Consider version pinning your dependencies

[AlexBachmann]

Right now, we do have an issue, where production sites go down, because an Update to FrankenPHP causes the HTTP server to never start. See php/frankenphp#2250

As it stands right now, any deployment setup that follows your instructions on https://developer.shopware.com/docs/guides/hosting/installation-updates/docker.html will go down, if it deploys a freshly build application image based on FROM ghcr.io/shopware/docker-base:$PHP_VERSION-frankenphp AS base-image

I want to ask the question: Should we version pin dependencies OR should we update the documentation to highlight, that developers should version pin the docker-base dependency?

[shyim]

Hey,

we pin only to Major versions because of breaking changes. Regardless of that it's required not to pin on our side to take the security updates.

We have following already in the docs:

You may want to pin the Docker image to a specific sha256 digest to ensure you always use the same image. See Best Practices for more information.

Maybe we should make this more verbose and more visible 🤔

I downgraded until it's fixed

[AlexBachmann]

Hey,

we pin only to Major versions because of breaking changes. Regardless of that it's required not to pin on our side to take the security updates.

This is a very valid argument. I guess it's a weighting exercise for the end user to either pin the docker-base image and regularly check for security updates themselves, or skip the version pinning and risk a failure on update. But I see why a version pin on your side does not make sense.