From 77ea8cb693e10b0403ae530a41e5f2fc598d3f28 Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Fri, 23 Oct 2026 12:18:23 +0530 Subject: [PATCH] fix(php): drop deprecated session ID ini settings from 8.4 and 8.5 session.sid_length and session.sid_bits_per_character are deprecated as of PHP 8.4: setting either one raises an E_DEPRECATED at startup, which shows up in php -i, php-fpm -t and the FPM log whenever error_reporting includes E_DEPRECATED. PHP's own php.ini-production for 8.4 and later no longer sets them. Remove both directives and their quick-reference entries from the 8.4 and 8.5 php.ini, matching upstream. Newly created session IDs fall back to PHP's defaults, 32 characters of 0-9a-f (128 bits) instead of 26 characters of 0-9a-v (130 bits). IDs issued before the change are still accepted. The 5.6 to 8.3 and stable images keep the settings, since they are valid there and changing them would only alter session IDs without removing a deprecation. --- php/8.4/php.ini | 26 -------------------------- php/8.5/php.ini | 26 -------------------------- 2 files changed, 52 deletions(-) diff --git a/php/8.4/php.ini b/php/8.4/php.ini index 01513ab..852ed21 100644 --- a/php/8.4/php.ini +++ b/php/8.4/php.ini @@ -143,11 +143,6 @@ ; Development Value: 1000 ; Production Value: 1000 -; session.sid_bits_per_character -; Default Value: 4 -; Development Value: 5 -; Production Value: 5 - ; short_open_tag ; Default Value: On ; Development Value: Off @@ -1475,15 +1470,6 @@ session.cache_expire = 180 ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 -; Set session ID character length. This value could be between 22 to 256. -; Shorter length than default is supported only for compatibility reason. -; Users should use 32 or more chars. -; http://php.net/session.sid-length -; Default Value: 32 -; Development Value: 26 -; Production Value: 26 -session.sid_length = 26 - ; The URL rewriter will look for URLs in a defined set of HTML tags. ;
is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended @@ -1509,18 +1495,6 @@ session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; Production Value: "" ;session.trans_sid_hosts="" -; Define how many bits are stored in each character when converting -; the binary hash data to something readable. -; Possible values: -; 4 (4 bits: 0-9, a-f) -; 5 (5 bits: 0-9, a-v) -; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") -; Default Value: 4 -; Development Value: 5 -; Production Value: 5 -; http://php.net/session.hash-bits-per-character -session.sid_bits_per_character = 5 - ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On diff --git a/php/8.5/php.ini b/php/8.5/php.ini index 01513ab..852ed21 100644 --- a/php/8.5/php.ini +++ b/php/8.5/php.ini @@ -143,11 +143,6 @@ ; Development Value: 1000 ; Production Value: 1000 -; session.sid_bits_per_character -; Default Value: 4 -; Development Value: 5 -; Production Value: 5 - ; short_open_tag ; Default Value: On ; Development Value: Off @@ -1475,15 +1470,6 @@ session.cache_expire = 180 ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 -; Set session ID character length. This value could be between 22 to 256. -; Shorter length than default is supported only for compatibility reason. -; Users should use 32 or more chars. -; http://php.net/session.sid-length -; Default Value: 32 -; Development Value: 26 -; Production Value: 26 -session.sid_length = 26 - ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended @@ -1509,18 +1495,6 @@ session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; Production Value: "" ;session.trans_sid_hosts="" -; Define how many bits are stored in each character when converting -; the binary hash data to something readable. -; Possible values: -; 4 (4 bits: 0-9, a-f) -; 5 (5 bits: 0-9, a-v) -; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") -; Default Value: 4 -; Development Value: 5 -; Production Value: 5 -; http://php.net/session.hash-bits-per-character -session.sid_bits_per_character = 5 - ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On