Security: Patch Brotli for CVE-2026-111497 and upgrade FrankenPHP to 1.13.4

src/common/usr/local/bin/docker-php-serversideup-dep-install-alpine

@@ -60,7 +60,7 @@ fi
 DEP_PACKAGES="$*"
 echo "🤖 Installing: $DEP_PACKAGES"
 apk update
-apk add --no-cache "$@"
+apk add --no-cache --upgrade "$@"
 
 
 echo "🧼 Cleaning up installation of: $DEP_PACKAGES"

src/variations/cli/Dockerfile

@@ -7,9 +7,12 @@ ARG PHP_VARIATION='cli'
 ##########
 FROM php:${PHP_VERSION}-${PHP_VARIATION}-${BASE_OS_VERSION}
 
+# brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
+    brotli-libs \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
+    libbrotli1 \
     procps \
     zip"
 ARG DEPENDENCY_PHP_EXTENSIONS='opcache pcntl pdo_mysql pdo_pgsql redis zip'

src/variations/fpm-apache/Dockerfile

@@ -22,12 +22,15 @@ RUN docker-php-serversideup-s6-install
 # FPM-APACHE: Main Image
 ##########
 FROM ${BASE_IMAGE}
+# brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
+    brotli-libs \
     apache2 \
     fcgi \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
     apache2 \
+    libbrotli1 \
     libfcgi-bin \
     procps \
     zip"

src/variations/fpm-nginx/Dockerfile

@@ -97,12 +97,15 @@ RUN \
 # FPM-NGINX: Main Image
 ##########
 FROM ${BASE_IMAGE}
+# brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
+    brotli-libs \
     fcgi \
     gettext \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
     gettext-base \
+    libbrotli1 \
     libfcgi-bin \
     procps \
     zip"

src/variations/fpm/Dockerfile

@@ -7,10 +7,13 @@ ARG PHP_VARIATION='fpm'
 ##########
 FROM php:${PHP_VERSION}-${PHP_VARIATION}-${BASE_OS_VERSION}
 
+# brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
+    brotli-libs \
     fcgi \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
+    libbrotli1 \
     libfcgi-bin \
     procps \
     zip"

src/variations/frankenphp/Dockerfile

@@ -2,7 +2,7 @@
 ARG BASE_OS_VERSION='trixie'
 ARG PHP_VERSION='8.5'
 ARG BASE_IMAGE="php:${PHP_VERSION}-zts-${BASE_OS_VERSION}"
-ARG FRANKENPHP_VERSION='1.13.2'
+ARG FRANKENPHP_VERSION='1.13.4'
 ARG GOLANG_VERSION='1.27'
 
 ########################
@@ -98,6 +98,23 @@ ENV GOTOOLCHAIN="local"
 RUN docker-php-serversideup-dep-install-alpine "$PHPIZE_DEPS ${BUILD_DEPENDENCY_PACKAGES_ALPINE}" && \
     docker-php-serversideup-dep-install-debian "${BUILD_DEPENDENCY_PACKAGES_DEBIAN}"
 
+# Bookworm ships libbrotli 1.0.9, but FrankenPHP's cbrotli needs 1.1 or newer and
+# 1.2.1 fixes CVE-2026-111497. Remove this once Bookworm is no longer supported.
+# Multiarch library paths sort before libc.conf on arm64, so without 000-brotli.conf
+# the distro libbrotli would still be loaded there.
+WORKDIR /usr/local/src/brotli
+RUN if ! pkg-config --atleast-version=1.1 libbrotlienc; then \
+        docker-php-serversideup-download https://github.com/google/brotli/archive/refs/tags/v1.2.1.tar.gz /tmp/brotli.tar.gz && \
+        echo "98d35d11a78dc453aebb7d10c3748f3f73ff78c8267c0dc697b8631f67bf7e8f  /tmp/brotli.tar.gz" | sha256sum -c - && \
+        tar xz --strip-components 1 -f /tmp/brotli.tar.gz && \
+        rm -f /tmp/brotli.tar.gz && \
+        cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF && \
+        cmake --build build && \
+        cmake --install build && \
+        echo /usr/local/lib > /etc/ld.so.conf.d/000-brotli.conf && \
+        ldconfig; \
+    fi
+
 # Install e-dant/watcher (necessary for file watching)
 WORKDIR /usr/local/src/watcher
 RUN WATCHER_TARBALL_URL=$(docker-php-serversideup-download https://api.github.com/repos/e-dant/watcher/releases/latest | \
@@ -145,10 +162,13 @@ RUN if cat /etc/os-release | grep -q 'debian'; then \
 # FrankenPHP Final
 ####################
 FROM common AS final
+# brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
+    brotli-libs \
     libstdc++ \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
+    libbrotli1 \
     libstdc++6 \
     procps \
     zip"
@@ -239,7 +259,7 @@ LABEL org.opencontainers.image.title="serversideup/php (frankenphp)" \
 COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
 
 COPY --from=frankenphp-build /usr/local/bin/frankenphp /usr/local/bin/frankenphp
-COPY --from=frankenphp-build /usr/local/lib/libwatcher* /usr/local/lib/
+COPY --from=frankenphp-build /usr/local/lib/libwatcher* /usr/local/lib/libbrotli* /usr/local/lib/
 
 COPY src/variations/frankenphp/etc/frankenphp/ /etc/frankenphp/
 
@@ -250,6 +270,9 @@ RUN \
     if cat /etc/os-release | grep -q 'alpine'; then \
         ldconfig /usr/local/lib; \
     elif cat /etc/os-release | grep -q 'debian'; then \
+        if [ -e /usr/local/lib/libbrotlicommon.so.1 ]; then \
+            echo /usr/local/lib > /etc/ld.so.conf.d/000-brotli.conf; \
+        fi; \
         ldconfig; \
     else \
         echo "Unsupported OS"; \