From 79e465434a3ad3c1e1db5eee902ec4f65cf89c94 Mon Sep 17 00:00:00 2001 From: loks0n <22452787+loks0n@users.noreply.github.com> Date: Thu, 22 Oct 2026 10:42:04 +0100 Subject: [PATCH] fix: pin PHP 8.5.12 for CVE-2026-109618 and CVE-2026-109619 The 8.5 image followed the floating php:8.5 tag, so main's last build still carries 8.5.11. Pinning the patch release forces a rebuild on the fixed interpreter and keeps the next release from shipping an older one. Co-Authored-By: Claude Opus 5.5 --- versions/8.5.env | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/versions/8.5.env b/versions/8.5.env index d973204..e520ef7 100644 --- a/versions/8.5.env +++ b/versions/8.5.env @@ -1,4 +1,4 @@ -PHP_VERSION=8.5 +PHP_VERSION=8.5.12 # Pinned: an unpinned tag follows the newest Alpine, and 3.24's erofs-utils 1.9.1 cannot extract fragments/dedupe images. ALPINE_VERSION=3.23 PHP_API=20250925