changelog: images updates, 2026W46

archetypes/applications.md

@@ -29,7 +29,7 @@ The [getting started guide](/doc/getting-started/) describes each step of the cr
 
 A {{ replace .File.ContentBaseName "-" " " | title }} application needs:
 
-- A project file, at the root of the project or of the folder set in `APP_FOLDER`
+- A project file, at the root of the project or of the folder set in `CC_APP_FOLDER`
 - A web server listening on `0.0.0.0`, on [the port in `PORT`](/doc/manage/#listen-on-the-right-port)
 
 <!-- If the runtime doesn't need a project file, replace or remove its item. Explain what the project file and its lock file, if the ecosystem has one, are for. Then show a minimal application that reads PORT, with the command to try it locally. If Clever Cloud starts a managed web server, such as Puma for Ruby, replace the web server item and explain this server instead. -->

content/changelog/2026/11-10-images-update.md

@@ -0,0 +1,104 @@
+---
+title: "Images update: FrankenPHP and Python security fixes, Chromium 157, Clever Tools 5.4, Gradle 9.9, CC_APP_FOLDER"
+description: FrankenPHP 1.13.5 and Python security releases, Chromium 157, Clever Tools 5.4, Gradle 9.9, Hugo 0.168 and 0.169, the CC_APP_FOLDER variable, Zola auto-build with zola.toml, and a fix for workers
+date: 2026-11-10
+tags:
+  - images
+  - update
+authors:
+  - name: David Legrand
+    link: https://github.com/davlgd
+    image: https://github.com/davlgd.png?size=40
+excludeSearch: true
+---
+
+We updated all our images. Deployment is in progress for all our users.
+
+- **Common:**
+  - Chromium 157.0.8103.38
+  - Clever Tools 5.4.0
+  - ExifTool 13.61
+  - Mise 2026.11.2
+  - OAuth2 Proxy 7.15.6
+  - OpenSSH 10.6_p2
+  - Poppler 26.11.0
+  - ProxySQL 2.7.4
+  - rsync 3.5.2
+  - Subversion 1.15.0
+  - Tailscale 1.104.5
+- **Docker:**
+  - Update to 29.9.3
+  - Buildx 0.38.2
+  - OpenVPN 2.7.9
+- **FrankenPHP:**
+  - Update to 1.13.5 (PHP 8.5.12, Caddy 2.11.9)
+- **Java:**
+  - Update to 1.8.0.512_p09
+  - Update to 11.0.33_p10
+  - Gradle 9.9.0
+- **Node.js & Bun:**
+  - nvm 0.41.0
+- **PHP:**
+  - MongoDB extension 1.21.12 (PHP 8.1 to 8.4)
+  - xdebug extension 3.5.3
+- **Python:**
+  - Update to 3.11.18
+  - Update to 3.12.16
+  - Update to 3.13.18
+  - Update to 3.14.10
+  - pip 26.3
+  - uv 0.13.7
+- **Rust:**
+  - rustup 1.29.3
+- **Static:**
+  - Caddy 2.11.9
+  - Hugo 0.168.0 and 0.169.0 are now available
+
+## FrankenPHP 1.13.5
+
+[FrankenPHP](/doc/deploy/applications/frankenphp/) 1.13.5 is a security release that fixes 17 vulnerabilities. The most severe one let `php_server` run an uploaded file as PHP when its path contained a PHP extension, such as `/uploads/photos.php.php/avatar.jpg`. Others include an open redirect, a `Host` spoofing over HTTP/2, a crash a client could trigger, and slow request bodies blocking every PHP thread.
+
+In worker mode, FrankenPHP now only resets between requests the state built from the HTTP request. The values of `error_get_last()`, `strtok()`, `http_get_last_response_headers()`, and the libxml errors persist again. Call `error_clear_last()`, `libxml_clear_errors()`, or `http_clear_last_response_headers()` if you need a clean state.
+
