What happened?
The floating Docker tag dunglas/frankenphp:1-php8.4-alpine still resolves to an image that contains golang.org/x/net v0.59.0. Trivy reports the fixed high-severity CVE-2026-78669 against that binary.
#2707 updated the dependency. It merged as 77b32f5517ec419725a945d12bc48ba10eabce6f. The v1.13.1 source tag contains golang.org/x/net v0.61.0. The v1.13.1 Docker-image build completed successfully. Its explicit image tag, dunglas/frankenphp:1.13.1-php8.4-alpine, is available.
Could 1-php8.4-alpine be repointed to the v1.13.1 image? Alternatively, could the intended major-tag policy be documented? The current state leaves users of the documented major tag on an older image despite the nightly-rebuild statement in SECURITY.md.
This is related to #2459. That issue tracks a different HTTP/2 denial-of-service concern, so this is not a duplicate.
Build Type
Docker (Alpine)
Worker Mode
No
Operating System
GNU/Linux
CPU Architecture
x86_64
PHP configuration
Not applicable. The discrepancy is visible in the published image and its source tag.
Relevant log output
usr/local/bin/frankenphp (gobinary)
Library: golang.org/x/net
Vulnerability: CVE-2026-78669
Severity: HIGH
Installed Version: v0.59.0
Fixed Version: 0.60.0
What happened?
The floating Docker tag
dunglas/frankenphp:1-php8.4-alpinestill resolves to an image that containsgolang.org/x/net v0.59.0. Trivy reports the fixed high-severity CVE-2026-78669 against that binary.#2707 updated the dependency. It merged as 77b32f5517ec419725a945d12bc48ba10eabce6f. The v1.13.1 source tag contains
golang.org/x/net v0.61.0. The v1.13.1 Docker-image build completed successfully. Its explicit image tag,dunglas/frankenphp:1.13.1-php8.4-alpine, is available.Could
1-php8.4-alpinebe repointed to the v1.13.1 image? Alternatively, could the intended major-tag policy be documented? The current state leaves users of the documented major tag on an older image despite the nightly-rebuild statement in SECURITY.md.This is related to #2459. That issue tracks a different HTTP/2 denial-of-service concern, so this is not a duplicate.
Build Type
Docker (Alpine)
Worker Mode
No
Operating System
GNU/Linux
CPU Architecture
x86_64
PHP configuration
Not applicable. The discrepancy is visible in the published image and its source tag.
Relevant log output