[mrrobot47]

What

Remove session.sid_length and session.sid_bits_per_character (and their quick-reference entries) from php/8.4/php.ini and php/8.5/php.ini. This matches PHP's own php.ini-production for 8.4 and later, which no longer sets either directive.

Why

Both settings are deprecated as of PHP 8.4. Setting either one raises an E_DEPRECATED during startup:

PHP Deprecated:  PHP Startup: session.sid_length INI setting is deprecated in Unknown on line 0
PHP Deprecated:  PHP Startup: session.sid_bits_per_character INI setting is deprecated in Unknown on line 0

With the shipped error_reporting (E_ALL & ~E_DEPRECATED & ~E_STRICT) these are hidden, but they appear in php -i, php-fpm -t and the FPM log as soon as a site raises error_reporting to include E_DEPRECATED at the ini level, and the settings are slated for removal in a future PHP version.

Behaviour change

Only session ID generation on 8.4 and 8.5 changes. New IDs fall back to PHP's defaults:

	before	after
session.sid_length	26	32 (default)
session.sid_bits_per_character	5 (0-9a-v)	4 (0-9a-f, default)
entropy	130 bits	128 bits

IDs issued before the change are still accepted (checked with an existing 26-character 0-9a-v session, with session.use_strict_mode both off and on), so logged-in users are not signed out. Apart from these two keys, the effective ini (ini_get_all()) and the loaded modules are identical before and after.

The 5.6 to 8.3 and stable (7.4) images keep the settings: they are valid there, raise no deprecation, and removing them would only change session IDs.

This only affects newly created sites: the PHP config of an existing site lives in its own volume, which is populated from the image once, at creation.

Testing

Built php/8.4 and php/8.5 from this branch and compared each against the published easyengine/php8.4:v4.13.3 / easyengine/php8.5:v4.13.3 (same Dockerfiles, so php.ini is the only difference):

• before: php-fpm -t and php -i with error_reporting=-1 display_startup_errors=1 print both deprecations; a new session ID is 26 characters of 0-9a-v
• after: no deprecation; session.sid_length => 32, session.sid_bits_per_character => 4; a new session ID is 32 hex characters
• ini_get_all() differs only in the two keys; php -m is identical

Independent of #367: this touches only the two php.ini files and merges cleanly with it.

[Copilot]

🟢 Approval recommended

Both files consistently remove only the deprecated settings and associated comments, with no unresolved issues identified.

No open issues 🎉

What changed in this PR

Removes deprecated session ID settings from the PHP 8.4 and 8.5 image configurations, avoiding startup deprecations and restoring PHP’s default session ID generation.

Changes:

• Removes session.sid_length and session.sid_bits_per_character, allowing new IDs to use 32 hexadecimal characters.
• Removes the associated comments and quick-reference entries; older PHP configurations remain unchanged.

File	Description
php/​8.5/​php.ini	Removes deprecated session ID directives and associated comments.
php/​8.4/​php.ini	Applies the same cleanup to the PHP 8.4 configuration.

_{Review effort: Balanced}