Repository navigation
Upgrade Shabbat 3.1.0: MadelineProto 8.11.10, Layer 232 and current PHP security fixes - #23
Merged
Merged
Conversation
WizardLoop
changed the title
WizardLoop
marked this pull request as ready for review
October 22, 2026 20:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Upgrade Shabbat 3.1.0 to official MadelineProto 8.11.10 / Telegram layer 232, preserving existing stored templates, permission snapshots, calendar modules and SQLite migrations. A central keyboard boundary emits the current native constructors while supporting saved legacy keyboard formats. The legacy importer now binds review reports to the actual source/destination plan and verifies the applied result.
Remove the upstreamed UpdateLoop/cancellation, GeoPoint and formatted-date patches. Retain only the reviewed Fresh Peer and BroadcastManager patches, with pinned baselines, exact hash checks, behavioral coverage and the matching runtime source inventory. Simplify both READMEs and provide mirrored staging, backup, import and rollback guides.
Following the PHP security releases of 22 October 2026, require PHP 8.3.36 / 8.4.27 / 8.5.12 or later patches in those branches. Docker uses the registry-verified PHP 8.4.27 image digest. CI and release preparation assert exact patched runtime versions. Startup rejects unsupported PHP before opening a bot session. The Composer package graph stays locked.
Validation
Mandatory checks run on this PR's exact current head: PHP matrix, full unit/integration/regression suite, static analysis, syntax/style, Composer validation/platform/security audit, locale/documentation checks, patch verification, packaging regressions, and Docker builds including the generated deployment ZIP without Git metadata. Release assets must come from the successfully tested merge commit and pass an independent source/hash/license/secrets review.
Regression coverage includes actual SDK serialization for current keyboard/permission constructors, historical stored masks, raw fresh-peer evidence, cancellation classifications, the SDK stop/finalize boundary with modeled transport/flush, isolated process descriptors, legacy import/report binding and security-runtime boundaries. No tests or required gates are disabled.
Deployment and limits
This PR does not deploy, restart the active bot, change production data or contact real Telegram groups. Live client rendering, true session/IPC and signal behavior, paid operations, calendar transitions and prolonged live load/soak remain isolated deployment acceptance checks. Historical dev.9 live acceptance is not 3.1.0 acceptance. Source archive scope and original dependency licenses are retained explicitly.