deps(deps): update ansible/ansible-lint action to v25.7.0 #110

renovate · 2025-07-29T23:02:21Z

This PR contains the following updates:

Package	Type	Update	Change
ansible/ansible-lint	action	minor	`v25.6.1` -> `v25.7.0`

Release Notes

ansible/ansible-lint (ansible/ansible-lint)

`v25.7.0`

Compare Source

Enhancements

Use 'x-ansible-lint' key for path patterns in schema tests (#4690) @alisonlhart
Address disable_lookups deprecation with ansible-core 2.19 (#4683) @ssbarnea
Add auto-fixing implementation for pattern rule (#4679) @shatakshiiii
Remove patterns specific playbook meta folder (#4669) @alisonlhart
Allow loading of yamllint config from a different location (#4644) @dbrennand
Add new rule to validate pattern directory structure (#4662) @shatakshiiii
Add play argspec schema validation to schema rule (#4667) @alisonlhart
Add schema check for validating pattern specification file (#4653) @shatakshiiii
Enable testing with python 3.14 (#4637) @ssbarnea

Bugfixes

Check for gh_action_ref explicitly and document GHA inputs (#4701) @alisonlhart
jinja spacing warning line-endings (#4691) @anusshukla
Handle lookup templating checks with ASTs (#4698) @alisonlhart
Fix var-naming[no-role-prefix] rule incorrectly applying to role variables (#4677) @vills
schema: add missing subset 'systemd' to gather_subset (#4664) @eliba
Fix typos in --list-tags help text (#4661) @correctmost
Avoid import errors from filters when running in nodeps mode (#4651) @ssbarnea

Maintenance

packit: reformat, remove deprecated syntax and try merge queue (#4639) @mfocko
Remove patch report from codecov (#4671) @ssbarnea
Improve cspell configuration (#4668) @ssbarnea
Update test deps (#4658) @ssbarnea

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2025-07-29T23:03:12Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:d90e88506afe190999ea6ce16329d614408a9bb4e5d0f29030c5d7f6fbac1c8c`
vulnerabilities
platform	linux/amd64
size	108 MB
packages	247

📦 Base Image php:56992578823268ea128fe278fd23c5b82fefe8c76bb67ecaaaded5d3bfc89101

also known as	`8.1-alpine` `8.1-alpine3.21` `8.1-cli-alpine` `8.1-cli-alpine3.21` `8.1.33-alpine` `8.1.33-alpine3.21` `8.1.33-cli-alpine` `8.1.33-cli-alpine3.21`
digest	`sha256:b354796211589037af228ef6aa3a7663b6b8e8cee9e11aa317f5b260afb9b9f8`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

sqlite 3.48.0-r2 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.21

Affected range	`<3.48.0-r3`
Fixed version	`3.48.0-r3`
EPSS Score	`0.047%`
EPSS Percentile	`14th percentile`

Description

github-actions · 2025-07-29T23:03:14Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:3c93d4bdd1e7d8be8db566fe4c5c17b8a097c606f35fbe5f828806dee41ad0c4`
vulnerabilities
platform	linux/amd64
size	126 MB
packages	265

📦 Base Image php:56992578823268ea128fe278fd23c5b82fefe8c76bb67ecaaaded5d3bfc89101

also known as	`8.1-alpine` `8.1-alpine3.21` `8.1-cli-alpine` `8.1-cli-alpine3.21` `8.1.33-alpine` `8.1.33-alpine3.21` `8.1.33-cli-alpine` `8.1.33-cli-alpine3.21`
digest	`sha256:b354796211589037af228ef6aa3a7663b6b8e8cee9e11aa317f5b260afb9b9f8`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

setuptools 70.3.0 (pypi)

pkg:pypi/[email protected]

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected range	`<78.1.1`
Fixed version	`78.1.1`
CVSS Score	`7.7`
CVSS Vector	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P`
EPSS Score	`0.139%`
EPSS Percentile	`35th percentile`

Description

Summary

A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1

Details
    def _download_url(self, url, tmpdir):
        # Determine download filename
        #
        name, _fragment = egg_info_for_url(url)
        if name:
            while '..' in name:
                name = name.replace('..', '.').replace('\\', '_')
        else:
            name = "__downloaded__"  # default if URL has no path contents

        if name.endswith('.[egg.zip](http://egg.zip/)'):
            name = name[:-4]  # strip the extra .zip before download

 -->       filename = os.path.join(tmpdir, name)
Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88

os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter.
name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient.

