From b591b757563c8ac7ac99bf805584c23061e871eb Mon Sep 17 00:00:00 2001 From: NautiyalVikas1 Date: Thu, 22 Oct 2026 09:36:58 +0100 Subject: [PATCH] Update PHP to 8.5.12 to remediate CC-4875 (CVE-2026-109618, CVE-2026-109619) PHP 8.1 is end-of-life and no longer receives security updates. Bump the PHP runtime and version constraints to 8.5.12, the patched release for the latest supported branch, across all PHP tutorial projects: - Dockerfile: php:8.1.11RC1-zts-buster -> php:8.5.12-zts-bookworm (also moves off EOL Debian Buster to Bookworm) - composer.json / composer.lock: php requirement >=8.1 -> >=8.5.12 - README.md: update documented PHP version Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- user-restricted-combined-auth-tutorials/cis2/php/README.md | 2 +- user-restricted-combined-auth-tutorials/cis2/php/composer.json | 2 +- user-restricted-combined-auth-tutorials/cis2/php/composer.lock | 2 +- user-restricted-combined-auth-tutorials/nhs-login/php/README.md | 2 +- .../nhs-login/php/composer.json | 2 +- .../nhs-login/php/composer.lock | 2 +- user-restricted-separate-auth-tutorials/cis2/php/README.md | 2 +- user-restricted-separate-auth-tutorials/cis2/php/composer.json | 2 +- user-restricted-separate-auth-tutorials/cis2/php/composer.lock | 2 +- .../nhs-login/php/Dockerfile | 2 +- user-restricted-separate-auth-tutorials/nhs-login/php/README.md | 2 +- .../nhs-login/php/composer.json | 2 +- .../nhs-login/php/composer.lock | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/user-restricted-combined-auth-tutorials/cis2/php/README.md b/user-restricted-combined-auth-tutorials/cis2/php/README.md index c20ec10..7a60de2 100644 --- a/user-restricted-combined-auth-tutorials/cis2/php/README.md +++ b/user-restricted-combined-auth-tutorials/cis2/php/README.md @@ -9,7 +9,7 @@ To call a user-restricted API, the end user must be authenticated. NHS CIS2 is used to authenticate when the end user is a healthcare worker. With the combined authentication and authorisation pattern, authentication is done by NHS CIS2 but is coordinated behind our OAuth2.0 authorisation server. In exchange, you receive an access token which you need to include in the API request. ## Setting up your environment -This example project was developed using Symfony 6.1.4 and PHP 8.1.9 so you need to have these installed. +This example project was developed using Symfony 6.1.4 and PHP 8.5.12 so you need to have these installed. ## Checkout the GitHub Repository diff --git a/user-restricted-combined-auth-tutorials/cis2/php/composer.json b/user-restricted-combined-auth-tutorials/cis2/php/composer.json index d312f69..a8d132e 100644 --- a/user-restricted-combined-auth-tutorials/cis2/php/composer.json +++ b/user-restricted-combined-auth-tutorials/cis2/php/composer.json @@ -4,7 +4,7 @@ "minimum-stability": "stable", "prefer-stable": true, "require": { - "php": ">=8.1", + "php": ">=8.5.12", "ext-ctype": "*", "ext-iconv": "*", "league/oauth2-client": "2.9", diff --git a/user-restricted-combined-auth-tutorials/cis2/php/composer.lock b/user-restricted-combined-auth-tutorials/cis2/php/composer.lock index 7c43045..1135675 100644 --- a/user-restricted-combined-auth-tutorials/cis2/php/composer.lock +++ b/user-restricted-combined-auth-tutorials/cis2/php/composer.lock @@ -9957,7 +9957,7 @@ "prefer-stable": true, "prefer-lowest": false, "platform": { - "php": ">=8.1", + "php": ">=8.5.12", "ext-ctype": "*", "ext-iconv": "*" }, diff --git a/user-restricted-combined-auth-tutorials/nhs-login/php/README.md b/user-restricted-combined-auth-tutorials/nhs-login/php/README.md index ff0778c..d4171f6 100644 --- a/user-restricted-combined-auth-tutorials/nhs-login/php/README.md +++ b/user-restricted-combined-auth-tutorials/nhs-login/php/README.md @@ -9,7 +9,7 @@ To call a user-restricted API, the end user must be authenticated. NHS login is used to authenticate when the end user is a patient. With the combined authentication and authorisation pattern, authentication is done by NHS login but is coordinated behind our OAuth2.0 authorisation server. In exchange, you receive an access token which you need to include in the API request. ## Setting up your environment -This example project was developed using Symfony 6.1.4 and PHP 8.1.9 so you need to have these installed. +This example project was developed using Symfony 6.1.4 and PHP 8.5.12 so you need to have these installed. ## Checkout the GitHub Repository diff --git a/user-restricted-combined-auth-tutorials/nhs-login/php/composer.json b/user-restricted-combined-auth-tutorials/nhs-login/php/composer.json index d312f69..a8d132e 100644 --- a/user-restricted-combined-auth-tutorials/nhs-login/php/composer.json +++ b/user-restricted-combined-auth-tutorials/nhs-login/php/composer.json @@ -4,7 +4,7 @@ "minimum-stability": "stable", "prefer-stable": true, "require": { - "php": ">=8.1", + "php": ">=8.5.12", "ext-ctype": "*", "ext-iconv": "*", "league/oauth2-client": "2.9", diff --git