Repository navigation
Upgrade images to PHP 8.2.35 (PHP2Shell fix) and support Akaunting 3.2 - #123
Merged
Merged
Conversation
Akaunting 3.2 requires PHP ^8.2, so images built on PHP 8.1 could no longer install or run the latest release. As a result, Docker Hub tags, including `latest`, have been stuck on 3.1.21 (akaunting/akaunting#3402). PHP 8.2.35 also fixes the critical unauthenticated RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). PHP 8.1 has no official fix for them. Images: - Apache images (Dockerfile, v.Dockerfile): php:8.1-apache -> php:8.2.35-apache - FPM image: php:8.1-fpm -> php:8.2.35-fpm - Alpine images: php:8.1-fpm-alpine3.15 -> php:8.2.35-fpm-alpine3.24, and the apk repositories now point to Alpine v3.24 Workflow: - Replace the deprecated `::set-output` command with $GITHUB_OUTPUT - Add a workflow_dispatch trigger for manual rebuilds - Bump actions/checkout to v4, docker/setup-qemu-action and docker/setup-buildx-action to v3, docker/login-action to v3, and docker/build-push-action to v6
The composer images run `npm install` and `npm run prod`, which failed on Alpine 3.24 because it ships Node.js 24. Akaunting requires node >=18 <21, and node-sass does not build on Node.js 24. Copy Node.js 20 and npm from the official node:20.20.2-alpine3.23 image instead of installing them from apk. Also set `fail-fast: false` in the build matrix, so a failure in one image no longer cancels the builds of the other images.
Pulling a newer image does not upgrade Akaunting, because the application files are kept in the akaunting-data volume. Explain how to back up the database, switch to the new image, and then upgrade with `php artisan update:all`, in that order. Akaunting 3.2 requires PHP 8.2, so upgrading on a PHP 8.1 image breaks the application.
This was referenced Oct 28, 2026
kevinveenbirkenbach
added a commit
to kevinveenbirkenbach/infinito-nexus-core
that referenced
this pull request
Oct 31, 2026
The role builds akaunting/docker at master. Upstream moved that Dockerfile to `FROM php:8.2.35-apache` (akaunting/docker#123, merged 2026-10-26), a release with the fixes for CVE-2026-109618 and CVE-2026-109619, so the to-do that asked to move off PHP 8.1.34 no longer describes the image the role builds. Closes infinito-nexus#1119 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves all images from PHP 8.1 to PHP 8.2.35 and fixes the publishing pipeline so Docker Hub images track the latest Akaunting release again.
Fixes akaunting/akaunting#3402
Why
latest) were stuck on 3.1.x.Changes
php:8.1-*->php:8.2.35-*. The Alpine images are updated from 3.15 to 3.24.node-sass) does not support Node.js 24, which ships with Alpine 3.24.set-outputwith$GITHUB_OUTPUT, addworkflow_dispatch, setfail-fast: false, and bump the action versions.Upgrade notes for existing installations
Pulling the new image updates PHP but not Akaunting, because the application files live in the
akaunting-datavolume. Users should:docker exec -u www-data akaunting php artisan update:all.The order matters: upgrading Akaunting to 3.2 while still on a PHP 8.1 image prevents the application from starting.