From 6041ab2d58e1d3cd170f949fabf2e8e45580cfdf Mon Sep 17 00:00:00 2001
From: Marjo Wenzel van Lier <marjo.vanlier@gmail.com>
Date: Sat, 31 Oct 2026 20:38:42 +0100
Subject: [PATCH] security(alpine): Upgrade curl to 8.23.0

The official PHP Alpine 3.23 and 3.24 images still ship curl and
libcurl 8.22.0-r0, which Trivy reports as critical (CVE-2026-86409
and seven related CVEs). Alpine already publishes 8.23.0-r0, so
every variation now lists both packages and the install helper
upgrades them at build time, the same way as the Brotli fix.

Debian is not changed: apt has no newer curl for Bookworm or
Trixie. Remove the packages once the official images ship 8.23.0.

Signed-off-by: Marjo Wenzel van Lier <marjo.vanlier@gmail.com>
---
 src/variations/cli/Dockerfile        | 3 +++
 src/variations/fpm-apache/Dockerfile | 3 +++
 src/variations/fpm-nginx/Dockerfile  | 3 +++
 src/variations/fpm/Dockerfile        | 3 +++
 src/variations/frankenphp/Dockerfile | 3 +++
 5 files changed, 15 insertions(+)

diff --git a/src/variations/cli/Dockerfile b/src/variations/cli/Dockerfile
index afbed7ec..9bc60bfc 100644
--- a/src/variations/cli/Dockerfile
+++ b/src/variations/cli/Dockerfile
@@ -8,8 +8,11 @@ ARG PHP_VARIATION='cli'
 FROM php:${PHP_VERSION}-${PHP_VARIATION}-${BASE_OS_VERSION}
 
 # brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
+# curl and libcurl upgrade Alpine past curl 8.22.0 (CVE-2026-86409 and others). Remove them once the official PHP images ship 8.23.0.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     brotli-libs \
+    curl \
+    libcurl \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
     libbrotli1 \
diff --git a/src/variations/fpm-apache/Dockerfile b/src/variations/fpm-apache/Dockerfile
index d6783957..96a02e9e 100644
--- a/src/variations/fpm-apache/Dockerfile
+++ b/src/variations/fpm-apache/Dockerfile
@@ -23,8 +23,11 @@ RUN docker-php-serversideup-s6-install
 ##########
 FROM ${BASE_IMAGE}
 # brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
+# curl and libcurl upgrade Alpine past curl 8.22.0 (CVE-2026-86409 and others). Remove them once the official PHP images ship 8.23.0.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     brotli-libs \
+    curl \
+    libcurl \
     apache2 \
     fcgi \
     shadow"
diff --git a/src/variations/fpm-nginx/Dockerfile b/src/variations/fpm-nginx/Dockerfile
index 70021770..99a7f322 100644
--- a/src/variations/fpm-nginx/Dockerfile
+++ b/src/variations/fpm-nginx/Dockerfile
@@ -98,10 +98,13 @@ RUN \
 ##########
 FROM ${BASE_IMAGE}
 # brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
+# curl and libcurl upgrade Alpine past curl 8.22.0 (CVE-2026-86409 and others). Remove them once the official PHP images ship 8.23.0.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     brotli-libs \
+    curl \
     fcgi \
     gettext \
+    libcurl \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
     gettext-base \
diff --git a/src/variations/fpm/Dockerfile b/src/variations/fpm/Dockerfile
index 6976a67d..f98a35ee 100644
--- a/src/variations/fpm/Dockerfile
+++ b/src/variations/fpm/Dockerfile
@@ -8,9 +8,12 @@ ARG PHP_VARIATION='fpm'
 FROM php:${PHP_VERSION}-${PHP_VARIATION}-${BASE_OS_VERSION}
 
 # brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
+# curl and libcurl upgrade Alpine past curl 8.22.0 (CVE-2026-86409 and others). Remove them once the official PHP images ship 8.23.0.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     brotli-libs \
+    curl \
     fcgi \
+    libcurl \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
     libbrotli1 \
diff --git a/src/variations/frankenphp/Dockerfile b/src/variations/frankenphp/Dockerfile
index a9ca1079..d06e6284 100644
--- a/src/variations/frankenphp/Dockerfile
+++ b/src/variations/frankenphp/Dockerfile
@@ -163,8 +163,11 @@ RUN if cat /etc/os-release | grep -q 'debian'; then \
 ####################
 FROM common AS final
 # brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
+# curl and libcurl upgrade Alpine past curl 8.22.0 (CVE-2026-86409 and others). Remove them once the official PHP images ship 8.23.0.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     brotli-libs \
+    curl \
+    libcurl \
     libstdc++ \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\