The Docker image runs PHP 8.5.12, which fixes PHP2Shell
(CVE-2026-109618, CVE-2026-109619): two flaws that let an attacker
without an account run code on the server when a request ends
abnormally. Every earlier image runs an affected PHP.
Dependencies are up to date (Laravel 13.38, Livewire 4.4.8, Octane
2.22, Vite 8.3.5). Update now: docker compose pull and docker compose
up -d.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Composer: Laravel 13.38, Octane 2.22, Livewire 4.4.8 and Pest 5.3.3,
with the packages they bring (35 in all). npm: Vite 8.3.5 with
Rolldown 1.2.15, and Playwright 1.64.1. chokidar stays on 5: a major
update does not go into a patch release. Both audits are clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>