fix(php): publish legacy security backports under maintenance tags

Author: zhengkunwang223

.cnb.yml

@@ -33,6 +33,11 @@ main:
             image_version="${PHP_IMAGE_VERSION:-}"
             if [ -z "$image_version" ]; then
               case "$PHP_VERSION" in
+                5.6.40) image_version=5.6.41 ;;
+                7.0.33) image_version=7.0.34 ;;
+                7.1.33) image_version=7.1.34 ;;
+                7.2.34) image_version=7.2.35 ;;
+                7.3.33) image_version=7.3.34 ;;
                 7.4.33) image_version=7.4.34 ;;
                 8.0.30) image_version=8.0.31 ;;
                 8.1.34) image_version=8.1.35 ;;
@@ -52,4 +57,4 @@ main:
               -t $IMAGE_TAG 
               -f php/$DIR/Dockerfile 
               php/$DIR/ 
-              --push
+              --push

.github/workflows/php5-release.yml

@@ -5,8 +5,8 @@ on:
   workflow_dispatch:
     inputs:
       php56Version:
-        description: 'PHP 5.6 Version'
-        default: '5.6.40'
+        description: '1Panel maintenance image version (PHP remains 5.6.40)'
+        default: '5.6.41'
         required: true
 
 jobs:

.github/workflows/php7-legacy-release.yml

@@ -1,5 +1,5 @@
 name: Build PHP 7 Legacy Images
-run-name: Build PHP 7 Legacy Images 7.0.33, 7.1.33, 7.2.34
+run-name: Build PHP 7 Legacy Images 7.0.34, 7.1.34, 7.2.35
 
 on:
   workflow_dispatch:
@@ -9,13 +9,19 @@ permissions:
 
 jobs:
   docker:
-    name: Build PHP Image ${{ matrix.phpVersion }}
+    name: Build PHP Image ${{ matrix.imageVersion }} (PHP ${{ matrix.phpVersion }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       max-parallel: 1
       matrix:
-        phpVersion: ["7.0.33", "7.1.33", "7.2.34"]
+        include:
+          - phpVersion: "7.0.33"
+            imageVersion: "7.0.34"
+          - phpVersion: "7.1.33"
+            imageVersion: "7.1.34"
+          - phpVersion: "7.2.34"
+            imageVersion: "7.2.35"
     steps:
       - name: Checkout
         uses: actions/checkout@v5
@@ -39,6 +45,6 @@ jobs:
           file: php/${{ matrix.phpVersion }}/Dockerfile
           platforms: linux/amd64,linux/arm64/v8,linux/arm/v7
           push: true
-          tags: 1panel/php:${{ matrix.phpVersion }}-fpm
+          tags: 1panel/php:${{ matrix.imageVersion }}-fpm
           cache-from: type=gha,scope=php-legacy-${{ matrix.phpVersion }}
           cache-to: type=gha,mode=max,scope=php-legacy-${{ matrix.phpVersion }}

.github/workflows/php7-release.yml

@@ -1,5 +1,5 @@
 name: Build PHP 7 Image
-run-name: Build PHP 7 Image ${{ github.event.inputs.php74ImageVersion }}, ${{ github.event.inputs.php73Version }}
+run-name: Build PHP 7 Image ${{ github.event.inputs.php74ImageVersion }}, ${{ github.event.inputs.php73ImageVersion }}
 
 on:
   workflow_dispatch:
@@ -23,9 +23,13 @@ on:
         default: true
         required: false
       php73Version:
-        description: 'PHP 7.3 Version'
+        description: 'Official PHP 7.3 base version (7.3.33)'
         default: '7.3.33'
         required: true
+      php73ImageVersion:
+        description: '1Panel maintenance image version (PHP remains 7.3.33)'
+        default: '7.3.34'
+        required: true
 
 jobs:
   docker:
@@ -72,6 +76,6 @@ jobs:
           build-args:
             PHP_VERSION=${{ github.event.inputs.php73Version }}
           tags: |
-            1panel/php:${{ github.event.inputs.php73Version }}-fpm
+            1panel/php:${{ github.event.inputs.php73ImageVersion }}-fpm
           cache-from: type=gha
           cache-to: type=gha,mode=max