Risk Assessment

As easy_install and package_index are deprecated, the exploitation surface is reduced.
However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.

Impact

An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

References

https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
pypa/setuptools#4946

sqlite 3.48.0-r2 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.21

Affected range	`<3.48.0-r3`
Fixed version	`3.48.0-r3`
EPSS Score	`0.047%`
EPSS Percentile	`14th percentile`

Description

github-actions · 2025-07-29T23:03:14Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:5a5fb295fac3c99f76492e0c2c1aad0316300823f5bab2ee09515e4b706a83fd`
vulnerabilities
platform	linux/amd64
size	108 MB
packages	250

📦 Base Image php:6895d0713f94121218fde3d48d359ad6a829ce6fcf3e8606f1514e04bca3d2be

also known as	`8.3-fpm-alpine` `8.3-fpm-alpine3.22` `8.3.23-fpm-alpine` `8.3.23-fpm-alpine3.22`
digest	`sha256:6d134d3d8edf3f9468cbc8de6489b942f0340914cc6c7bc00018ea838abdc5c4`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

git 2.49.1-r0 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.102%`
EPSS Percentile	`29th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.021%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.016%`
EPSS Percentile	`2nd percentile`

Description

stdlib 1.24.3 (golang)

pkg:golang/[email protected]

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.012%`
EPSS Percentile	`1st percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-07-29T23:03:14Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.1-alpine

Name	8.1.33-alpine3.21
Digest	sha256:b354796211589037af228ef6aa3a7663b6b8e8cee9e11aa317f5b260afb9b9f8
Vulnerabilities
Pushed	3 weeks ago
Size	36 MB
Packages	59
Flavor	alpine
OS	3.21
Runtime	8.1.33

The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.33-alpine, 8.1.33-alpine3.21, 8.1.33-cli-alpine, 8.1.33-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed
`8.1-alpine3.22` Patch runtime version update Also known as: 8.1.33-cli-alpine3.22 8.1-cli-alpine3.22 8.1.33-alpine3.22	Benefits: Patch runtime version update Same OS detected Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.1.33	3 weeks ago
`8.3-alpine` Minor runtime version update Also known as: 8.3.23-cli-alpine 8.3.23-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.23-alpine 8.3.23-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.23	3 weeks ago
`8.3-alpine3.21` Minor runtime version update Also known as: 8.3.23-cli-alpine3.21 8.3-cli-alpine3.21 8.3.23-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.21 Runtime: 8.3.23	3 weeks ago
`8.4-alpine3.21` Minor runtime version update Also known as: 8.4.10-cli-alpine3.21 8-cli-alpine3.21 cli-alpine3.21 alpine3.21 8.4.10-alpine3.21 8-alpine3.21	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.21 Runtime: 8.4.10	3 weeks ago
`8.4-alpine` Minor runtime version update Also known as: 8.4.10-cli-alpine 8.4.10-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4	3 weeks ago
`8.2-alpine` Minor runtime version update Also known as: 8.2.29-cli-alpine 8.2.29-cli-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.29-alpine 8.2.29-alpine3.22 8.2-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages 8.2-alpine was pulled 1.8K times last month Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.2.29	3 weeks ago
`8.2-alpine3.21` Minor runtime version update Also known as: 8.2.29-cli-alpine3.21 8.2-cli-alpine3.21 8.2.29-alpine3.21	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.2.29	3 weeks ago
`8.4.10-alpine` Minor runtime version update Also known as: 8.4.10-alpine3.22	Benefits: Same OS detected Minor runtime version update Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 44 MB Flavor: alpine OS: 3.22 Runtime: 8.4.10	3 weeks ago

github-actions · 2025-07-29T23:03:16Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.1-alpine