+FrankenPHP now answers `400` to requests that are ambiguous about the script they run. A client header can no longer override a variable set with `env`. This release embeds Caddy 2.11.9, also used by [Static](/doc/deploy/applications/static/) applications. Since 2.11.8, Caddy validates its configuration more strictly, and rejects some settings it silently accepted before.
+
+- [Read the FrankenPHP 1.13.5 release notes](https://github.com/php/frankenphp/releases/tag/v1.13.5)
+- [Read the Caddy 2.11.8 release notes](https://github.com/caddyserver/caddy/releases/tag/v2.11.8)
+- [Read the Caddy 2.11.9 release notes](https://github.com/caddyserver/caddy/releases/tag/v2.11.9)
+
+## Python security releases
+
+Python 3.11.18, 3.12.16, 3.13.18, and 3.14.10 are [expedited security releases](https://blog.python.org/2026/10/python-3152-31410-31318-31216-31118). They distrust the compromised intermediate certificates of the [eMudhra certificate authority](/changelog/2026/10-21-images-update/#emudhra-certificate-authorities-distrust). They also make the `tarfile` extraction filters reject links that replace their destination. Python 3.11, 3.12, and 3.13 also update the bundled Expat library to 2.9.0.
+
+If your application requests a Python branch, such as `3.13`, it gets the fixed release at its next deployment.
+
+- [Learn more about Python on Clever Cloud](/doc/deploy/applications/python/)
+
+## CC_APP_FOLDER
+
+`CC_APP_FOLDER` replaces `APP_FOLDER` to deploy an application from a folder of your repository. The previous name still works, with a deprecation warning in the deployment logs. If you set both, the deployment fails: keep only the new one.
+
+Clever Cloud now uses this folder more consistently:
+
+- Clever Cloud reads `mise.toml`, or the file set in `CC_MISE_FILE_PATH`, from this folder
+- Linux applications read the Makefile of their build and run commands from this folder
+- FrankenPHP and Static applications look for `CC_WEBROOT` in this folder first, then at the root of the repository
+
+In FrankenPHP and Static applications, the deployment now fails when the `CC_WEBROOT` folder doesn't exist after the build, or when its path has a `..` segment. In Static applications, the build command is the last step that can create this folder.
+
+## Zola auto-build with zola.toml
+
+The [auto-build](/doc/deploy/applications/static/#static-site-generators-ssg-auto-build) of Static applications now detects a [Zola](https://www.getzola.org) project from its `zola.toml` file, in addition to `config.toml`.
+
+The first images update after December 1, 2026 will stop detecting `config.toml`, to avoid conflicts with other tools that use this file name. If your Zola website relies on the auto-build, rename this file to `zola.toml` before this date.
+
+## Other changes
+
+- Clever Cloud now deletes the `.nvmrc` file on every runtime, [as announced](/changelog/2026/11-05-nvmrc-all-runtimes/): set the version with `CC_NODE_VERSION`
+- [Workers](/doc/manage/workers/) no longer start on dedicated build instances, nor with Clever Tasks: they only run next to your application
+- A Ruby application without a `Gemfile.lock` or `gems.locked` file now fails at the start of its deployment
+- The `memcache` extension is now loaded with PHP 8.5
+
+## Linux Kernel
+
+Kernel is [now updated independently](/changelog/2026/05-12-linux-kernel-7.0.6). Current version is 7.2.15.