README.md

@@ -42,9 +42,9 @@ Commit and push the fixes, then select that branch in Actions. Existing images a
 
 | Action | Inputs | Published `1panel/php` tags |
 | --- | --- | --- |
-| Build PHP 5 Image | `php56Version=5.6.40` | `5.6.40-fpm` (amd64) |
-| Build PHP 7 Legacy Images | No inputs; builds all three versions | `7.0.33-fpm`, `7.1.33-fpm`, `7.2.34-fpm` |
-| Build PHP 7 Image | `buildPhp74=true`, `php74Version=7.4.33`, `php74ImageVersion=7.4.34`, `buildPhp73=true`, `php73Version=7.3.33` | `7.4.34-fpm`, `7.3.33-fpm` |
+| Build PHP 5 Image | `php56Version=5.6.41` | `5.6.41-fpm` (amd64) |
+| Build PHP 7 Legacy Images | No inputs; builds all three versions | `7.0.34-fpm`, `7.1.34-fpm`, `7.2.35-fpm` |
+| Build PHP 7 Image | `buildPhp74=true`, `php74Version=7.4.33`, `php74ImageVersion=7.4.34`, `buildPhp73=true`, `php73Version=7.3.33`, `php73ImageVersion=7.3.34` | `7.4.34-fpm`, `7.3.34-fpm` |
 | Build PHP 8 Image | Run twice: `phpVersion=8.0.30`, then `8.1.34` | `8.0.31-fpm`, `8.1.35-fpm` |
 
 The legacy PHP 7 Action uses the existing Dockerfiles and preserves the previous workflow's amd64/arm64/arm/v7 platform list; local PECL installation checks cover amd64 only. The alternative `php/5.6` context remains available through CNB. Both 5.6 contexts include the PECL fix.
@@ -53,7 +53,7 @@ For PHP 8.2+, rebuild only images whose PEAR is older than 1.10.17. `Build PHP 8
 
 ## PHP EOL source backports
 
-PHP 5.6.40, 7.0.33, 7.1.33, 7.2.34 and 7.3.33 builds also apply SHA256-pinned local source backports, including the alternate `php/5.6` context. The third-party starting patches have been supplemented with applicable allocation-overflow, VM and request-state changes from PHP's minimal backport. Image tags and internal PHP versions stay unchanged. Use `tests/check-php-legacy-backport.py` for source checks and `tests/check-php-legacy-runtime.py IMAGE` for actual CLI/FPM regressions. These branches remain EOL; provenance, behavior changes and validation instructions are documented below.
+PHP 5.6.40, 7.0.33, 7.1.33, 7.2.34 and 7.3.33 builds also apply SHA256-pinned local source backports, including the alternate `php/5.6` context. The third-party starting patches have been supplemented with applicable allocation-overflow, VM and request-state changes from PHP's minimal backport. The maintenance image tags are `5.6.41-fpm`, `7.0.34-fpm`, `7.1.34-fpm`, `7.2.35-fpm` and `7.3.34-fpm`; internal PHP versions retain the real baselines above. Use `tests/check-php-legacy-backport.py` for source checks and `tests/check-php-legacy-runtime.py IMAGE` for actual CLI/FPM regressions. These branches remain EOL; provenance, behavior changes and validation instructions are documented below.
 
 PHP 7.4.33, 8.0.30 and 8.1.34 builds apply the official minimal source backports for CVE-2026-109618 / CVE-2026-109619 and rebuild PHP. These branches remain EOL; older patch levels in these series now fail explicitly. `1panel/php:7.4.34-fpm`, `8.0.31-fpm` and `8.1.35-fpm` are 1Panel maintenance image tags based on official PHP 7.4.33, 8.0.30 and 8.1.34 respectively; their internal PHP versions remain unchanged. See [implementation, compatibility changes and validation](php/EOL-BACKPORT.md).
 

README_zh.md

@@ -42,9 +42,9 @@ PHP 5.6、PHP 7 和 PHP 8 镜像在编译 PHP 后安装固定版本、校验 SHA
 
 | Action | 参数 | 发布的 `1panel/php` 标签 |
 | --- | --- | --- |
-| Build PHP 5 Image | `php56Version=5.6.40` | `5.6.40-fpm`（amd64） |
-| Build PHP 7 Legacy Images | 无参数，一次构建三个版本 | `7.0.33-fpm`、`7.1.33-fpm`、`7.2.34-fpm` |
-| Build PHP 7 Image | `buildPhp74=true`、`php74Version=7.4.33`、`php74ImageVersion=7.4.34`、`buildPhp73=true`、`php73Version=7.3.33` | `7.4.34-fpm`、`7.3.33-fpm` |
+| Build PHP 5 Image | `php56Version=5.6.41` | `5.6.41-fpm`（amd64） |
+| Build PHP 7 Legacy Images | 无参数，一次构建三个版本 | `7.0.34-fpm`、`7.1.34-fpm`、`7.2.35-fpm` |
+| Build PHP 7 Image | `buildPhp74=true`、`php74Version=7.4.33`、`php74ImageVersion=7.4.34`、`buildPhp73=true`、`php73Version=7.3.33`、`php73ImageVersion=7.3.34` | `7.4.34-fpm`、`7.3.34-fpm` |
 | Build PHP 8 Image | 分别运行两次：`phpVersion=8.0.30`、`8.1.34` | `8.0.31-fpm`、`8.1.35-fpm` |
 
