Docker: pin PHP 8.2.35 for CVE-2026-109618 and CVE-2026-109619

Resolve #2085. Pin the final image to php:8.2.35-fpm-alpine and add a container-structure-test that fails if the image ships a PHP older than 8.2.35.

.docker/release/Dockerfile

@@ -23,7 +23,9 @@ RUN set -eux; \
     rm -v /snappymail/README.md /snappymail/_include.php
 
 # Inspired by the original Rainloop dockerfile from youtous on GitLab
-FROM php:8.2-fpm-alpine AS final
+# PHP is pinned to a patch release so each image ships a known PHP version.
+# 8.2.35 fixes CVE-2026-109618 and CVE-2026-109619. Bump this on new PHP security releases.
+FROM php:8.2.35-fpm-alpine AS final
 
 LABEL org.label-schema.description="SnappyMail webmail client image using nginx, php-fpm on Alpine"
 

.docker/release/test/config.yaml

@@ -2,6 +2,12 @@
 # See: https://github.com/GoogleContainerTools/container-structure-test/issues/78
 schemaVersion: 2.0.0
 commandTests:
+  - name: PHP version includes fixes for CVE-2026-109618 and CVE-2026-109619
+    command: php
+    args:
+      - -r
+      - 'echo PHP_VERSION, PHP_EOL; exit(version_compare(PHP_VERSION, "8.2.35", ">=") ? 0 : 1);'
+    exitCode: 0
   - name: Integration test
     command: /bin/sh
     args: