deps(deps): update ansible/ansible-lint action to v25.6.0 #106

renovate · 2025-06-17T19:25:33Z

This PR contains the following updates:

Package	Type	Update	Change
ansible/ansible-lint	action	minor	`v25.5.0` -> `v25.6.0`

Release Notes

ansible/ansible-lint (ansible/ansible-lint)

`v25.6.0`

Compare Source

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2025-06-17T19:26:23Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:afd233a3e701be6fa566398625962cb39ddf40a81334db4265b532c03f447984`
vulnerabilities
platform	linux/amd64
size	113 MB
packages	249

📦 Base Image php:8.3-alpine

also known as	`8.3-alpine3.22` `8.3-cli-alpine` `8.3-cli-alpine3.22` `8.3.22-alpine` `8.3.22-alpine3.22` `8.3.22-cli-alpine` `8.3.22-cli-alpine3.22`
digest	`sha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang)

pkg:golang/stdlib@1.24.3

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.017%`
EPSS Percentile	`2nd percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-06-17T19:26:24Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:9ab1ee46267191b3a81a2f020994042e38306d58f0698655e0462e40a17a8af1`
vulnerabilities
platform	linux/amd64
size	112 MB
packages	249

📦 Base Image php:8.2-alpine

also known as	`8.2-alpine3.22` `8.2-cli-alpine` `8.2-cli-alpine3.22` `8.2.28-alpine` `8.2.28-alpine3.22` `8.2.28-cli-alpine` `8.2.28-cli-alpine3.22`
digest	`sha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang)

pkg:golang/stdlib@1.24.3

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.017%`
EPSS Percentile	`2nd percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-06-17T19:26:24Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:9182ffc63da99e6df9997be7461f620ca9b854d15fefd18458df4fb1df17668e`
vulnerabilities
platform	linux/amd64
size	112 MB
packages	250

📦 Base Image php:8-fpm-alpine

also known as	`8-fpm-alpine3.22` `8.4-fpm-alpine` `8.4-fpm-alpine3.22` `8.4.8-fpm-alpine` `8.4.8-fpm-alpine3.22` `fpm-alpine` `fpm-alpine3.22`
digest	`sha256:bc12bbfaf3d00edcc78c086423804b91071d64ee3c34511f0d8f5cea778f7daf`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang)

pkg:golang/stdlib@1.24.3

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.017%`
EPSS Percentile	`2nd percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-06-17T19:26:24Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:013c156b183610b9f760688d7f83738b6708030f32909e74ff801525ca85b3b0`
vulnerabilities
platform	linux/amd64
size	108 MB
packages	250

📦 Base Image php:8.3-fpm-alpine

also known as	`8.3-fpm-alpine3.22` `8.3.22-fpm-alpine` `8.3.22-fpm-alpine3.22`
digest	`sha256:2895cabe974eb03fbdb77aa019d52a5b6b18f745ac2837dea33603e8a2c10d88`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang)

pkg:golang/stdlib@1.24.3

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.017%`
EPSS Percentile	`2nd percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-06-17T19:26:25Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.3-alpine

Name	8.3.22-alpine3.22
Digest	sha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961
Vulnerabilities
Pushed	1 week ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.3.22

The base image is also available under the supported tag(s): 8.3-alpine3.22, 8.3-cli-alpine, 8.3-cli-alpine3.22, 8.3.22-alpine, 8.3.22-alpine3.22, 8.3.22-cli-alpine, 8.3.22-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.4-alpine` Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago

github-actions · 2025-06-17T19:26:26Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.2-alpine

Name	8.2.28-alpine3.22
Digest	sha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7
Vulnerabilities
Pushed	1 week ago
Size	36 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.2.28