content/doc/deploy/applications/docker.md

@@ -71,7 +71,7 @@
 - A web server listening on `0.0.0.0:8080` in the container
 - A command that starts your application, set with `CMD` or `ENTRYPOINT` in your Dockerfile or in its base image
 
-To use another file, set its path in `CC_DOCKERFILE`, such as `docker/Dockerfile.prod`. With `APP_FOLDER`, Clever Cloud looks for the `Dockerfile` in this folder. To listen on another port, set it in `CC_DOCKER_EXPOSED_HTTP_PORT`. A [Clever Task](#docker-applications-as-clever-tasks) doesn't need a web server.
+To use another file, set its path in `CC_DOCKERFILE`, such as `docker/Dockerfile.prod`. With `CC_APP_FOLDER`, Clever Cloud looks for the `Dockerfile` in this folder. To listen on another port, set it in `CC_DOCKER_EXPOSED_HTTP_PORT`. A [Clever Task](#docker-applications-as-clever-tasks) doesn't need a web server.
 
 In most cases, `CMD` gives the whole command, such as `CMD ["node", "server.js"]`. If the image sets an `ENTRYPOINT`, it's the program to run, and `CMD` only gives its arguments, as in the following example. Learn more in the [Docker documentation](https://docs.docker.com/reference/dockerfile/#understand-how-cmd-and-entrypoint-interact).
 
@@ -95,7 +95,7 @@
 
 ### Build phase
 
-On a new build, Clever Cloud builds the image with [Buildx](https://docs.docker.com/build/). The build context is the root of your project, or the folder set in `APP_FOLDER`. Set `CC_DOCKER_BUILDX=false` to use the legacy builder instead (deprecated, and to be removed).
+On a new build, Clever Cloud builds the image with [Buildx](https://docs.docker.com/build/). The build context is the root of your project, or the folder set in `CC_APP_FOLDER`. Set `CC_DOCKER_BUILDX=false` to use the legacy builder instead (deprecated, and to be removed).
 
 Clever Cloud passes each [environment variable](/doc/manage/environment-variables/) of your application with `--build-arg`. Declare the ones a build step needs with an [`ARG`](https://docs.docker.com/reference/dockerfile/#arg) instruction. For instance, a [Vite](https://vite.dev/) application embeds its `VITE_*` variables in its files at build time. With a `VITE_API_URL` environment variable, this Dockerfile builds the application, then serves it with Nginx. Declare `ARG` in the stage that uses it:
 

content/doc/deploy/applications/dotnet.md

@@ -45,7 +45,7 @@ clever create --type dotnet
 
 A .NET application needs:
 
-- A project file, at the root of the project or of the folder set in `APP_FOLDER`
+- A project file, at the root of the project or of the folder set in `CC_APP_FOLDER`
 - A web server listening on `0.0.0.0`, on [the port in `PORT`](/doc/manage/#listen-on-the-right-port)
 
 The project file is a `.csproj` file for C#, `.fsproj` for F#, or `.vbproj` for Visual Basic. It describes the [version of .NET your code targets](#net-version-and-target-framework), and the libraries it uses, called NuGet packages. A [Clever Task](#net-applications-as-clever-tasks) doesn't need a web server.
@@ -102,7 +102,7 @@ clever env set CC_DOTNET_VERSION 10.0
 
 ### Several projects or target frameworks
 
-Clever Cloud looks for project files at the root of the repository, or of the folder set in `APP_FOLDER`, but not in the folders below. If your web project is in `src/Api/`, for instance, set `APP_FOLDER=src/Api`.
+Clever Cloud looks for project files at the root of the repository, or of the folder set in `CC_APP_FOLDER`, but not in the folders below. If your web project is in `src/Api/`, for instance, set `CC_APP_FOLDER=src/Api`.
 
 If this folder holds several project files, set the one to publish in `CC_DOTNET_PROJ`, by its name without extension:
 
@@ -161,7 +161,7 @@ To pass arguments, set `CC_RUN_COMMAND`. It runs from the root of the repository
 clever env set CC_RUN_COMMAND "./bin/Release/net8.0/exherbo-x64/publish/hello --verbose"
 ```
 
-With `APP_FOLDER`, start the path of the executable with this folder.
+With `CC_APP_FOLDER`, start the path of the executable with this folder.
 
 ### Caches
 

content/doc/deploy/applications/elixir.md

@@ -45,7 +45,7 @@ clever create --type elixir
 
 An Elixir application needs:
 
-- A `mix.exs` file and its `mix.lock` file, at the root of the project or of the folder set in `APP_FOLDER`
+- A `mix.exs` file and its `mix.lock` file, at the root of the project or of the folder set in `CC_APP_FOLDER`
 - A web server listening on `0.0.0.0`, on [the port in `PORT`](/doc/manage/#listen-on-the-right-port)
 
 Mix is the build tool of Elixir. `mix.exs` describes your project and its dependencies. `mix deps.get` records their exact versions in `mix.lock`: commit it, so that the build fetches the versions you tested. A [Clever Task](#elixir-applications-as-clever-tasks) doesn't need a web server.

content/doc/deploy/applications/golang.md

@@ -49,7 +49,7 @@ clever create --type go
 
 A Go application needs:
 
-- A `go.mod` file, at the root of the project or of the folder set in `APP_FOLDER`, or a [Makefile](#build-with-a-makefile)
+- A `go.mod` file, at the root of the project or of the folder set in `CC_APP_FOLDER`, or a [Makefile](#build-with-a-makefile)
 - A `main` package at the root of the module, or the path of another one set in [`CC_GO_PKG`](#build-another-package)
 - A web server listening on `0.0.0.0`, on [the port in `PORT`](/doc/manage/#listen-on-the-right-port), unless the application runs as a [Clever Task](#go-applications-as-clever-tasks)
 
@@ -149,7 +149,7 @@ By default, Clever Cloud starts the binary without arguments, from a folder that
 clever env set CC_RUN_COMMAND "hello --workers 4"
 ```
 
