chore(master): release 2.8.19

[lotyp]

🤖 I have created a release beep boop

2.8.19 (2025-06-19)

Dependencies

• deps: update ansible/ansible-lint action to v25.6.1 (#108) (6cd19e8)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:801255ba96228d3c9cabb1b7112a647bb7b7142048955b31393839791578789e
vulnerabilities
platform	linux/amd64
size	108 MB
packages	250

📦 Base Image php:8.3-fpm-alpine

also known as	8.3-fpm-alpine3.22 8.3.22-fpm-alpine 8.3.22-fpm-alpine3.22
digest	sha256:2895cabe974eb03fbdb77aa019d52a5b6b18f745ac2837dea33603e8a2c10d88
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/[email protected] Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.022% EPSS Percentile 4th percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.3-fpm-alpine

Name	8.3.22-fpm-alpine3.22
Digest	sha256:2895cabe974eb03fbdb77aa019d52a5b6b18f745ac2837dea33603e8a2c10d88
Vulnerabilities
Pushed	1 week ago
Size	33 MB
Packages	61
Flavor	alpine
OS	3.22
Runtime	8.3.22

The base image is also available under the supported tag(s): 8.3-fpm-alpine3.22, 8.3.22-fpm-alpine, 8.3.22-fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-fpm-alpine Image has same number of vulnerabilities Also known as: 8.4.8-fpm-alpine 8.4.8-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22	1 week ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:54776df50c59bccd8ced60c9d97e1e5980695d0f27ff787ee1a1d5ea48b41c98
vulnerabilities
platform	linux/amd64
size	113 MB
packages	249

📦 Base Image php:8.3-alpine

also known as	8.3-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.22-alpine 8.3.22-alpine3.22 8.3.22-cli-alpine 8.3.22-cli-alpine3.22
digest	sha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/[email protected] Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.022% EPSS Percentile 4th percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:e74d48ff936c5b433536d131e39bb46d9446235563a8a10e8636b4164b01132b
vulnerabilities
platform	linux/amd64
size	112 MB
packages	250

📦 Base Image php:8-fpm-alpine

also known as	8-fpm-alpine3.22 8.4-fpm-alpine 8.4-fpm-alpine3.22 8.4.8-fpm-alpine 8.4.8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22
digest	sha256:bc12bbfaf3d00edcc78c086423804b91071d64ee3c34511f0d8f5cea778f7daf
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/[email protected] Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.022% EPSS Percentile 4th percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:d108d3ea6309666e389772c1278ab888bcdb7db286561e1ebe6fb644784cd7b9
vulnerabilities
platform	linux/amd64
size	111 MB
packages	247

📦 Base Image php:53a4f6c5bdf2c0213cb7293bc9da263feaa0ea41955f71bc1de2465f801efff9

also known as	8.1-alpine 8.1-alpine3.21 8.1-cli-alpine 8.1-cli-alpine3.21 8.1.32-alpine 8.1.32-alpine3.21 8.1.32-cli-alpine 8.1.32-cli-alpine3.21
digest	sha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.3-alpine

Name	8.3.22-alpine3.22
Digest	sha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961
Vulnerabilities
Pushed	1 week ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.3.22

The base image is also available under the supported tag(s): 8.3-alpine3.22, 8.3-cli-alpine, 8.3-cli-alpine3.22, 8.3.22-alpine, 8.3.22-alpine3.22, 8.3.22-cli-alpine, 8.3.22-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8-fpm-alpine

Name	fpm-alpine3.22
Digest	sha256:bc12bbfaf3d00edcc78c086423804b91071d64ee3c34511f0d8f5cea778f7daf
Vulnerabilities
Pushed	1 week ago
Size	37 MB
Packages	61
Flavor	alpine
OS	3.22

The base image is also available under the supported tag(s): 8-fpm-alpine3.22, 8.4-fpm-alpine, 8.4-fpm-alpine3.22, 8.4.8-fpm-alpine, 8.4.8-fpm-alpine3.22, fpm-alpine, fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.3-fpm-alpine Minor runtime version update Also known as: 8.3.22-fpm-alpine 8.3.22-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Image is smaller by 3.3 MB Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago
8.2-fpm-alpine Minor runtime version update Also known as: 8.2.28-fpm-alpine 8.2.28-fpm-alpine3.22 8.2-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Image is smaller by 4.0 MB Image has same number of vulnerabilities Image contains equal number of packages 8.2-fpm-alpine was pulled 4.1K times last month Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.2.28	1 week ago
8.1-fpm-alpine3.22 Minor runtime version update Also known as: 8.1.32-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Image is smaller by 4.5 MB Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.1.32	1 week ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-alpine