The base image is also available under the supported tag(s): 8.2-alpine3.22, 8.2-cli-alpine, 8.2-cli-alpine3.22, 8.2.28-alpine, 8.2.28-alpine3.22, 8.2.28-cli-alpine, 8.2.28-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.4-alpine` Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago
`8.3-alpine` Minor runtime version update Also known as: 8.3.22-cli-alpine 8.3.22-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.22-alpine 8.3.22-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago

github-actions · 2025-06-17T19:26:27Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8-fpm-alpine

Name	fpm-alpine3.22
Digest	sha256:bc12bbfaf3d00edcc78c086423804b91071d64ee3c34511f0d8f5cea778f7daf
Vulnerabilities
Pushed	1 week ago
Size	37 MB
Packages	61
Flavor	alpine
OS	3.22

The base image is also available under the supported tag(s): 8-fpm-alpine3.22, 8.4-fpm-alpine, 8.4-fpm-alpine3.22, 8.4.8-fpm-alpine, 8.4.8-fpm-alpine3.22, fpm-alpine, fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed
`8.3-fpm-alpine` Minor runtime version update Also known as: 8.3.22-fpm-alpine 8.3.22-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Image is smaller by 3.3 MB Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago
`8.2-fpm-alpine` Minor runtime version update Also known as: 8.2.28-fpm-alpine 8.2.28-fpm-alpine3.22 8.2-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Image is smaller by 4.0 MB Image has same number of vulnerabilities Image contains equal number of packages 8.2-fpm-alpine was pulled 4.1K times last month Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.2.28	1 week ago
`8.1-fpm-alpine3.22` Minor runtime version update Also known as: 8.1.32-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Image is smaller by 4.5 MB Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.1.32	1 week ago

github-actions · 2025-06-17T19:26:27Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.3-fpm-alpine

Name	8.3.22-fpm-alpine3.22
Digest	sha256:2895cabe974eb03fbdb77aa019d52a5b6b18f745ac2837dea33603e8a2c10d88
Vulnerabilities
Pushed	1 week ago
Size	33 MB
Packages	61
Flavor	alpine
OS	3.22
Runtime	8.3.22

The base image is also available under the supported tag(s): 8.3-fpm-alpine3.22, 8.3.22-fpm-alpine, 8.3.22-fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.4-fpm-alpine` Image has same number of vulnerabilities Also known as: 8.4.8-fpm-alpine 8.4.8-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22	1 week ago

github-actions · 2025-06-17T19:26:27Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:5350638da91e16fc18a51118def3c2aba37552d91b30080382cdaf0905ce4a8e`
vulnerabilities
platform	linux/amd64
size	137 MB
packages	284

📦 Base Image php:8-alpine

also known as	`8-alpine3.22` `8-cli-alpine` `8-cli-alpine3.22` `8.4-alpine` `8.4-alpine3.22` `8.4-cli-alpine` `8.4-cli-alpine3.22` `8.4.8-alpine` `8.4.8-alpine3.22` `8.4.8-cli-alpine` `8.4.8-cli-alpine3.22` `alpine` `alpine3.22` `cli-alpine` `cli-alpine3.22`
digest	`sha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang)

pkg:golang/stdlib@1.24.3

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.017%`
EPSS Percentile	`2nd percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-06-17T19:26:27Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:f48cb83d2618b4e1a6343c227f8fb0a46dec233cd79efd9018b359d04eb1f630`
vulnerabilities
platform	linux/amd64
size	118 MB
packages	249

📦 Base Image php:8-alpine

also known as	`8-alpine3.22` `8-cli-alpine` `8-cli-alpine3.22` `8.4-alpine` `8.4-alpine3.22` `8.4-cli-alpine` `8.4-cli-alpine3.22` `8.4.8-alpine` `8.4.8-alpine3.22` `8.4.8-cli-alpine` `8.4.8-cli-alpine3.22` `alpine` `alpine3.22` `cli-alpine` `cli-alpine3.22`
digest	`sha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang)

pkg:golang/stdlib@1.24.3

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.017%`
EPSS Percentile	`2nd percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-06-17T19:26:28Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:b2b799d2d42bff33c8c52779d00a6a28612b0c07958562c72ec3586e8e2e6925`
vulnerabilities
platform	linux/amd64
size	106 MB
packages	248