-This command runs in a shell, from the root of your repository, even when `APP_FOLDER` sets another folder. Start it with `cd api &&` to keep the relative paths of an `api` folder. With a Makefile, call the binary with its path from this root, such as `./bin/app`.
+This command runs in a shell, from the root of your repository, even when `CC_APP_FOLDER` sets another folder. Start it with `cd api &&` to keep the relative paths of an `api` folder. With a Makefile, call the binary with its path from this root, such as `./bin/app`.
 
 ### Caches
 

content/doc/deploy/applications/haskell.md

@@ -45,7 +45,7 @@ clever create --type haskell
 
 A Haskell application needs:
 
-- A `stack.yaml` file, at the root of the project or of the folder set in `APP_FOLDER`
+- A `stack.yaml` file, at the root of the project or of the folder set in `CC_APP_FOLDER`
 - A package described in a `.cabal` or a `package.yaml` file, with one executable
 - A web server listening on `0.0.0.0`, on [the port in `PORT`](/doc/manage/#listen-on-the-right-port)
 
@@ -116,7 +116,7 @@ clever env set CC_HASKELL_STACK_TARGET hello
 
 ### Custom run command
 
-By default, Clever Cloud starts the executable Stack built, which it looks for in the `.stack-work/install` folder at the root of the repository. If your project is in an `APP_FOLDER`, has several executables, or needs arguments, set `CC_RUN_COMMAND`. It runs from the root of the repository: call the executable by its name, as `stack install` copies it to `~/.local/bin`. For instance, for the `site` executable of a [Hakyll](https://jaspervdj.be/hakyll/) website:
+By default, Clever Cloud starts the executable Stack built, which it looks for in the `.stack-work/install` folder at the root of the repository. If your project is in a `CC_APP_FOLDER` folder, has several executables, or needs arguments, set `CC_RUN_COMMAND`. It runs from the root of the repository: call the executable by its name, as `stack install` copies it to `~/.local/bin`. For instance, for the `site` executable of a [Hakyll](https://jaspervdj.be/hakyll/) website:
 
 ```bash
 clever env set CC_RUN_COMMAND 'site server --host 0.0.0.0 --port $PORT'

content/doc/deploy/applications/linux.md

@@ -87,7 +87,7 @@ Clever Cloud looks for the build command and the start command separately, in th
 
 Each source only fills in the commands that a previous one doesn't define. For instance, you can set `CC_BUILD_COMMAND` only, and let a `run` task of Mise or a `run` target of a Makefile provide the start command.
 
-Clever Cloud looks for these files at the root of your repository, even with `APP_FOLDER`, before the pre-build [hook](/doc/manage/build-hooks/): a hook can't create them. It runs the Mise tasks from the folder of `mise.toml`, which `CC_MISE_FILE_PATH` can move. For the Makefile, it uses the first file it finds among:
+Clever Cloud looks for these files at the root of your project, or of the `CC_APP_FOLDER` folder, before the pre-build [hook](/doc/manage/build-hooks/): a hook can't create them. It runs the Mise tasks from the folder of `mise.toml`, which `CC_MISE_FILE_PATH` can move. For the Makefile, it uses the first file it finds among:
 
 - The file set in `CC_MAKEFILE`
 - `GNUmakefile`, `Makefile`, then `makefile`
@@ -96,11 +96,11 @@ It checks each target with `make --dry-run`, and ignores the ones that fail. Wit
 
 ### Build phase
 
-Before an instance starts, Mise installs the tools of `mise.toml`. On a new build, Clever Cloud then runs the pre-build hook, the build command, and the post-build hook. `CC_BUILD_COMMAND` and the Makefile targets run from the root of your project, or from the folder set in `APP_FOLDER`.
+Before an instance starts, Mise installs the tools of `mise.toml`. On a new build, Clever Cloud then runs the pre-build hook, the build command, and the post-build hook. `CC_BUILD_COMMAND` and the Makefile targets run from the root of your project, or from the folder set in `CC_APP_FOLDER`.
 
 ### Start command
 
-A `run` target of a Makefile runs from the root of your project, or from the folder set in `APP_FOLDER`. A Mise task runs from the folder of `mise.toml`. `CC_RUN_COMMAND` runs from the root of the repository, through a shell: it reads variables such as `$PORT`.
+A `run` target of a Makefile runs from the root of your project, or from the folder set in `CC_APP_FOLDER`. A Mise task runs from the folder of `mise.toml`. `CC_RUN_COMMAND` runs from the root of the repository, through a shell: it reads variables such as `$PORT`.
 
 ### Caches
 

content/doc/deploy/applications/meteor.md

@@ -42,7 +42,7 @@ Use the `meteor` type: a [Node.js application](/doc/deploy/applications/nodejs/)
 
 A Meteor.js application needs:
 
-- The `.meteor` folder and `package.json` file, at the root of the project or of the folder set in `APP_FOLDER`
+- The `.meteor` folder and `package.json` file, at the root of the project or of the folder set in `CC_APP_FOLDER`
 - The Node.js version of your Meteor release, set in [`engines.node`](#nodejs-version)
 - A MongoDB database, set in `MONGO_URL`
 - The URL of your application, set in `ROOT_URL`
@@ -134,7 +134,7 @@ To pass arguments to your application, set `CC_RUN_COMMAND`. It runs from the ro
 clever env set CC_RUN_COMMAND "node .build/bundle/main.js --my-option"
 ```
 
