Repository navigation
Conversation
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Ticket: UID2-8161 Branch: syw-UID2-8161-bump-php-wordpress-fixture
sunnywu
changed the title
aram356
left a comment
aram356
left a comment
There was a problem hiding this comment.
Thanks for the contribution, @sunnywu.
php:8.3-cli-alpine already resolves to 8.3.36: on Docker Hub its amd64 image has the same digest as php:8.3.36-cli-alpine (sha256:74c3e6f3f78d...). CI builds this fixture on fresh runners with no image cache, so every run already pulls the patched release. Pinning the tag would stop the fixture from picking up the next PHP and Alpine fixes on its own, so we'd like to keep the floating tag (inline suggestion on the FROM line).
🔧 wrench: To keep the base image current without manual bumps, please add a Docker entry to .github/dependabot.yml in this PR instead:
- package-ecosystem: "docker"
directory: "/crates/trusted-server-integration-tests/fixtures/frameworks/wordpress"
schedule:
interval: "weekly"Patch releases keep arriving through the floating tag, and Dependabot opens a PR when a newer PHP line is published (it should propose 8.5-cli-alpine today).
| # docker run -p 8080:80 test-wordpress:latest | ||
|
|
||
| FROM php:8.3-cli-alpine | ||
| FROM php:8.3.36-cli-alpine3.23 |
There was a problem hiding this comment.
🔧 wrench: Keep the floating tag. It already resolves to 8.3.36, and this pin also moves the base from Alpine 3.24 (what 8.3-cli-alpine uses) back to 3.23.
| FROM php:8.3.36-cli-alpine3.23 | |
| FROM php:8.3-cli-alpine |
Pins the WordPress integration-test fixture base image from the floating
php:8.3-cli-alpinetag tophp:8.3.36-cli-alpine3.23.8.3.36 is the fixed release for CVE-2026-109618 and CVE-2026-109619 (8.3.x before 8.3.36 is affected). The floating tag already resolves to 8.3.36 today; pinning makes the patched version explicit so Dockerfile-based scanners stop flagging it. The image is only used by the integration tests and is never deployed.
🤖 Generated with Claude Code