📦 Base Image php:42e8584bcaac5cccda08e770cb32513710f12eb6f8d76dd829150e72ac2bedf0

also known as	`8.1-fpm-alpine` `8.1-fpm-alpine3.21` `8.1.32-fpm-alpine` `8.1.32-fpm-alpine3.21`
digest	`sha256:e726fe8db6397574e12eb4f7be34f508443217f6396d7573b60e0b84db78c64e`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

github-actions · 2025-06-17T19:26:31Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8-alpine

Name	8.4.8-alpine3.22
Digest	sha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2
Vulnerabilities
Pushed	1 week ago
Size	42 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.4.8

The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.8-alpine, 8.4.8-alpine3.22, 8.4.8-cli-alpine, 8.4.8-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2025-06-17T19:26:31Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:42d7d65f75b6a626cd90e7290cb5d2245acd0d13fb806a3f8f9c6ee9dc544f88`
vulnerabilities
platform	linux/amd64
size	129 MB
packages	265

📦 Base Image php:53a4f6c5bdf2c0213cb7293bc9da263feaa0ea41955f71bc1de2465f801efff9

also known as	`8.1-alpine` `8.1-alpine3.21` `8.1-cli-alpine` `8.1-cli-alpine3.21` `8.1.32-alpine` `8.1.32-alpine3.21` `8.1.32-cli-alpine` `8.1.32-cli-alpine3.21`
digest	`sha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

setuptools 70.3.0 (pypi)

pkg:pypi/setuptools@70.3.0

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected range	`<78.1.1`
Fixed version	`78.1.1`
CVSS Score	`7.7`
CVSS Vector	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P`
EPSS Score	`0.104%`
EPSS Percentile	`29th percentile`

Description

Summary

A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1

Details
    def _download_url(self, url, tmpdir):
        # Determine download filename
        #
        name, _fragment = egg_info_for_url(url)
        if name:
            while '..' in name:
                name = name.replace('..', '.').replace('\\', '_')
        else:
            name = "__downloaded__"  # default if URL has no path contents

        if name.endswith('.[egg.zip](http://egg.zip/)'):
            name = name[:-4]  # strip the extra .zip before download

 -->       filename = os.path.join(tmpdir, name)
Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88

os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter.
name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient.

Risk Assessment

As easy_install and package_index are deprecated, the exploitation surface is reduced.
However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.

Impact

An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

References

https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
pypa/setuptools#4946

github-actions · 2025-06-17T19:26:31Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:7efdf49203d92149dae6fc9f078c8ef2026ec00edab9aa84b5ed27b7a3f77ac3`
vulnerabilities
platform	linux/amd64
size	132 MB
packages	284

📦 Base Image php:8.3-alpine

also known as	`8.3-alpine3.22` `8.3-cli-alpine` `8.3-cli-alpine3.22` `8.3.22-alpine` `8.3.22-alpine3.22` `8.3.22-cli-alpine` `8.3.22-cli-alpine3.22`
digest	`sha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang)

pkg:golang/stdlib@1.24.3

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.017%`
EPSS Percentile	`2nd percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-06-17T19:26:31Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.1-fpm-alpine

Name	8.1.32-fpm-alpine3.21
Digest	sha256:e726fe8db6397574e12eb4f7be34f508443217f6396d7573b60e0b84db78c64e
Vulnerabilities
Pushed	3 months ago
Size	32 MB
Packages	53
Flavor	alpine
OS	3.21
Runtime	8.1.32

