Skip to content

fix(security): Stop publishing EOL PHP 8.1 and reject vulnerable dev runtimes - #168

Merged
vitormattos merged 2 commits into
mainfrom
security/php-rce-fixes-2026-10-21
Oct 22, 2026
Merged

vitormattos merged 2 commits into
mainfrom
security/php-rce-fixes-2026-10-21

Conversation

@vitormattos

@vitormattos vitormattos commented Oct 21, 2026 •

Copy link
Copy Markdown
Member

Summary

  • Pin PHP 8.2.35 and 8.3.36 development bases by verified OCI digest.
  • Stop publishing PHP 8.1; use Dependabot for future Docker updates instead of scheduled PHP rebuilds.
  • Fix missing Buildx step IDs used by the workflows.

Validation

Actionlint and 14 worker contract tests passed locally. GitHub image/integration checks must pass before merge.

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos
vitormattos merged commit 34e7cb2 into main Oct 22, 2026
12 checks passed
@vitormattos
vitormattos deleted the security/php-rce-fixes-2026-10-21 branch October 22, 2026 18:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant