Updated #

• libxml2 2.12.8
• libxslt 1.1.41
• PHP 8.3.7

Changed #

• the access log output of Apache httpd is now enabled by default
• further consolidation of field names in logs

24.0.0 #

2024-05-14

Major release (stable)

FLAT 24.0.0 features an upgrade of the base image to Ubuntu 24.04 LTS as well as major upgrades of the third-party components PHP and libxml2. Many libraries have received updates, too.

The release also comes with two new images for monitoring (flatphpstats) and maintenance (flatcleancaches) and the option to run web server and PHP-FPM as separate containers.

Updated #

• Ubuntu 24.04 LTS
• PHP 8.3.6
• libxml2 2.12.6
• APCu 5.1.23
• pecl_http 4.2.4
• psr7 1.8.1
• xmlseclibs 3.1.1
• Symfony Yaml 7.0.3
• ZipStream-PHP 3.1.0

New #

• optionally run PHP-FPM and httpd as separate containers
• flatphpstats container image to monitor utilization
• flatcleancaches container image
• psr 1.2.0

Changed #

• /test.fit endpoint now requires parameter ?full for detailed output: /test.fit?full
• the access log output of Apache httpd is now formatted as JSON
• consolidated field names in logs

Removed #

• Console_CommandLine
• http-factory
• message-factory
• PEAR
• php-enum
• PSR Http Message
• undocumented features/legacy code, e.g. automatic cookie forwarding, control scripts, …

23.1.2 #

2024-04-22

⚠️ Security release (stable)

Updated #

• Ubuntu 20.04 LTS: CVE-2024-2961, CVE-2023-38709, CVE-2024-24795
• PHP 8.2.18

23.1.1 #

2024-02-13

⚠️ Security/bug fix release (stable)

Updated #

• libxml2 2.11.7: CVE-2024-25062
• PHP 8.2.15

Fixed #

• error in log action when overriding nullified log fields (#71)

23.1.0 #

2024-01-23

Feature release (stable)

New #

• CORS handling with subdomain wildcards

Fixed #

• Updated CORS behavior according to the current Fetch standard

Updated #

• PHP 8.2.14

23.0.6 #

2023-11-30

Bug fix release (stable)

Updated #

• PHP 8.2.13
• libxml2 2.11.6
• libxslt 1.1.39

Fixed #

• $request/remote-ip now contains the IP address of the peer

Added #

• License information accessible via docker inspect

Removed #

• unused legacy code

23.0.5 #

2023-10-11

⚠️ Security Release (stable)

Fixed #

• cookie injection vulnerability in libcurl: CVE-2023-38546
• file-exists function no longer throws an error when used with relative or empty URIs
• networking tests honor proxy settings from environment

Updated #

• PHP 8.2.11
• libxml2 2.11.5

23.0.4 #

2023-08-22

Bug fix release (stable)

Fixed #

• status code 404 for missing flows
• release build

Updated #

• PHP 8.2.9
• PHPUnit 10 (only for development/testing)

Improved #

• measure code coverage
• simplify test setup
• simplify versioning

23.0.3 #

2023-08-01

Bug fix release (stable)

Updated #

• PHP 8.2.8

Improved #

• build/test tools

23.0.2 #

2023-06-14

Bug fix release (stable)

Updated #

• PHP 8.2.7
• libxml2 2.11.4
• libxslt 1.1.38

23.0.1 #

2023-05-09

Bug fix release (stable)

Updated #

• libxml2 2.10.4: CVE-2023-29469, CVE-2023-28484
• PHP 8.2.5

Added #

• version info now also available via $server/flat-version

Fixed #

• Mocking was allowed by default. Can be enabled by $FLAT_ALLOW_MOCKING=true.

23.0.0 #

2023-04-04

Major release (stable)

Updated #

• slimline Docker image based on Ubuntu 20.04 LTS
• PHP 8.2.4 + compatible modules
• libxml2 2.10.3
• libxslt 1.1.37

Added #

• functions to handle date and time: datetime-format(), datetime-parse(), datetime-parse-iso()

Fixed #

• sorting order of some special characters in sort()
• evaluation of $FLAT_USE_XSLT_CACHE environment variable
• no more backslash escaping of / in template output
• parser in html-parse() now HTML5 compatible

Removed #

• flat CLI, use docker run/docker exec or docker compose instead