The base image is also available under the supported tag(s): 8.1-fpm-alpine3.21, 8.1.32-fpm-alpine, 8.1.32-fpm-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed
`8.4-fpm-alpine3.21` Minor runtime version update Also known as:	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 2 Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.4	1 month ago
`8.3-fpm-alpine3.21` Minor runtime version update Also known as: 8.3.22-fpm-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.21 Runtime: 8.3.22	1 week ago
`8.2-fpm-alpine3.21` Minor runtime version update Also known as: 8.2.28-fpm-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 32 MB Flavor: alpine OS: 3.21 Runtime: 8.2.28	3 months ago
`8.1-fpm-alpine3.22` Patch runtime version update Also known as: 8.1.32-fpm-alpine3.22	Benefits: Patch runtime version update Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.1.32	1 week ago
`8.3-fpm-alpine` Minor runtime version update Also known as: 8.3.22-fpm-alpine 8.3.22-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago
`8.2-fpm-alpine` Minor runtime version update Also known as: 8.2.28-fpm-alpine 8.2.28-fpm-alpine3.22 8.2-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 8.2-fpm-alpine was pulled 4.1K times last month Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.2.28	1 week ago
`8.4.8-fpm-alpine3.21` Image introduces no new vulnerability but removes 4 Also known as: 8-fpm-alpine3.21 fpm-alpine3.21	Benefits: Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21	1 week ago
`8.4-fpm-alpine` Image introduces no new vulnerability but removes 4 Also known as: 8.4.8-fpm-alpine 8.4.8-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 37 MB Flavor: alpine OS: 3.22	1 week ago

github-actions · 2025-06-17T19:26:32Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8-alpine

Name	8.4.8-alpine3.22
Digest	sha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2
Vulnerabilities
Pushed	1 week ago
Size	42 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.4.8

The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.8-alpine, 8.4.8-alpine3.22, 8.4.8-cli-alpine, 8.4.8-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2025-06-17T19:26:35Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.3-alpine

Name	8.3.22-alpine3.22
Digest	sha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961
Vulnerabilities
Pushed	1 week ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.3.22

The base image is also available under the supported tag(s): 8.3-alpine3.22, 8.3-cli-alpine, 8.3-cli-alpine3.22, 8.3.22-alpine, 8.3.22-alpine3.22, 8.3.22-cli-alpine, 8.3.22-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.4-alpine` Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago

github-actions · 2025-06-17T19:26:35Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.1-alpine

Name	8.1.32-alpine3.21
Digest	sha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b
Vulnerabilities
Pushed	3 months ago
Size	36 MB
Packages	52
Flavor	alpine
OS	3.21
Runtime	8.1.32

The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.32-alpine, 8.1.32-alpine3.21, 8.1.32-cli-alpine, 8.1.32-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed
`8.4-alpine3.21` Minor runtime version update Also known as: 8.4.8-cli-alpine3.21 8-cli-alpine3.21 cli-alpine3.21 alpine3.21 8-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.21 Runtime: 8.4	1 week ago
`8.3-alpine3.21` Minor runtime version update Also known as: 8.3.22-cli-alpine3.21 8.3-cli-alpine3.21 8.3.22-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.21 Runtime: 8.3.22	1 week ago
`8.2-alpine3.21` Minor runtime version update Also known as: 8.2.28-cli-alpine3.21 8.2-cli-alpine3.21 8.2.28-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.2.28	3 months ago
`8.1-alpine3.22` Patch runtime version update Also known as: 8.1.32-cli-alpine3.22 8.1-cli-alpine3.22 8.1.32-alpine3.22	Benefits: Patch runtime version update Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.1.32	1 week ago
`8.4-alpine` Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago
`8.3-alpine` Minor runtime version update Also known as: 8.3.22-cli-alpine 8.3.22-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.22-alpine 8.3.22-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago
`8.2-alpine` Minor runtime version update Also known as: 8.2.28-cli-alpine 8.2.28-cli-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.28-alpine 8.2.28-alpine3.22 8.2-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 8.2-alpine was pulled 1.8K times last month Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.2.28	1 week ago

github-actions · 2025-06-17T19:26:44Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:22ca343dd0a317cd802253f3e54d7b4d758ce04ee21ba84e998a2f19271f0ecd`
vulnerabilities
platform	linux/amd64
size	131 MB
packages	284

