forked from RoushTech/docker
frankenphp:8.5 ships 10 fixable CRITICAL/HIGH Go CVEs, and the 2026-08-11 rebuild did not move them #47
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
matthewbaggett/frankenphp:8.5ships a Go binary with 10 fixable CRITICAL/HIGHCVEs, and the 2026-08-11 rebuild did not move any of them.
Downstream this is
Someones.Computer#354,
where it fails the nightly CVE gate on every image built on this base.
What is in the binary
/usr/bin/frankenphp, in the current:8.5(=8.5-build-2026-08-11,sha256:053a6ec3ee8b84473a0f0adac974085df27bba401917c7d57f65e7ddddb643bdonamd64):
github.com/getkin/kin-openapigoogle.golang.org/grpcstdlibstdlibstdlibstdlibstdlibstdlibstdlibstdlibThe Alpine package set is clean —
trivyfinds 0 OS-package findings at anyseverity. This is entirely the one binary.
The 2026-08-11 rebuild changed nothing here
Worth stating plainly, because "the tag floats, so a rebuild picks up the fix"
is the reasonable assumption and it does not hold. The two builds are
byte-identical in the ways that matter to a scanner:
8.5-build-2026-08-048.5(=8.5-build-2026-08-11)Reproducing it
Scanning the image is not reliable here —
trivy imagereports thegobinarytarget on the 08-04 build and silently omits it on 08-11, on thesame trivy and the same cache, so an image-mode scan of the current tag looks
clean when it is not. Extract the binary and scan that:
That discrepancy is worth a look in its own right — if it is general rather
than specific to these two images, every consumer scanning this base in image
mode is getting a false green on Go findings.
Where the fix has to come from
FrankenPHP.Dockerfileinstalls a prebuilt package rather than buildingFrankenPHP:
from
pkg.henderkes.com, currentlyfrankenphp-1.12.7p85-r0. So nothing inthis repo can move these versions, and there is no newer upstream release to
move to either:
installed.
embedded. Caddy's
masteralready carriesgrpc v1.82.1, but no releasedoes yet.
kin-openapiis not in FrankenPHP'sgo.modat all — it arrivestransitively.
That leaves two routes, and the choice is yours rather than mine:
with
kin-openapiandgrpcbumped. Clears all ten at once, keeps thisrepo's build as simple as it is.
go getoverrides forthe two modules. Fixes it without waiting on anyone, at the cost of owning a
Go build in this repo — considerably more than the apk line it replaces.
Waiting for upstream releases to carry the bumps is a third option, but it is
not a plan with a date on it, and the downstream gate is red now.
Done when
matthewbaggett/frankenphp:8.5no longer shipskin-openapi< 0.144.0,grpc< 1.82.1, or a Go stdlib below 1.26.6.trivy rootfson the extracted binary reports no fixable CRITICAL/HIGH.