Name	8.1.33-alpine3.21
Digest	sha256:b354796211589037af228ef6aa3a7663b6b8e8cee9e11aa317f5b260afb9b9f8
Vulnerabilities
Pushed	3 weeks ago
Size	36 MB
Packages	59
Flavor	alpine
OS	3.21
Runtime	8.1.33

The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.33-alpine, 8.1.33-alpine3.21, 8.1.33-cli-alpine, 8.1.33-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed
`8.1-alpine3.22` Patch runtime version update Also known as: 8.1.33-cli-alpine3.22 8.1-cli-alpine3.22 8.1.33-alpine3.22	Benefits: Patch runtime version update Same OS detected Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.1.33	3 weeks ago
`8.3-alpine` Minor runtime version update Also known as: 8.3.23-cli-alpine 8.3.23-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.23-alpine 8.3.23-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.23	3 weeks ago
`8.3-alpine3.21` Minor runtime version update Also known as: 8.3.23-cli-alpine3.21 8.3-cli-alpine3.21 8.3.23-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.21 Runtime: 8.3.23	3 weeks ago
`8.4-alpine3.21` Minor runtime version update Also known as: 8.4.10-cli-alpine3.21 8-cli-alpine3.21 cli-alpine3.21 alpine3.21 8.4.10-alpine3.21 8-alpine3.21	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.21 Runtime: 8.4.10	3 weeks ago
`8.4-alpine` Minor runtime version update Also known as: 8.4.10-cli-alpine 8.4.10-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4	3 weeks ago
`8.2-alpine` Minor runtime version update Also known as: 8.2.29-cli-alpine 8.2.29-cli-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.29-alpine 8.2.29-alpine3.22 8.2-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages 8.2-alpine was pulled 1.8K times last month Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.2.29	3 weeks ago
`8.2-alpine3.21` Minor runtime version update Also known as: 8.2.29-cli-alpine3.21 8.2-cli-alpine3.21 8.2.29-alpine3.21	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.2.29	3 weeks ago
`8.4.10-alpine` Minor runtime version update Also known as: 8.4.10-alpine3.22	Benefits: Same OS detected Minor runtime version update Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 44 MB Flavor: alpine OS: 3.22 Runtime: 8.4.10	3 weeks ago

github-actions · 2025-07-29T23:03:17Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.3-fpm-alpine

Name	8.3.23-fpm-alpine3.22
Digest	sha256:6d134d3d8edf3f9468cbc8de6489b942f0340914cc6c7bc00018ea838abdc5c4
Vulnerabilities
Pushed	3 weeks ago
Size	33 MB
Packages	61
Flavor	alpine
OS	3.22
Runtime	8.3.23

The base image is also available under the supported tag(s): 8.3-fpm-alpine3.22, 8.3.23-fpm-alpine, 8.3.23-fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.4-fpm-alpine` Image has same number of vulnerabilities Also known as: 8.4.10-fpm-alpine 8.4.10-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22	3 weeks ago

github-actions · 2025-07-29T23:03:19Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:40ee331dd6c3dbfe7a5b21a1aeb5146cab888e144c213e653263423418368998`
vulnerabilities
platform	linux/amd64
size	131 MB
packages	284

📦 Base Image php:37c03f5427764bbf4b1d18e24034c2bef66d53588079fb3a90d140d341f28cd8

also known as	`8.3-alpine` `8.3-alpine3.22` `8.3-cli-alpine` `8.3-cli-alpine3.22` `8.3.23-alpine` `8.3.23-alpine3.22` `8.3.23-cli-alpine` `8.3.23-cli-alpine3.22`
digest	`sha256:7c4b34b9bcea402f1fedb8985a6c6d49f1283c26a76f432088f6a23f744fc194`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

git 2.49.1-r0 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.102%`
EPSS Percentile	`29th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.021%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.016%`
EPSS Percentile	`2nd percentile`

Description

stdlib 1.24.3 (golang)

pkg:golang/[email protected]

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.012%`
EPSS Percentile	`1st percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-07-29T23:03:20Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:760b967584396fd8c0aefab591097a9ec8e0157da2be9862a6e00b48628bea3e`
vulnerabilities
platform	linux/amd64
size	112 MB
packages	249

📦 Base Image php:37c03f5427764bbf4b1d18e24034c2bef66d53588079fb3a90d140d341f28cd8

also known as	`8.3-alpine` `8.3-alpine3.22` `8.3-cli-alpine` `8.3-cli-alpine3.22` `8.3.23-alpine` `8.3.23-alpine3.22` `8.3.23-cli-alpine` `8.3.23-cli-alpine3.22`
digest	`sha256:7c4b34b9bcea402f1fedb8985a6c6d49f1283c26a76f432088f6a23f744fc194`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

git 2.49.1-r0 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.102%`
EPSS Percentile	`29th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.021%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.016%`
EPSS Percentile	`2nd percentile`

Description

stdlib 1.24.3 (golang)

pkg:golang/[email protected]

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.012%`
EPSS Percentile	`1st percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-07-29T23:03:22Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.3-alpine

Name	8.3.23-alpine3.22
Digest	sha256:7c4b34b9bcea402f1fedb8985a6c6d49f1283c26a76f432088f6a23f744fc194
Vulnerabilities
Pushed	3 weeks ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.3.23

The base image is also available under the supported tag(s): 8.3-alpine3.22, 8.3-cli-alpine, 8.3-cli-alpine3.22, 8.3.23-alpine, 8.3.23-alpine3.22, 8.3.23-cli-alpine, 8.3.23-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.4.10-alpine` Minor runtime version update Also known as: 8.4.10-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 44 MB Flavor: alpine OS: 3.22 Runtime: 8.4.10	3 weeks ago
`8.4-alpine` Minor runtime version update Also known as: 8.4.10-cli-alpine 8.4.10-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4	3 weeks ago

github-actions · 2025-07-29T23:03:23Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:cc401107563b79259c3f55a9dd7300d8877efa5807c62b1ead81e4586794c9c6`
vulnerabilities
platform	linux/amd64
size	112 MB
packages	250

📦 Base Image oisupport/staging-amd64:8-fpm-alpine

also known as	`8-fpm-alpine3.22` `8.4-fpm-alpine` `8.4-fpm-alpine3.22` `8.4.10-fpm-alpine` `8.4.10-fpm-alpine3.22` `bf3abc5b8cece0c8377d2b43fda020363802e516010bb9b7bd2dc65d89953a21` `fpm-alpine` `fpm-alpine3.22`
digest	`sha256:8f5c6041134df87721b8767876198c72504bb3c2c56b028eba3110a5aedcc948`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

git 2.49.1-r0 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.102%`
EPSS Percentile	`29th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.021%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.016%`
EPSS Percentile	`2nd percentile`

Description

stdlib 1.24.3 (golang)

pkg:golang/[email protected]

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.012%`
EPSS Percentile	`1st percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-07-29T23:03:23Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:c0eb08d3ecd7ff5376ab13c1d3dd058f1e3d2d197fd4cb0400960e2eefdc6209`
vulnerabilities
platform	linux/amd64
size	111 MB
packages	249

📦 Base Image oisupport/staging-amd64:6d8f1501134a9bdee714377c21301b62cf07f86c3b82a73ae27b779d30916fdb

also known as	`8.2-alpine` `8.2-alpine3.22` `8.2-cli-alpine` `8.2-cli-alpine3.22` `8.2.29-alpine` `8.2.29-alpine3.22` `8.2.29-cli-alpine` `8.2.29-cli-alpine3.22`
digest	`sha256:53ac6edeae46bbdd44555b8be8d0823f7d212c8c8e725439fbdbe1d1ad3e53ac`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

git 2.49.1-r0 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.102%`
EPSS Percentile	`29th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.021%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.016%`
EPSS Percentile	`2nd percentile`

Description

stdlib 1.24.3 (golang)

pkg:golang/[email protected]

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.012%`
EPSS Percentile	`1st percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-07-29T23:03:23Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.3-alpine

Name	8.3.23-alpine3.22
Digest	sha256:7c4b34b9bcea402f1fedb8985a6c6d49f1283c26a76f432088f6a23f744fc194
Vulnerabilities
Pushed	3 weeks ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.3.23

The base image is also available under the supported tag(s): 8.3-alpine3.22, 8.3-cli-alpine, 8.3-cli-alpine3.22, 8.3.23-alpine, 8.3.23-alpine3.22, 8.3.23-cli-alpine, 8.3.23-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.4.10-alpine` Minor runtime version update Also known as: 8.4.10-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 44 MB Flavor: alpine OS: 3.22 Runtime: 8.4.10	3 weeks ago
`8.4-alpine` Minor runtime version update Also known as: 8.4.10-cli-alpine 8.4.10-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4	3 weeks ago

github-actions · 2025-07-29T23:03:24Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is :6d8f1501134a9bdee714377c21301b62cf07f86c3b82a73ae27b779d30916fdb

Digest
Vulnerabilities
Size	0 B
Packages	0

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2025-07-29T23:03:25Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is :8-fpm-alpine

Digest
Vulnerabilities
Size	0 B
Packages	0

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2025-07-29T23:03:27Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:201bbb9b530f56899dc8e598e8ecb14286f9edd3d7828c37bd721392ad9f999e`
vulnerabilities
platform	linux/amd64
size	131 MB
packages	284

📦 Base Image oisupport/staging-amd64:6d8f1501134a9bdee714377c21301b62cf07f86c3b82a73ae27b779d30916fdb

also known as	`8.2-alpine` `8.2-alpine3.22` `8.2-cli-alpine` `8.2-cli-alpine3.22` `8.2.29-alpine` `8.2.29-alpine3.22` `8.2.29-cli-alpine` `8.2.29-cli-alpine3.22`
digest	`sha256:53ac6edeae46bbdd44555b8be8d0823f7d212c8c8e725439fbdbe1d1ad3e53ac`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

git 2.49.1-r0 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.102%`
EPSS Percentile	`29th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.021%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.016%`
EPSS Percentile	`2nd percentile`

Description

stdlib 1.24.3 (golang)

pkg:golang/[email protected]

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.012%`
EPSS Percentile	`1st percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-07-29T23:03:27Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:1ca69f0c21fd357e4c27dd54311ce01d7f07b5ecff6c437b66b18f065a19c658`
vulnerabilities
platform	linux/amd64
size	136 MB
packages	284

📦 Base Image php:8-alpine

also known as	`8-alpine3.22` `8-cli-alpine` `8-cli-alpine3.22` `8.4-alpine` `8.4-alpine3.22` `8.4-cli-alpine` `8.4-cli-alpine3.22` `8.4.10-cli-alpine` `8.4.10-cli-alpine3.22` `9ff1d89ef9c2fb92353d89f7d4acd209fa736d8eb62a53b9ba0d93dd408e60af` `alpine` `alpine3.22` `cli-alpine` `cli-alpine3.22`
digest	`sha256:f5f0e78475a1280bb8f4a77fa426fbfc2390f418f51757359949cb8ebf79cc52`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

git 2.49.1-r0 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.102%`
EPSS Percentile	`29th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.021%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.016%`
EPSS Percentile	`2nd percentile`

Description

stdlib 1.24.3 (golang)

pkg:golang/[email protected]

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.012%`
EPSS Percentile	`1st percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-07-29T23:03:29Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:72a8429ae547e080e91aaeb51d14891bff7082c04bfe90421f65ad8cfca93dbb`
vulnerabilities
platform	linux/amd64
size	117 MB
packages	249

