From bc08f4323144273aa88831cc47d7d4c0fc04b1cd Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 26 Oct 2026 13:45:01 -0400 Subject: [PATCH] Update the PHP the Windows image ships before testing setup-php reused the image's PHP 8.5.11 after 8.5.12 shipped a security fix, and roave/security-advisories refuses to install on it, so the Windows leg failed on every pull request. Set setup-php's update (read from the step's environment) off Linux so it upgrades to the latest patch. --- .github/workflows/tests.yml | 6 ++++++ CHANGELOG.md | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 28fd004..15720ad 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -173,6 +173,12 @@ jobs: extensions: dom, curl, libxml, mbstring, zip, fileinfo, pdo, sqlite3, pdo_sqlite coverage: none ini-values: error_reporting=E_ALL + env: + # The Windows and macOS images ship PHP, and setup-php reuses that copy unless `update` + # is set (an env var in setup-php 2.x, not an input). A security release then lags there, + # and roave/security-advisories refuses to install on the vulnerable patch (8.5.11 vs + # 8.5.12, 2026-10-26). Linux installs fresh, so it is left alone. + update: ${{ runner.os != 'Linux' }} - name: Install dependencies run: composer update --prefer-stable --no-interaction --no-progress diff --git a/CHANGELOG.md b/CHANGELOG.md index 1e5f400..42dc063 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Fixed + +- **Windows CI installs the current PHP patch.** setup-php reused the PHP the Windows image + ships (8.5.11) after 8.5.12 fixed a security issue, so `roave/security-advisories` refused + to install and the Windows leg failed on every pull request. The cross-platform job now + sets setup-php's `update` (an environment variable) off Linux, so it upgrades to the latest patch. + ## [0.1.8] - 2026-10-20 ### Changed