 旧 PHP 7 Action 使用已有 Dockerfile，保留此前工作流的 amd64/arm64/arm/v7 平台列表；本地 PECL 安装验证仅覆盖 amd64。备用 `php/5.6` 构建目录仍可通过 CNB 选择，两个 5.6 目录均包含 PECL 修复。
@@ -53,7 +53,7 @@ PHP 8.2+ 仅在镜像内 PEAR 低于 1.10.17 时需要为本问题重打。`Buil
 
 ## PHP EOL 源码回补
 
-PHP 5.6.40、7.0.33、7.1.33、7.2.34 和 7.3.33 的构建也会应用固定 SHA256 的本地源码回补。补丁以第三方回补为起点，并补齐官方最小回补中适用于各旧分支的分配溢出、VM 和请求状态清理等改动；备用 `php/5.6` 入口同样覆盖。镜像标签和内部 PHP 版本保持原值。源码校验使用 `tests/check-php-legacy-backport.py`，实际 CLI/FPM 回归使用 `tests/check-php-legacy-runtime.py IMAGE`。这些旧分支仍为 EOL，详细来源、行为变化和验证方式见下方说明。
+PHP 5.6.40、7.0.33、7.1.33、7.2.34 和 7.3.33 的构建也会应用固定 SHA256 的本地源码回补。补丁以第三方回补为起点，并补齐官方最小回补中适用于各旧分支的分配溢出、VM 和请求状态清理等改动；备用 `php/5.6` 入口同样覆盖。维护版镜像标签分别为 `5.6.41-fpm`、`7.0.34-fpm`、`7.1.34-fpm`、`7.2.35-fpm`、`7.3.34-fpm`，内部 PHP 版本仍保留上述真实基线。源码校验使用 `tests/check-php-legacy-backport.py`，实际 CLI/FPM 回归使用 `tests/check-php-legacy-runtime.py IMAGE`。这些旧分支仍为 EOL，详细来源、行为变化和验证方式见下方说明。
 
 PHP 7.4.33、8.0.30 和 8.1.34 构建会应用官方针对 CVE-2026-109618 / CVE-2026-109619 的最小源码回补并重新编译 PHP。这些分支仍为 EOL，同系列更早的补丁版本现在会明确失败。`1panel/php:7.4.34-fpm`、`8.0.31-fpm` 和 `8.1.35-fpm` 为 1Panel 维护版镜像标签，分别基于官方 PHP 7.4.33、8.0.30、8.1.34 加上述回补，内部 PHP 版本保持原值。详见[实现、兼容性变化和验证说明](php/EOL-BACKPORT.md)。
 

php/EOL-BACKPORT.md

@@ -2,7 +2,7 @@
 
 ## PHP 5.6 and 7.0–7.3
 
-The exact baselines **5.6.40, 7.0.33, 7.1.33, 7.2.34 and 7.3.33** also receive locally maintained source backports. These are not official PHP security releases or continued support for these branches. Internal PHP versions and the existing image tags remain unchanged.
+The exact baselines **5.6.40, 7.0.33, 7.1.33, 7.2.34 and 7.3.33** also receive locally maintained source backports. These are not official PHP security releases or continued support for these branches. Internal PHP versions remain unchanged; publication uses the distinct 1Panel maintenance image tags listed below.
 
 The starting patches are from [vperetti's backports at `6296d6baf05cd2e727e66d38b8f33caf60d90896`](https://github.com/vperetti/php-cve-2026-109618-109619-backports/tree/6296d6baf05cd2e727e66d38b8f33caf60d90896). They have been supplemented by comparison with the PHP project's [7.4 minimal backport](https://github.com/php/php-src/commit/712e60f9edfd03f0960fc4fc3c2c375f42b90aa2):
 
