[csandanov]

Problem

The latest numbered PHP image release still contains a Brotli decoder affected by CVE-2026-111497. The release gate also retains temporary exceptions for an older New Relic daemon even though a fixed agent is now available.

Cause

Those images were built before the updated Alpine packages were available to the build. Rebuilding refreshes the system library used by PHP, cURL and development Node.js, but the existing tests did not verify that library. The daemon exceptions were added while waiting for an upstream release.

Solution

Keep the existing Alpine package selection and verify the fixed Brotli library in the final image. Remove the resolved daemon exceptions so future builds must pass the normal vulnerability gate. PHP compression and decompression remain available.

Changes

• Keep the functional checks for Brotli 1.2.1 or newer in the PHP extension and cURL, including a binary compression/decompression round trip.
• Restore unversioned brotli-libs and brotli-dev package dependencies.
• Remove the 13 exceptions for the old New Relic daemon's Go and x/net findings. The three existing npm exceptions remain.

Extension audit — 2026-10-24

• Checked all 26 PECL-listed extensions against upstream release metadata, plus SPX and New Relic.
• The existing extension pins are current, including PHP Brotli 0.21.0 and SPX 0.4.22.
• Keep smbclient 1.1.2: PECL labels 1.2.0dev stable, but GitHub explicitly marks it as a prerelease; its stated change only removes support for PHP below 7.4.
• Keep the PHP 8.2 SQL Server driver compatibility pins at 5.12.0; the 5.13.3 packages require PHP 8.3 or newer.
• gRPC already follows the latest stable release; the fresh image contains 1.84.1.
• New Relic already follows the current upstream archive. The download endpoint and freshly pulled image now provide 12.12.0.41. Both published musl daemon binaries use Go 1.27.3 and golang.org/x/net v0.60.0.

Validation

• The Brotli check rejects an older PHP 8.3 image with Brotli 1.2.0 and passes against the current Linux/arm64 image with 1.2.1.
• PHP and shell syntax checks pass; all eight existing build-reliability unit tests pass.
• YAML parsing confirms that only the three existing npm exceptions remain.
• Verified the published amd64 and arm64 New Relic binaries with Go build metadata.
• Grype 0.120.0 scans of both published musl daemon binaries pass with zero findings with available fixes and no suppressed matches (database built 2026-10-23).
• The updated full image test and vulnerability scan matrix is running in CI.

Rollout

Publish a new numbered PHP image revision using a fresh rebuild that reruns package installation, then recreate affected containers. The latest numbered release, r10, contains Brotli 1.2.0-r1 in all production, development and dev-macos variants on amd64 and arm64. A fresh Linux/arm64 pull of the moving tag 8.3 already contains 1.2.1.

References: Brotli security release, New Relic 12.12.0.41, smbclient prerelease.