📦 Base Image php:8-alpine

also known as	`8-alpine3.22` `8-cli-alpine` `8-cli-alpine3.22` `8.4-alpine` `8.4-alpine3.22` `8.4-cli-alpine` `8.4-cli-alpine3.22` `8.4.10-cli-alpine` `8.4.10-cli-alpine3.22` `9ff1d89ef9c2fb92353d89f7d4acd209fa736d8eb62a53b9ba0d93dd408e60af` `alpine` `alpine3.22` `cli-alpine` `cli-alpine3.22`
digest	`sha256:f5f0e78475a1280bb8f4a77fa426fbfc2390f418f51757359949cb8ebf79cc52`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

git 2.49.1-r0 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.102%`
EPSS Percentile	`29th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.021%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.016%`
EPSS Percentile	`2nd percentile`

Description

stdlib 1.24.3 (golang)

pkg:golang/[email protected]

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.012%`
EPSS Percentile	`1st percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-07-29T23:03:30Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is :6d8f1501134a9bdee714377c21301b62cf07f86c3b82a73ae27b779d30916fdb

Digest
Vulnerabilities
Size	0 B
Packages	0

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2025-07-29T23:03:31Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8-alpine

Name	8.4-alpine3.22
Digest	sha256:f5f0e78475a1280bb8f4a77fa426fbfc2390f418f51757359949cb8ebf79cc52
Vulnerabilities
Pushed	3 weeks ago
Size	42 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.4

The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.10-cli-alpine, 8.4.10-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.4.10-alpine` Minor runtime version update Also known as: 8.4.10-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 44 MB Flavor: alpine OS: 3.22 Runtime: 8.4.10	3 weeks ago

github-actions · 2025-07-29T23:03:32Z

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:eeb718f6744451d82025208550a3e70ede2e369e045f023385fdaab5c9329e38`
vulnerabilities
platform	linux/amd64
size	104 MB
packages	248

📦 Base Image php:46b1fe80d62af9bafc4eeecf942c85ac59df475fed0d5c6c00ad4a5e86abd8c8

also known as	`8.1-fpm-alpine` `8.1-fpm-alpine3.21` `8.1.33-fpm-alpine` `8.1.33-fpm-alpine3.21`
digest	`sha256:5871d3d4f16880e00a32bd2ed082d37eccc1e79473014df282c8d9207b940cb0`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

sqlite 3.48.0-r2 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.21

Affected range	`<3.48.0-r3`
Fixed version	`3.48.0-r3`
EPSS Score	`0.047%`
EPSS Percentile	`14th percentile`

Description

github-actions · 2025-07-29T23:03:32Z

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:db5ad972c8b86fc5cc38e810077c3de74711e209bf3b81bad51cdb6744a674f5`
vulnerabilities
platform	linux/amd64
size	107 MB
packages	250

📦 Base Image php:640a89f12d2b0873fd58016ba9a2ad6e9daf3c0ef46fec05a5a0f301799a87cf

also known as	`8.2-fpm-alpine` `8.2-fpm-alpine3.22` `8.2.29-fpm-alpine` `8.2.29-fpm-alpine3.22`
digest	`sha256:aaccb621d115641a69281537adb477db665d0373b76851957c7015a20e85756b`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/[email protected]

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`38.497%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.127%`
EPSS Percentile	`33rd percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

git 2.49.1-r0 (apk)

pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.102%`
EPSS Percentile	`29th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.021%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.022%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<2.50.1-r0`
Fixed version	`2.50.1-r0`
EPSS Score	`0.016%`
EPSS Percentile	`2nd percentile`

Description

stdlib 1.24.3 (golang)

pkg:golang/[email protected]

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.012%`
EPSS Percentile	`1st percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-07-29T23:03:32Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8-alpine

Name	8.4-alpine3.22
Digest	sha256:f5f0e78475a1280bb8f4a77fa426fbfc2390f418f51757359949cb8ebf79cc52
Vulnerabilities
Pushed	3 weeks ago
Size	42 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.4