-With `APP_FOLDER`, start the path of the bundle with this folder.
+With `CC_APP_FOLDER`, start the path of the bundle with this folder.
 
 ### Caches
 

content/doc/deploy/applications/ruby.md

@@ -51,7 +51,7 @@ clever create --type ruby
 
 ### Mandatory needs
 
-A Ruby application needs, at the root of the project or of the folder set in `APP_FOLDER`:
+A Ruby application needs, at the root of the project or of the folder set in `CC_APP_FOLDER`:
 
 - A `Gemfile` with the `puma` gem, and its committed `Gemfile.lock`
 - A `config.ru` file

content/doc/deploy/applications/rust.md

@@ -46,7 +46,7 @@ clever create --type rust
 
 A Rust application needs:
 
-- A `Cargo.toml` file with at least one binary target, at the root of the project or of the folder set in `APP_FOLDER`
+- A `Cargo.toml` file with at least one binary target, at the root of the project or of the folder set in `CC_APP_FOLDER`
 - A committed `Cargo.lock` file: the build runs with `--locked`, so it fails if `Cargo.lock` is missing or out of date
 - A web server listening on `0.0.0.0`, on [the port in `PORT`](/doc/manage/#listen-on-the-right-port), unless the application runs as a [Clever Task](#rust-binaries-as-clever-tasks)
 
@@ -142,7 +142,7 @@ Set `CC_RUST_INSTALL=true` to build with `cargo install` instead of `cargo build
 
 ### Custom run command
 
-By default, Clever Cloud starts the selected binary without arguments. To pass arguments, or start something else, set `CC_RUN_COMMAND`. It runs from the folder of your project, the one set in `APP_FOLDER` if any. For a `web` binary that accepts a `--workers` option:
+By default, Clever Cloud starts the selected binary without arguments. To pass arguments, or start something else, set `CC_RUN_COMMAND`. It runs from the folder of your project, the one set in `CC_APP_FOLDER` if any. For a `web` binary that accepts a `--workers` option:
 
 ```bash
 clever env set CC_RUN_COMMAND "./target/release/web --workers 4"