From 6e785a834163b0d0744f113353522a4cf5d5f100 Mon Sep 17 00:00:00 2001
From: loks0n <22452787+loks0n@users.noreply.github.com>
Date: Mon, 9 Nov 2026 14:49:29 +0000
Subject: [PATCH] chore: update Swoole to v6.2.5 and check upload marker
 handling

v6.2.4 unlinks the path named by a client-supplied Swoole-Upload-File part
header; v6.2.5 ignores it (swoole/swoole-src#6309). tests-swoole.php runs
against every built image and fails if the named file is deleted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml |  3 +++
 tests-swoole.php         | 28 ++++++++++++++++++++++++++++
 versions/8.3.env         |  2 +-
 versions/8.4.env         |  2 +-
 versions/8.5.env         |  2 +-
 5 files changed, 34 insertions(+), 3 deletions(-)
 create mode 100644 tests-swoole.php

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2173c10..0b7af9d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -96,6 +96,9 @@ jobs:
       - name: Run container structure tests
         run: container-structure-test test --image utopia-base-test --config tests.yaml
 
+      - name: Check Swoole upload marker handling
+        run: docker run --rm -v "$PWD/tests-swoole.php:/tests-swoole.php:ro" utopia-base-test php /tests-swoole.php
+
   dive:
     name: Dive (${{ matrix.php-versions }})
     needs: build
diff --git a/tests-swoole.php b/tests-swoole.php
new file mode 100644
index 0000000..5d2888e
--- /dev/null
+++ b/tests-swoole.php
@@ -0,0 +1,28 @@
+<?php
+
+// Swoole must not treat a client's Swoole-Upload-File part header as an upload and
+// unlink the path it names (swoole/swoole-src#6309, fixed in v6.2.5).
+$target = '/tmp/target';
+touch($target);
+$status = 0;
+
+$server = new Swoole\Http\Server('127.0.0.1', 9501);
+$server->set(['worker_num' => 1, 'log_level' => SWOOLE_LOG_ERROR]);
+$server->on('request', fn ($request, $response) => $response->end());
+$server->on('start', function ($server) use ($target, &$status) {
+    go(function () use ($server, $target, &$status) {
+        $body = "--b\r\nContent-Disposition: form-data; name=\"file\"; filename=\"f.bin\"\r\n"
+            . "Swoole-Upload-File: {$target}\r\nContent-Type: application/octet-stream\r\n\r\nabc\r\n--b--\r\n";
+        $client = new Swoole\Coroutine\Http\Client('127.0.0.1', 9501);
+        $client->setHeaders(['Content-Type' => 'multipart/form-data; boundary=b']);
+        $client->post('/', $body);
+        Swoole\Coroutine::sleep(0.5);
+        $status = $client->statusCode;
+        $server->shutdown();
+    });
+});
+$server->start();
+
+$kept = file_exists($target);
+echo "status {$status}, target ", $kept ? 'kept' : 'deleted', PHP_EOL;
+exit($status === 200 && $kept ? 0 : 1);
diff --git a/versions/8.3.env b/versions/8.3.env
index 74c4aee..5b33d1c 100644
--- a/versions/8.3.env
+++ b/versions/8.3.env
@@ -3,7 +3,7 @@ PHP_VERSION=8.3
 ALPINE_VERSION=3.23
 PHP_API=20230831
 PHP_REDIS_VERSION=6.3.0
-PHP_SWOOLE_VERSION=v6.2.4
+PHP_SWOOLE_VERSION=v6.2.5
 PHP_IMAGICK_VERSION=3.8.1
 PHP_YAML_VERSION=2.3.0
 PHP_MAXMINDDB_VERSION=v1.12.0
diff --git a/versions/8.4.env b/versions/8.4.env
index 92aca0c..3932eba 100644
--- a/versions/8.4.env
+++ b/versions/8.4.env
@@ -3,7 +3,7 @@ PHP_VERSION=8.4
 ALPINE_VERSION=3.23
 PHP_API=20240924
 PHP_REDIS_VERSION=6.3.0
-PHP_SWOOLE_VERSION=v6.2.4
+PHP_SWOOLE_VERSION=v6.2.5
 PHP_IMAGICK_VERSION=3.8.1
 PHP_YAML_VERSION=2.3.0
 PHP_MAXMINDDB_VERSION=v1.12.0
diff --git a/versions/8.5.env b/versions/8.5.env
index 0ba8d10..cce65bd 100644
--- a/versions/8.5.env
+++ b/versions/8.5.env
@@ -3,7 +3,7 @@ PHP_VERSION=8.5.12
 ALPINE_VERSION=3.23
 PHP_API=20250925
 PHP_REDIS_VERSION=6.3.0
-PHP_SWOOLE_VERSION=v6.2.4
+PHP_SWOOLE_VERSION=v6.2.5
 PHP_IMAGICK_VERSION=3.8.1
 PHP_YAML_VERSION=2.3.0
 PHP_MAXMINDDB_VERSION=v1.12.0