@@ -85,19 +85,31 @@ These are **1Panel maintenance image tags**, not new official PHP releases:
 
 | Official base / internal PHP version | 1Panel output image |
 | --- | --- |
+| 5.6.40 | `1panel/php:5.6.41-fpm` |
+| 7.0.33 | `1panel/php:7.0.34-fpm` |
+| 7.1.33 | `1panel/php:7.1.34-fpm` |
+| 7.2.34 | `1panel/php:7.2.35-fpm` |
+| 7.3.33 | `1panel/php:7.3.34-fpm` |
 | 7.4.33 | `1panel/php:7.4.34-fpm` |
 | 8.0.30 | `1panel/php:8.0.31-fpm` |
 | 8.1.34 | `1panel/php:8.1.35-fpm` |
 
 `php -v`, `PHP_VERSION`, `php-config`, source checksums and every `FROM php:${PHP_VERSION}-fpm` retain the real official baseline in the left column. Do not pass the maintenance tag version as the Docker build's `PHP_VERSION`.
 
-The PHP 7 workflow has separate inputs: `php74Version` defaults to `7.4.33` (base), and `php74ImageVersion` defaults to `7.4.34` (output image). Both `buildPhp74` and `buildPhp73` default to true. Set `buildPhp73=false` to publish only the 7.4 maintenance image, or `buildPhp74=false` to publish only 7.3. The normal PHP 8 workflow maps the exact inputs `8.0.30` and `8.1.34` to maintenance output tags; all other inputs, including 8.2+, keep their previous output tags. Its input names/defaults and Docker build argument are unchanged. The four-version PHP 8 security workflow is unchanged.
+The PHP 5 workflow keeps its existing `php56Version` input for the output tag only, now defaulting to `5.6.41`; its source context remains fixed at `php/5.6.40`. The legacy PHP 7 matrix keeps each source baseline in `phpVersion` and stores its maintenance tag in `imageVersion`, preserving the existing source directories, cache scopes and platform list.
 
-CNB's PHP build accepts optional `PHP_IMAGE_VERSION`. When blank, the three exact EOL baselines above map to their maintenance tags; all other versions keep the original `PHP_VERSION` output tag. An explicit `PHP_IMAGE_VERSION` overrides only the output tag. For example, set `DIR=7`, `PHP_VERSION=7.4.33` (or `DIR=8`, `PHP_VERSION=8.0.30` / `8.1.34`). The Docker build argument remains `PHP_VERSION`.
+The PHP 7 workflow has separate inputs: `php74Version` defaults to `7.4.33` (base), and `php74ImageVersion` defaults to `7.4.34` (output image). `php73Version=7.3.33` and `php73ImageVersion=7.3.34` provide the same base/output separation for 7.3. Both `buildPhp74` and `buildPhp73` default to true. Set `buildPhp73=false` to publish only the 7.4 maintenance image, or `buildPhp74=false` to publish only 7.3. The normal PHP 8 workflow maps the exact inputs `8.0.30` and `8.1.34` to maintenance output tags; all other inputs, including 8.2+, keep their previous output tags. Its input names/defaults and Docker build argument are unchanged. The four-version PHP 8 security workflow is unchanged.
+
+CNB's PHP build accepts optional `PHP_IMAGE_VERSION`. When blank, the eight exact EOL baselines above map to their maintenance tags; all other versions keep the original `PHP_VERSION` output tag. An explicit `PHP_IMAGE_VERSION` overrides only the output tag. For example, set `DIR=7`, `PHP_VERSION=7.4.33` (or `DIR=8`, `PHP_VERSION=8.0.30` / `8.1.34`). The Docker build argument remains `PHP_VERSION`.
 