📦 Base Image php:8.2-alpine

also known as	`8.2-alpine3.22` `8.2-cli-alpine` `8.2-cli-alpine3.22` `8.2.28-alpine` `8.2.28-alpine3.22` `8.2.28-cli-alpine` `8.2.28-cli-alpine3.22`
digest	`sha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang)

pkg:golang/stdlib@1.24.3

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.017%`
EPSS Percentile	`2nd percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-06-17T19:26:44Z

Outdated

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:696e60a6802a4794d218eeab2a252214bb8560e613bce8c177a113c482ccb82d`
vulnerabilities
platform	linux/amd64
size	111 MB
packages	247

📦 Base Image php:53a4f6c5bdf2c0213cb7293bc9da263feaa0ea41955f71bc1de2465f801efff9

also known as	`8.1-alpine` `8.1-alpine3.21` `8.1-cli-alpine` `8.1-cli-alpine3.21` `8.1.32-alpine` `8.1.32-alpine3.21` `8.1.32-cli-alpine` `8.1.32-cli-alpine3.21`
digest	`sha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

github-actions · 2025-06-17T19:26:46Z

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

📦 Image Reference wayofdev/php-dev:latest

digest	`sha256:8cee81dbeace2d319bfcf45f7c42b6fff87bbab91a2103e9de46953f41a24810`
vulnerabilities
platform	linux/amd64
size	107 MB
packages	250

📦 Base Image php:8.2-fpm-alpine

also known as	`8.2-fpm-alpine3.22` `8.2.28-fpm-alpine` `8.2.28-fpm-alpine3.22`
digest	`sha256:1a30bfabe4c99f09227f38c8821d19f6e16702a81ceda26c0d8c929086ed4fb7`
vulnerabilities

golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

Improper Authorization

Affected range	`<0.31.0`
Fixed version	`0.31.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`35.144%`
EPSS Percentile	`97th percentile`

Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected range	`<0.35.0`
Fixed version	`0.35.0`
EPSS Score	`0.058%`
EPSS Percentile	`18th percentile`

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang)

pkg:golang/stdlib@1.24.3

Affected range	`>=1.24.0-0 <1.24.4`
Fixed version	`1.24.4`
EPSS Score	`0.017%`
EPSS Percentile	`2nd percentile`

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

github-actions · 2025-06-17T19:26:48Z

Outdated

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.2-alpine

Name	8.2.28-alpine3.22
Digest	sha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7
Vulnerabilities
Pushed	1 week ago
Size	36 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.2.28

The base image is also available under the supported tag(s): 8.2-alpine3.22, 8.2-cli-alpine, 8.2-cli-alpine3.22, 8.2.28-alpine, 8.2.28-alpine3.22, 8.2.28-cli-alpine, 8.2.28-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.4-alpine` Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago
`8.3-alpine` Minor runtime version update Also known as: 8.3.22-cli-alpine 8.3.22-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.22-alpine 8.3.22-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago

github-actions · 2025-06-17T19:26:48Z

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.1-alpine

Name	8.1.32-alpine3.21
Digest	sha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b
Vulnerabilities
Pushed	3 months ago
Size	36 MB
Packages	52
Flavor	alpine
OS	3.21
Runtime	8.1.32

