[AaronFeledy]

Summary

Supported devwithlando/php images (8.2, 8.3, 8.4, 8.5, apache and fpm) refuse to build unless PHP_VERSION is at least the 22 Oct 2026 security release:

• 8.5.12
• 8.4.27
• 8.3.36
• 8.2.35

Those floors are CVE-2026-109618 and CVE-2026-109619. The check is a RUN immediately after the final FROM, so a stale base fails the build before build-push-action pushes. pull: true is there so BuildKit resolves the official tag from the registry. Tags stay at -7. No plugin release. EOL PHP runtimes (8.1 and older) are not security-patched by this; legacy apt-source maintenance only restores their existing builds.

Merging to main rebuilds and publishes the production tags. This PR only publishes -edge tags. Do not treat a green EOL job as a fix. After the main build, confirm the eight -7 Hub digests moved and php -v on amd64 and arm64 meets the floor. Users pick the new image up with lando rebuild, not lando start.

Test plan

• The eight supported jobs fail closed if the base is older than the floor
• After merge, Hub digests for 8.2/8.3/8.4/8.5 apache and fpm -7 differ from the 2026-06-24 publishes
• php -v on both platforms meets the floor
• EOL jobs are not described as patched

---

Note

Medium Risk
Changes how production PHP Docker images are built and published, with version gates tied to security releases; EOL image apt changes affect legacy rebuild reliability but not supported runtime paths.

Overview
Adds fail-closed minimum PHP version gates for supported 8.2–8.5 apache/fpm Dockerfiles: each image accepts MIN_PHP and aborts the build if PHP_VERSION is below the Oct 2026 security floors (8.2.35, 8.3.36, 8.4.27, 8.5.12).

The image build workflow passes those floors via matrix min_php, sets build-args: MIN_PHP=…, and enables pull: true so builds use fresh upstream bases.

EOL Bullseye images (7.3–8.0) gain apt source tweaks pointing security updates at archive.debian.org and disabling valid-until checks so legacy images can still apt update.

PR Leia workflow tweaks: Lando version falls back to the matrix when inputs are missing, clears lando-version-file, and pins run-leia-action to 0.6.7. CHANGELOG and AGENTS.md document the build checks and docs:mvb caution.

^{Reviewed by Cursor Bugbot for commit 19e89f2. Bugbot is set up for automated code reviews on this repo. Configure here.}

CI maintenance

Pinned the Leia action fallback to the existing lockfile version so its Node 18 runner does not install Node 24-only Leia 2. Restored bullseye archive package sources without disabling package signature verification. The PHP integration matrix now actually selects its stable/edge Lando version.

Local validation: lint and docs build passed; unit command passed (0 passing / 1 pending placeholder). Isolated setup/test/cleanup Leia smoke passed under Node 18.20.8. Full integration and multi-platform image validation are pending the new CI runs.

[netlify]

✅ Deploy Preview for lando-php ready!

Name	Link
🔨 Latest commit	19e89f2
🔍 Latest deploy log	https://app.netlify.com/projects/lando-php/deploys/6af7b2fa15984dc64e71b2c2
😎 Deploy Preview	https://deploy-preview-255--lando-php.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 89 (🔴 down 1 from production) Accessibility: 98 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.