Final release

[llegaz]

with CI complete and almost all proposed features tested (XDebug not tested/fixed yet)

[github-actions]

🔍 Vulnerabilities of dunglas/frankenphp:1-php8.5

📦 Image Reference dunglas/frankenphp:1-php8.5

digest	sha256:c2f94cde9ff8d4833901084ad83092ff25da4b062f43344ffbe67cde9365ef26
vulnerabilities
platform	linux/amd64
size	209 MB
packages	427

📦 Base Image php:8-zts

also known as	8-zts-trixie 8.5-zts 8.5-zts-trixie 8.5.4-zts 8.5.4-zts-trixie zts zts-trixie
digest	sha256:f9fb12da6b78017b3a4f46bcfa93a5d5b96e14efdf62f638be6903482a3d94d4
vulnerabilities

nghttp2 1.64.0-1.1 (deb) pkg:deb/debian/nghttp2@1.64.0-1.1?os_distro=trixie&os_name=debian&os_version=13 # Dockerfile (0:0) Affected range <=1.64.0-1.1 Fixed version Not Fixed EPSS Score 0.017% EPSS Percentile 4th percentile Description nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available. nghttp2 1.68.1-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131369) GHSA-6933-cjhr-5qg6 Fixed by: nghttp2/nghttp2@5c7df8f (v1.68.1)

openssl 3.5.5-1~deb13u1 (deb) pkg:deb/debian/openssl@3.5.5-1~deb13u1?os_distro=trixie&os_name=debian&os_version=13 # Dockerfile (0:0) Affected range <3.5.5-1~deb13u2 Fixed version 3.5.5-1~deb13u2 EPSS Score 0.021% EPSS Percentile 6th percentile Description Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue. openssl https://openssl-library.org/news/secadv/20260407.txt

[github-actions]

🔍 Vulnerabilities of debian:13-slim

📦 Image Reference debian:13-slim

digest	sha256:5fb70129351edec3723d13f427400ecae3f13b83750e23ad47c46721effcf2db
vulnerabilities
platform	linux/amd64
size	30 MB
packages	111

openssl 3.5.5-1~deb13u1 (deb) pkg:deb/debian/openssl@3.5.5-1~deb13u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <3.5.5-1~deb13u2 Fixed version 3.5.5-1~deb13u2 EPSS Score 0.021% EPSS Percentile 6th percentile Description Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue. openssl https://openssl-library.org/news/secadv/20260407.txt

[github-actions]

Super-linter summary

Language	Validation result
BASH	Pass ✅
BASH_EXEC	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
SHELL_SHFMT	Pass ✅
SPELL_CODESPELL	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

[llegaz]

reviewed

[github-actions]

Super-linter summary

Language	Validation result
BASH	Pass ✅
BASH_EXEC	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
SHELL_SHFMT	Pass ✅
SPELL_CODESPELL	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

[llegaz]

rebased and reviewed