Name	8.1.32-alpine3.21
Digest	sha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b
Vulnerabilities
Pushed	3 months ago
Size	36 MB
Packages	52
Flavor	alpine
OS	3.21
Runtime	8.1.32

The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.32-alpine, 8.1.32-alpine3.21, 8.1.32-cli-alpine, 8.1.32-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine3.21 Minor runtime version update Also known as: 8.4.8-cli-alpine3.21 8-cli-alpine3.21 cli-alpine3.21 alpine3.21 8-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.21 Runtime: 8.4	1 week ago
8.3-alpine3.21 Minor runtime version update Also known as: 8.3.22-cli-alpine3.21 8.3-cli-alpine3.21 8.3.22-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.21 Runtime: 8.3.22	1 week ago
8.2-alpine3.21 Minor runtime version update Also known as: 8.2.28-cli-alpine3.21 8.2-cli-alpine3.21 8.2.28-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.2.28	3 months ago
8.1-alpine3.22 Patch runtime version update Also known as: 8.1.32-cli-alpine3.22 8.1-cli-alpine3.22 8.1.32-alpine3.22	Benefits: Patch runtime version update Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.1.32	1 week ago
8.4-alpine Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago
8.3-alpine Minor runtime version update Also known as: 8.3.22-cli-alpine 8.3.22-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.22-alpine 8.3.22-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago
8.2-alpine Minor runtime version update Also known as: 8.2.28-cli-alpine 8.2.28-cli-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.28-alpine 8.2.28-alpine3.22 8.2-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 8.2-alpine was pulled 1.8K times last month Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.2.28	1 week ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:4c1a02d04c78d49874f5312abe8278343011d5f53012012f4a2310e36baa9cca
vulnerabilities
platform	linux/amd64
size	107 MB
packages	250

📦 Base Image php:8.2-fpm-alpine

also known as	8.2-fpm-alpine3.22 8.2.28-fpm-alpine 8.2.28-fpm-alpine3.22
digest	sha256:1a30bfabe4c99f09227f38c8821d19f6e16702a81ceda26c0d8c929086ed4fb7
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/[email protected] Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.022% EPSS Percentile 4th percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:b00b1a9fa14a126008f568abd6591c3cb4964c7c5ee417116e2dac483cf45295
vulnerabilities
platform	linux/amd64
size	131 MB
packages	284

📦 Base Image php:8.2-alpine

also known as	8.2-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.28-alpine 8.2.28-alpine3.22 8.2.28-cli-alpine 8.2.28-cli-alpine3.22
digest	sha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/[email protected] Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.022% EPSS Percentile 4th percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:3f78e539126763483b636d85285cbfb6bab6e37846772e175f6dae5728679db0
vulnerabilities
platform	linux/amd64
size	118 MB
packages	249

📦 Base Image php:8-alpine

also known as	8-alpine3.22 8-cli-alpine 8-cli-alpine3.22 8.4-alpine 8.4-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 alpine alpine3.22 cli-alpine cli-alpine3.22
digest	sha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/[email protected] Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.022% EPSS Percentile 4th percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-fpm-alpine

Name	8.2.28-fpm-alpine3.22
Digest	sha256:1a30bfabe4c99f09227f38c8821d19f6e16702a81ceda26c0d8c929086ed4fb7
Vulnerabilities
Pushed	1 week ago
Size	32 MB
Packages	61
Flavor	alpine
OS	3.22
Runtime	8.2.28

The base image is also available under the supported tag(s): 8.2-fpm-alpine3.22, 8.2.28-fpm-alpine, 8.2.28-fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.3-fpm-alpine Minor runtime version update Also known as: 8.3.22-fpm-alpine 8.3.22-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago
8.4-fpm-alpine Image has same number of vulnerabilities Also known as: 8.4.8-fpm-alpine 8.4.8-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22	1 week ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8-alpine

Name	8.4.8-alpine3.22
Digest	sha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2
Vulnerabilities
Pushed	1 week ago
Size	42 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.4.8

The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.8-alpine, 8.4.8-alpine3.22, 8.4.8-cli-alpine, 8.4.8-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-alpine