 For direct builds:
 
 ```sh
+docker build -t 1panel/php:5.6.41-fpm php/5.6.40
+docker build -t 1panel/php:7.0.34-fpm php/7.0.33
+docker build -t 1panel/php:7.1.34-fpm php/7.1.33
+docker build -t 1panel/php:7.2.35-fpm php/7.2.34
+docker build --build-arg PHP_VERSION=7.3.33 -t 1panel/php:7.3.34-fpm php/7
 docker build --build-arg PHP_VERSION=7.4.33 -t 1panel/php:7.4.34-fpm php/7
 docker build --build-arg PHP_VERSION=8.0.30 -t 1panel/php:8.0.31-fpm php/8
 docker build --build-arg PHP_VERSION=8.1.34 -t 1panel/php:8.1.35-fpm php/8

tests/check-php-eol-backport.py

@@ -76,7 +76,16 @@
 assert "php74ImageVersion:\n        description: '1Panel maintenance image version (PHP remains 7.4.33)'\n        default: '7.4.34'" in php7
 assert 'PHP_VERSION=${{ github.event.inputs.php74Version }}' in php7
 assert '1panel/php:${{ github.event.inputs.php74ImageVersion }}-fpm' in php7
-assert '1panel/php:${{ github.event.inputs.php73Version }}-fpm' in php7
+assert "php73Version:\n        description: 'Official PHP 7.3 base version (7.3.33)'\n        default: '7.3.33'" in php7
+assert "php73ImageVersion:\n        description: '1Panel maintenance image version (PHP remains 7.3.33)'\n        default: '7.3.34'" in php7
+assert 'PHP_VERSION=${{ github.event.inputs.php73Version }}' in php7
+assert '1panel/php:${{ github.event.inputs.php73ImageVersion }}-fpm' in php7
+assert '1panel/php:${{ github.event.inputs.php73Version }}-fpm' not in php7
+php5 = (root / '.github/workflows/php5-release.yml').read_text()
+assert "php56Version:\n        description: '1Panel maintenance image version (PHP remains 5.6.40)'\n        default: '5.6.41'" in php5
+assert 'context: php/5.6.40' in php5 and 'file: php/5.6.40/Dockerfile' in php5
+assert '1panel/php:${{ github.event.inputs.php56Version }}-fpm' in php5
+assert 'PHP_VERSION=${{ github.event.inputs.php56Version }}' not in php5
 assert "buildPhp73:\n        description: 'Also build and publish PHP 7.3'\n        type: boolean\n        default: true" in php7
 assert 'Build PHP-7.3 and Push\n        if: ${{ inputs.buildPhp73 }}' in php7
 cnb = (root / '.cnb.yml').read_text()
@@ -87,12 +96,14 @@
 assert '1panel/php:${{ steps.image.outputs.version }}-fpm' in php8
 tag_step = textwrap.dedent(php8.split('        run: |\n', 1)[1].split('\n      - name:', 1)[0])
 cnb_step = textwrap.dedent(cnb.split('web_trigger_build_php_image:', 1)[1].split('          script: |\n', 1)[1].split('\n          exports:', 1)[0])
-for base, expected in [('7.4.33', '7.4.34'), ('8.0.30', '8.0.31'), ('8.1.34', '8.1.35'),
+for base, expected in [('5.6.40', '5.6.41'), ('7.0.33', '7.0.34'), ('7.1.33', '7.1.34'),
+                       ('7.2.34', '7.2.35'), ('7.3.33', '7.3.34'),
+                       ('7.4.33', '7.4.34'), ('8.0.30', '8.0.31'), ('8.1.34', '8.1.35'),
                        ('8.2.35', '8.2.35'), ('8.3.36', '8.3.36'), ('8.4.27', '8.4.27'), ('8.5.12', '8.5.12')]:
     with tempfile.TemporaryDirectory() as tmp:
         output = Path(tmp) / 'output'
         env = dict(os.environ, PHP_VERSION=base, PHP_IMAGE_VERSION='', DOCKER_REGISTRY='registry', DOCKER_GROUP='1panel', GITHUB_OUTPUT=str(output))
-        if not base.startswith('7.'):
+        if base.startswith('8.'):
             subprocess.run(['sh', '-eu', '-c', tag_step], env=env, check=True)
             assert output.read_text().strip() == 'version=' + expected
         tag = subprocess.check_output(['sh', '-eu', '-c', cnb_step], env=env, text=True)

tests/check-php-pecl-source.py

@@ -25,10 +25,11 @@
         subprocess.run(['sh', '-n', '-c', command], check=True)
 
 workflow = (root / '.github/workflows/php7-legacy-release.yml').read_text()
-assert 'phpVersion: ["7.0.33", "7.1.33", "7.2.34"]' in workflow
+assert re.findall(r'- phpVersion: "([^"]+)"\s+imageVersion: "([^"]+)"', workflow) == [
+    ('7.0.33', '7.0.34'), ('7.1.33', '7.1.34'), ('7.2.34', '7.2.35')]
 assert 'context: php/${{ matrix.phpVersion }}' in workflow
 assert 'file: php/${{ matrix.phpVersion }}/Dockerfile' in workflow
-assert 'tags: 1panel/php:${{ matrix.phpVersion }}-fpm' in workflow
+assert 'tags: 1panel/php:${{ matrix.imageVersion }}-fpm' in workflow
 assert 'context: php/5.6.40' in (root / '.github/workflows/php5-release.yml').read_text()
 subprocess.run(['bash', '-n', str(root / 'tests/check-php-pecl.sh')], check=True)
 print('PASS: seven PECL bootstraps, RUN shell syntax, legacy CA and release contexts')