[stasadev]

Short Summary (TL;DR)

Adds the DDEV v1.25.5 release post, with before/after recordings of the rebuilt ddev tui, and records how to make such recordings in the blog-images skill. The post explains that the PHP fixes for CVE-2026-109618 and CVE-2026-109619 matter locally only with ddev share or casual hosting, and that production servers need the PHP update.

How This PR Solves The Issue

The post follows the v1.25.4 one and the release notes in ddev/ddev#8926. The three ddev tui WebPs stack v1.25.4 above v1.25.5 and were recorded with VHS against demo projects in an isolated global config; their tapes and ffmpeg filter graphs are in public/img/blog/2026/10/vhs/ so they can be re-recorded.

The blog-images skill gets a new gif-comparison.md with what took several attempts to get right for these recordings: demo projects in an isolated DDEV_XDG_CONFIG_HOME instead of real ones, a font size that stays readable after the blog scales the image, short clips per feature with captions shown before each key, and timing captions from ffmpeg scene detection, because VHS sleeps do not match video time.

Manual Testing Instructions

Open https://pr-759.ddev-com-fork-previews.pages.dev/blog/release-v1-25-5/ and compare it with the v1.25.4 post at https://ddev.com/blog/release-v1-25-4/. Check that the three ddev tui recordings play and are readable at the column width, and that the ddev launch --qr screenshot shows the whole QR code.

Release/Deployment Notes

Before publishing, replace the 8.5.XX-style PHP versions and the PHP announcement link, check the PR count, and drop the Ctrl-C and symlinked agent socket sentences if ddev/ddev#8954 or ddev/ddev#8963 don't make the release.

🤖 Developed with assistance from Claude Code

[github-actions]

🌐 Fork Preview for PR #759

https://pr-759.ddev-com-fork-previews.pages.dev

This preview updates automatically when you push changes to your fork.

[rfay]

Comment by Claude Code, at @rfay's request.

Looks good overall. The PHP security section needs the same fixes that went into the v1.25.5 release notes today, and a few changes that affect users are missing. Line numbers refer to src/content/blog/release-v1-25-5.md at 10a1051.

1. PHP versions, line 20: replace the 8.5.XX-style placeholders with 8.5.12, 8.4.27, 8.3.36, and 8.2.35, the fixed releases, which deb.sury.org has for amd64 now. The link still points at https://www.php.net/ instead of the announcement.

2. The Dockerfile.update workaround, line 36: (apt-get update || true) hides a failed update, so the build can succeed without upgrading anything. The release notes now use the line below, which I ran as an apt dry run in v1.25.4's ddev-webserver image:

   RUN apt-get update && apt-get install -y --only-upgrade 'php*'

3. The tested example, line 41: it goes from 8.3.33 to 8.3.35, but the fixed version is 8.3.36, so a reader comparing php -v against it will be confused. Rerun it now or drop the version numbers.

4. mod_php vs PHP-FPM, line 22: add one sentence saying that DDEV runs PHP-FPM, not Apache's mod_php, which is what the published exploit targets, but that PHP-FPM is also considered vulnerable.

5. PHP 8.6, line 20 and lines 45-53: ddev-webserver ships 8.6, so say whether the 8.6 prerelease includes the fix. This is still a TODO in the release notes too.

6. Customized nginx config, line 43: anyone who removed #ddev-generated from .ddev/nginx_full/nginx-site.conf doesn't get the new rule that denies PHP in upload directories. Tell them to merge it into their copy.

7. Missing from "Changes That Might Affect You", lines 134-140:

   • ddev delete now exits with an error, and keeps the project listed, when it can't remove a volume. Before, it reported success.
   • From ddev/ddev#8929:
     • The database buffer pool drops from 1024M to 512M, which can slow large imports.
     • The connection collation is now utf8mb4_unicode_520_ci on MySQL 8.0/8.4/9.7 and MariaDB 11+, which can change how strings compare and sort.
     • Each project's database volume grows by about 160-210M on the first start after upgrading.