Name	8.2.28-alpine3.22
Digest	sha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7
Vulnerabilities
Pushed	1 week ago
Size	36 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.2.28

The base image is also available under the supported tag(s): 8.2-alpine3.22, 8.2-cli-alpine, 8.2-cli-alpine3.22, 8.2.28-alpine, 8.2.28-alpine3.22, 8.2.28-cli-alpine, 8.2.28-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago
8.3-alpine Minor runtime version update Also known as: 8.3.22-cli-alpine 8.3.22-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.22-alpine 8.3.22-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:8488331bb827779577c678d5a2fc865431291b8b37ba04e1bdd31a9d153afeae
vulnerabilities
platform	linux/amd64
size	137 MB
packages	284

📦 Base Image php:8-alpine

also known as	8-alpine3.22 8-cli-alpine 8-cli-alpine3.22 8.4-alpine 8.4-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 alpine alpine3.22 cli-alpine cli-alpine3.22
digest	sha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/[email protected] Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.022% EPSS Percentile 4th percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:95332bcae882e4fe7a6cb26b749089b07c2682368156715f7e592d75ecdbe04f
vulnerabilities
platform	linux/amd64
size	112 MB
packages	249

📦 Base Image php:8.2-alpine

also known as	8.2-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.28-alpine 8.2.28-alpine3.22 8.2.28-cli-alpine 8.2.28-cli-alpine3.22
digest	sha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/[email protected] Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.022% EPSS Percentile 4th percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8-alpine

Name	8.4.8-alpine3.22
Digest	sha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2
Vulnerabilities
Pushed	1 week ago
Size	42 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.4.8

The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.8-alpine, 8.4.8-alpine3.22, 8.4.8-cli-alpine, 8.4.8-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-alpine

Name	8.2.28-alpine3.22
Digest	sha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7
Vulnerabilities
Pushed	1 week ago
Size	36 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.2.28

The base image is also available under the supported tag(s): 8.2-alpine3.22, 8.2-cli-alpine, 8.2-cli-alpine3.22, 8.2.28-alpine, 8.2.28-alpine3.22, 8.2.28-cli-alpine, 8.2.28-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago
8.3-alpine Minor runtime version update Also known as: 8.3.22-cli-alpine 8.3.22-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.22-alpine 8.3.22-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:9e2958c0522b08abdea0700bc5a05186dfe18abf1927298d0b40c91388348035
vulnerabilities
platform	linux/amd64
size	132 MB
packages	284

📦 Base Image php:8.3-alpine

also known as	8.3-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.22-alpine 8.3.22-alpine3.22 8.3.22-cli-alpine 8.3.22-cli-alpine3.22
digest	sha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/[email protected] Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.022% EPSS Percentile 4th percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:36312391b467cae85aeb635c68bb52fc0cb2f9826dce2c61ad4ca4c915fb1ad9
vulnerabilities
platform	linux/amd64
size	106 MB
packages	248

📦 Base Image php:42e8584bcaac5cccda08e770cb32513710f12eb6f8d76dd829150e72ac2bedf0

also known as	8.1-fpm-alpine 8.1-fpm-alpine3.21 8.1.32-fpm-alpine 8.1.32-fpm-alpine3.21
digest	sha256:e726fe8db6397574e12eb4f7be34f508443217f6396d7573b60e0b84db78c64e
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.3-alpine

Name	8.3.22-alpine3.22
Digest	sha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961
Vulnerabilities
Pushed	1 week ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.3.22

The base image is also available under the supported tag(s): 8.3-alpine3.22, 8.3-cli-alpine, 8.3-cli-alpine3.22, 8.3.22-alpine, 8.3.22-alpine3.22, 8.3.22-cli-alpine, 8.3.22-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-fpm-alpine

Name	8.1.32-fpm-alpine3.21
Digest	sha256:e726fe8db6397574e12eb4f7be34f508443217f6396d7573b60e0b84db78c64e
Vulnerabilities
Pushed	3 months ago
Size	32 MB
Packages	53
Flavor	alpine
OS	3.21
Runtime	8.1.32