a/user-restricted-combined-auth-tutorials/nhs-login/php/composer.lock b/user-restricted-combined-auth-tutorials/nhs-login/php/composer.lock index 2c3f309..2f212b3 100644 --- a/user-restricted-combined-auth-tutorials/nhs-login/php/composer.lock +++ b/user-restricted-combined-auth-tutorials/nhs-login/php/composer.lock @@ -9957,7 +9957,7 @@ "prefer-stable": true, "prefer-lowest": false, "platform": { - "php": ">=8.1", + "php": ">=8.5.12", "ext-ctype": "*", "ext-iconv": "*" }, diff --git a/user-restricted-separate-auth-tutorials/cis2/php/README.md b/user-restricted-separate-auth-tutorials/cis2/php/README.md index 1642287..2b9cb68 100644 --- a/user-restricted-separate-auth-tutorials/cis2/php/README.md +++ b/user-restricted-separate-auth-tutorials/cis2/php/README.md @@ -9,7 +9,7 @@ To call a user-restricted API, the end user must be authenticated. NHS CIS2 is used to authenticate when the end user is a healthcare worker. With the separate authentication and authorisation pattern, authentication and authorisation are done separately. You might authenticate the user when they sign in but only get authorisation to call the API if and when you need it. You do authentication directly with NHS CIS2 and then separately do authorisation with our OAuth2.0 authorisation service ## Setting up your environment -This example project was developed using Symfony 6.1.4 and PHP 8.1.9 so you need to have these installed. +This example project was developed using Symfony 6.1.4 and PHP 8.5.12 so you need to have these installed. ## Checkout the GitHub Repository diff --git a/user-restricted-separate-auth-tutorials/cis2/php/composer.json b/user-restricted-separate-auth-tutorials/cis2/php/composer.json index d312f69..a8d132e 100644 --- a/user-restricted-separate-auth-tutorials/cis2/php/composer.json +++ b/user-restricted-separate-auth-tutorials/cis2/php/composer.json @@ -4,7 +4,7 @@ "minimum-stability": "stable", "prefer-stable": true, "require": { - "php": ">=8.1", + "php": ">=8.5.12", "ext-ctype": "*", "ext-iconv": "*", "league/oauth2-client": "2.9", diff --git a/user-restricted-separate-auth-tutorials/cis2/php/composer.lock b/user-restricted-separate-auth-tutorials/cis2/php/composer.lock index 2c3f309..2f212b3 100644 --- a/user-restricted-separate-auth-tutorials/cis2/php/composer.lock +++ b/user-restricted-separate-auth-tutorials/cis2/php/composer.lock @@ -9957,7 +9957,7 @@ "prefer-stable": true, "prefer-lowest": false, "platform": { - "php": ">=8.1", + "php": ">=8.5.12", "ext-ctype": "*", "ext-iconv": "*" }, diff --git a/user-restricted-separate-auth-tutorials/nhs-login/php/Dockerfile b/user-restricted-separate-auth-tutorials/nhs-login/php/Dockerfile index 274ed7f..f96d0b8 100644 --- a/user-restricted-separate-auth-tutorials/nhs-login/php/Dockerfile +++ b/user-restricted-separate-auth-tutorials/nhs-login/php/Dockerfile @@ -1,4 +1,4 @@ -FROM php:8.1.11RC1-zts-buster +FROM php:8.5.12-zts-bookworm USER root RUN apt-get update -y && apt-get install -y libmcrypt-dev diff --git a/user-restricted-separate-auth-tutorials/nhs-login/php/README.md b/user-restricted-separate-auth-tutorials/nhs-login/php/README.md index 64fa6a2..3c25991 100644 --- a/user-restricted-separate-auth-tutorials/nhs-login/php/README.md +++ b/user-restricted-separate-auth-tutorials/nhs-login/php/README.md @@ -9,7 +9,7 @@ To call a user-restricted API, the end user must be authenticated. NHS login is used to authenticate when the end user is a patient. With the separate authentication and authorisation pattern, authentication is done by NHS login. In exchange, you receive an access ID token which you need to exchange it with an access token. You need to include this access token in the API request. ## Setting up your environment -This example project was developed using Symfony 6.1.4 and PHP 8.1.9 so you need to have these installed. +This example project was developed using Symfony 6.1.4 and PHP 8.5.12 so you need to have these installed. ## Checkout the GitHub Repository diff --git a/user-restricted-separate-auth-tutorials/nhs-login/php/composer.json b/user-restricted-separate-auth-tutorials/nhs-login/php/composer.json index d312f69..a8d132e 100644 --- a/user-restricted-separate-auth-tutorials/nhs-login/php/composer.json +++ b/user-restricted-separate-auth-tutorials/nhs-login/php/composer.json @@ -4,7 +4,7 @@ "minimum-stability": "stable", "prefer-stable": true, "require": { - "php": ">=8.1", + "php": ">=8.5.12", "ext-ctype": "*", "ext-iconv": "*", "league/oauth2-client": "2.9", diff --git a/user-restricted-separate-auth-tutorials/nhs-login/php/composer.lock b/user-restricted-separate-auth-tutorials/nhs-login/php/composer.lock index 7c43045..1135675 100644 --- a/user-restricted-separate-auth-tutorials/nhs-login/php/composer.lock +++ b/user-restricted-separate-auth-tutorials/nhs-login/php/composer.lock @@ -9957,7 +9957,7 @@ "prefer-stable": true, "prefer-lowest": false, "platform": { - "php": ">=8.1", + "php": ">=8.5.12", "ext-ctype": "*", "ext-iconv": "*" },