The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.10-cli-alpine, 8.4.10-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.4.10-alpine` Minor runtime version update Also known as: 8.4.10-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 44 MB Flavor: alpine OS: 3.22 Runtime: 8.4.10	3 weeks ago

github-actions · 2025-07-29T23:03:35Z

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.2-fpm-alpine

Name	8.2.29-fpm-alpine3.22
Digest	sha256:aaccb621d115641a69281537adb477db665d0373b76851957c7015a20e85756b
Vulnerabilities
Pushed	3 weeks ago
Size	32 MB
Packages	61
Flavor	alpine
OS	3.22
Runtime	8.2.29

The base image is also available under the supported tag(s): 8.2-fpm-alpine3.22, 8.2.29-fpm-alpine, 8.2.29-fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.3-fpm-alpine` Minor runtime version update Also known as: 8.3.23-fpm-alpine 8.3.23-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.23	3 weeks ago
`8.4-fpm-alpine` Image has same number of vulnerabilities Also known as: 8.4.10-fpm-alpine 8.4.10-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22	3 weeks ago

github-actions · 2025-07-29T23:03:35Z

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.1-fpm-alpine

Name	8.1.33-fpm-alpine3.21
Digest	sha256:5871d3d4f16880e00a32bd2ed082d37eccc1e79473014df282c8d9207b940cb0
Vulnerabilities
Pushed	3 weeks ago
Size	32 MB
Packages	60
Flavor	alpine
OS	3.21
Runtime	8.1.33

The base image is also available under the supported tag(s): 8.1-fpm-alpine3.21, 8.1.33-fpm-alpine, 8.1.33-fpm-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed
`8.1-fpm-alpine3.22` Patch runtime version update Also known as: 8.1.33-fpm-alpine3.22	Benefits: Patch runtime version update Same OS detected Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.1.33	3 weeks ago
`8.3-fpm-alpine` Minor runtime version update Also known as: 8.3.23-fpm-alpine 8.3.23-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.23	3 weeks ago
`8.3-fpm-alpine3.21` Minor runtime version update Also known as: 8.3.23-fpm-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.21 Runtime: 8.3.23	3 weeks ago
`8.2-fpm-alpine` Minor runtime version update Also known as: 8.2.29-fpm-alpine 8.2.29-fpm-alpine3.22 8.2-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages 8.2-fpm-alpine was pulled 4.1K times last month Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.2.29	3 weeks ago
`8.2-fpm-alpine3.21` Minor runtime version update Also known as: 8.2.29-fpm-alpine3.21	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 32 MB Flavor: alpine OS: 3.21 Runtime: 8.2.29	3 weeks ago
`8.4-fpm-alpine` Image introduces no new vulnerability but removes 1 Also known as: 8.4.10-fpm-alpine 8.4.10-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Image has similar size Image introduces no new vulnerability but removes 1 Image contains similar number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22	3 weeks ago
`8.4-fpm-alpine3.21` Image has same number of vulnerabilities Also known as: 8.4.10-fpm-alpine3.21 8-fpm-alpine3.21 fpm-alpine3.21	Benefits: Same OS detected Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21	3 weeks ago

deps(deps): update ansible/ansible-lint action to v25.7.0

c55543b

renovate bot enabled auto-merge (squash) July 29, 2025 23:02

renovate bot requested a review from lotyp as a code owner July 29, 2025 23:02

github-actions bot added the type: maintenance For maintenance, refactor and testing (perf, chore, style, revert, refactor, test, build, ci) label Jul 29, 2025

Uh oh!

deps(deps): update ansible/ansible-lint action to v25.7.0 #110

Are you sure you want to change the base?

deps(deps): update ansible/ansible-lint action to v25.7.0 #110

Uh oh!

Conversation

renovate bot commented Jul 29, 2025

Release Notes

v25.7.0

Enhancements

Bugfixes

Maintenance

Configuration

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Summary

Details

Risk Assessment

Impact

References

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

`v25.7.0`

github-actions bot commented Jul 29, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jul 29, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

Recommended fixes for image `wayofdev/php-dev:latest`

Recommended fixes for image `wayofdev/php-dev:latest`