The base image is also available under the supported tag(s): 8.1-fpm-alpine3.21, 8.1.32-fpm-alpine, 8.1.32-fpm-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-fpm-alpine3.21 Minor runtime version update Also known as:	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 2 Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.4	1 month ago
8.3-fpm-alpine3.21 Minor runtime version update Also known as: 8.3.22-fpm-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.21 Runtime: 8.3.22	1 week ago
8.2-fpm-alpine3.21 Minor runtime version update Also known as: 8.2.28-fpm-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 32 MB Flavor: alpine OS: 3.21 Runtime: 8.2.28	3 months ago
8.1-fpm-alpine3.22 Patch runtime version update Also known as: 8.1.32-fpm-alpine3.22	Benefits: Patch runtime version update Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.1.32	1 week ago
8.3-fpm-alpine Minor runtime version update Also known as: 8.3.22-fpm-alpine 8.3.22-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago
8.2-fpm-alpine Minor runtime version update Also known as: 8.2.28-fpm-alpine 8.2.28-fpm-alpine3.22 8.2-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 8.2-fpm-alpine was pulled 4.1K times last month Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.2.28	1 week ago
8.4.8-fpm-alpine3.21 Image introduces no new vulnerability but removes 4 Also known as: 8-fpm-alpine3.21 fpm-alpine3.21	Benefits: Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21	1 week ago
8.4-fpm-alpine Image introduces no new vulnerability but removes 4 Also known as: 8.4.8-fpm-alpine 8.4.8-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 37 MB Flavor: alpine OS: 3.22	1 week ago

[github-actions]

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:6df8e4f41783710608d0aafa678bc8491d3b2587f0ba2ea35c2dc2ae54b63c8a
vulnerabilities
platform	linux/amd64
size	129 MB
packages	265

📦 Base Image php:53a4f6c5bdf2c0213cb7293bc9da263feaa0ea41955f71bc1de2465f801efff9

also known as	8.1-alpine 8.1-alpine3.21 8.1-cli-alpine 8.1-cli-alpine3.21 8.1.32-alpine 8.1.32-alpine3.21 8.1.32-cli-alpine 8.1.32-cli-alpine3.21
digest	sha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/[email protected] Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 35.144% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.058% EPSS Percentile 18th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

setuptools 70.3.0 (pypi) pkg:pypi/[email protected] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <78.1.1 Fixed version 78.1.1 CVSS Score 7.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P EPSS Score 0.120% EPSS Percentile 32nd percentile Description Summary A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1 Details def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while '..' in name: name = name.replace('..', '.').replace('\\', '_') else: name = "__downloaded__" # default if URL has no path contents if name.endswith('.[egg.zip](http://egg.zip/)'): name = name[:-4] # strip the extra .zip before download --> filename = os.path.join(tmpdir, name) Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88 os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter. name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient. Risk Assessment As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index. Impact An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context. References https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 pypa/setuptools#4946

[github-actions]

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-alpine

Name	8.1.32-alpine3.21
Digest	sha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b
Vulnerabilities
Pushed	3 months ago
Size	36 MB
Packages	52
Flavor	alpine
OS	3.21
Runtime	8.1.32

The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.32-alpine, 8.1.32-alpine3.21, 8.1.32-cli-alpine, 8.1.32-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine3.21 Minor runtime version update Also known as: 8.4.8-cli-alpine3.21 8-cli-alpine3.21 cli-alpine3.21 alpine3.21 8-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.21 Runtime: 8.4	1 week ago
8.3-alpine3.21 Minor runtime version update Also known as: 8.3.22-cli-alpine3.21 8.3-cli-alpine3.21 8.3.22-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.21 Runtime: 8.3.22	1 week ago
8.2-alpine3.21 Minor runtime version update Also known as: 8.2.28-cli-alpine3.21 8.2-cli-alpine3.21 8.2.28-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.2.28	3 months ago
8.1-alpine3.22 Patch runtime version update Also known as: 8.1.32-cli-alpine3.22 8.1-cli-alpine3.22 8.1.32-alpine3.22	Benefits: Patch runtime version update Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.1.32	1 week ago
8.4-alpine Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago
8.3-alpine Minor runtime version update Also known as: 8.3.22-cli-alpine 8.3.22-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.22-alpine 8.3.22-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago
8.2-alpine Minor runtime version update Also known as: 8.2.28-cli-alpine 8.2.28-cli-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.28-alpine 8.2.28-alpine3.22 8.2-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 8.2-alpine was pulled 1.8K times last month Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.2.28	1 week ago

[lotyp]

🤖 Created releases:

• v2.8.19

🌻