From fc1b7e2d3cff98ce184ea38a11a6e45c28527da0 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Thu, 22 Oct 2026 05:59:33 -0700 Subject: [PATCH] Move PHP from Remi 8.4 to 8.5 (security update) The php:remi-8.4 stream has a known exploit. Enable php:remi-8.5 instead (still unpinned to a patch version). Package list is unchanged and resolves on 8.5 (php-json is built in; json module present). Co-Authored-By: Claude Opus 5.5 --- Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index e50d8ad..5da9d46 100644 --- a/Dockerfile +++ b/Dockerfile @@ -28,9 +28,9 @@ ENV LANG=C.UTF-8 \ # the SaneSecurity rsync temp files at the end of the layer. # # Pinning strategy: -# - PHP 8.4: AlmaLinux 10 stock ships PHP 8.3 only; the spec asks for -# 8.4 specifically. We add Remi's modular repo and enable the -# `php:remi-8.4` stream. We DO NOT pin to a specific 8.4.X because +# - PHP 8.5: AlmaLinux 10 stock ships PHP 8.3 only; the spec asks for +# a current Remi stream (8.5; the 8.4 stream had a known exploit). We +# add Remi's modular repo and enable the `php:remi-8.5` stream. We DO NOT pin to a specific 8.5.X because # Remi rolls security patches into the same minor and an exact pin # would block updates. # - clamav / clamav-update: track the AL10 EPEL stream. CI builds @@ -50,11 +50,11 @@ RUN set -eux; \ dnf \ shadow-utils \ ; \ - # Add Remi's repo for PHP 8.4 (AL10 stock has 8.3 only). + # Add Remi's repo for PHP 8.5 (AL10 stock has 8.3 only). dnf -y --setopt=install_weak_deps=0 install \ https://rpms.remirepo.net/enterprise/remi-release-10.rpm ; \ dnf -y --setopt=install_weak_deps=0 module reset php ; \ - dnf -y --setopt=install_weak_deps=0 module enable php:remi-8.4 ; \ + dnf -y --setopt=install_weak_deps=0 module enable php:remi-8.5 ; \ # Pre-create the worker BEFORE installing clamav so virusgroup # doesn't claim our GID. groupadd --system --gid ${WHP_GID} whp-import ; \