The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.32-alpine, 8.1.32-alpine3.21, 8.1.32-cli-alpine, 8.1.32-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed
`8.4-alpine3.21` Minor runtime version update Also known as: 8.4.8-cli-alpine3.21 8-cli-alpine3.21 cli-alpine3.21 alpine3.21 8-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.21 Runtime: 8.4	1 week ago
`8.3-alpine3.21` Minor runtime version update Also known as: 8.3.22-cli-alpine3.21 8.3-cli-alpine3.21 8.3.22-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.21 Runtime: 8.3.22	1 week ago
`8.2-alpine3.21` Minor runtime version update Also known as: 8.2.28-cli-alpine3.21 8.2-cli-alpine3.21 8.2.28-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.2.28	3 months ago
`8.1-alpine3.22` Patch runtime version update Also known as: 8.1.32-cli-alpine3.22 8.1-cli-alpine3.22 8.1.32-alpine3.22	Benefits: Patch runtime version update Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.1.32	1 week ago
`8.4-alpine` Minor runtime version update Also known as: 8.4.8-cli-alpine 8.4.8-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.8-alpine 8.4.8-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.8	1 week ago
`8.3-alpine` Minor runtime version update Also known as: 8.3.22-cli-alpine 8.3.22-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.22-alpine 8.3.22-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago
`8.2-alpine` Minor runtime version update Also known as: 8.2.28-cli-alpine 8.2.28-cli-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.28-alpine 8.2.28-alpine3.22 8.2-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 4 8.2-alpine was pulled 1.8K times last month Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.2.28	1 week ago

github-actions · 2025-06-17T19:26:49Z

Recommended fixes for image `wayofdev/php-dev:latest`

Base image is php:8.2-fpm-alpine

Name	8.2.28-fpm-alpine3.22
Digest	sha256:1a30bfabe4c99f09227f38c8821d19f6e16702a81ceda26c0d8c929086ed4fb7
Vulnerabilities
Pushed	1 week ago
Size	32 MB
Packages	61
Flavor	alpine
OS	3.22
Runtime	8.2.28

The base image is also available under the supported tag(s): 8.2-fpm-alpine3.22, 8.2.28-fpm-alpine, 8.2.28-fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
`8.3-fpm-alpine` Minor runtime version update Also known as: 8.3.22-fpm-alpine 8.3.22-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.22	1 week ago
`8.4-fpm-alpine` Image has same number of vulnerabilities Also known as: 8.4.8-fpm-alpine 8.4.8-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22	1 week ago

deps(deps): update ansible/ansible-lint action to v25.6.0

fbfbf0d

renovate bot requested a review from lotyp as a code owner June 17, 2025 19:25

renovate bot enabled auto-merge (squash) June 17, 2025 19:25

github-actions bot added the type: maintenance For maintenance, refactor and testing (perf, chore, style, revert, refactor, test, build, ci) label Jun 17, 2025

way-finder-bot self-requested a review June 17, 2025 19:27

way-finder-bot self-assigned this Jun 17, 2025

way-finder-bot approved these changes Jun 17, 2025

View reviewed changes

renovate bot merged commit 38d8642 into master Jun 17, 2025
19 of 20 checks passed

renovate bot deleted the renovate/ansible-ansible-lint-25.x branch June 17, 2025 19:27

lotyp mentioned this pull request Jun 17, 2025

chore(master): release 2.8.18 #107

Merged

Uh oh!

deps(deps): update ansible/ansible-lint action to v25.6.0 #106

deps(deps): update ansible/ansible-lint action to v25.6.0 #106

Uh oh!

Conversation

renovate bot commented Jun 17, 2025

Release Notes

v25.6.0

Configuration

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Recommended fixes for image wayofdev/php-dev:latest

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

Summary

Details

Risk Assessment

Impact

References

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Vulnerabilities of wayofdev/php-dev:latest

`v25.6.0`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

🔍 Vulnerabilities of `wayofdev/php-dev:latest`

github-actions bot commented Jun 17, 2025 •

edited

Loading

Recommended fixes for image `wayofdev/php-dev:latest`

Recommended fixes for image `wayofdev/php-dev:latest`

Recommended fixes for image `wayofdev/php-dev:latest`