From 603dd33a358337e6c3e23e0e0ad79c56efb82c71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gr=C3=A9goire=20Pineau?= <lyrixx@lyrixx.info>
Date: Wed, 21 Oct 2026 10:28:54 +0200
Subject: [PATCH] feat(php): require a minimal patch version of PHP

Bumping it after a security release invalidates the build cache of the PHP
packages, which would keep the vulnerable version otherwise, and the build
fails until Sury publishes the fixed version.
---
 CHANGELOG.md                                  |  1 +
 infrastructure/docker/services/php/Dockerfile | 12 +++++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 57bd0aa..306410c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@
   * Add support for pie
   * Add some PHP tooling (PHP-CS-Fixer, PHPStan, Twig-CS-Fixer)
   * Update Composer to version 2.8
+  * Require a minimal patch version of PHP, to force the upgrade after a security release
 * Builder
   * Update NodeJS to version 20.x LTS
   * Add support for autocomplete (composer & symfony)
diff --git a/infrastructure/docker/services/php/Dockerfile b/infrastructure/docker/services/php/Dockerfile
index da33a1e..6244c48 100644
--- a/infrastructure/docker/services/php/Dockerfile
+++ b/infrastructure/docker/services/php/Dockerfile
@@ -23,6 +23,10 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
 
 ARG PHP_VERSION
+# Minimal patch version of each PHP branch, to bump after a security release: it
+# invalidates the build cache (local and registry) of the PHP packages, which would
+# keep the vulnerable version otherwise, and the build fails until Sury publishes it
+ARG PHP_MIN_VERSIONS="8.3.35 8.4.26 8.5.11"
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
@@ -40,7 +44,13 @@ RUN apt-get update \
         "php${PHP_VERSION}-xml" \
         "php${PHP_VERSION}-zip" \
     && apt-get clean \
-    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/* \
+    && for min in ${PHP_MIN_VERSIONS}; do \
+        if [ "${min%.*}" = "${PHP_VERSION}" ] && dpkg --compare-versions "$(php -r 'echo PHP_VERSION;')" lt "${min}"; then \
+            echo "PHP ${min} is required, packages.sury.org does not have it yet." >&2; \
+            exit 1; \
+        fi; \
+    done
 
 # Every PHP setting of every image: each stage enables its own ones with phpenmod
 COPY php/mods-available/ /etc/php/${PHP_VERSION}/mods-available/