Hi,
I refer to this repo:
https://github.com/wmde/wikibase-release-pipeline
I checked out master and noticed that the current php version is 7.4.27 (apache2handler). This contains a high security risk:
https://nvd.nist.gov/vuln/detail/CVE-2021-21708
this was fixed in 7.4.28
https://www.php.net/ChangeLog-7.php#7.4.28
Could you check this?
D063520
In the target repo, there is no pinning specifically to PHP 7.4.27. If that version is being used, it's due to the images being pulled in, which are likely updated by different upstreams.
And searching for FILTER_VALIDATE_FLOAT, that constant is not used in Wikibase repos, nor is it used in that repo.
yes, I agree, it is coming from some images that are used ... still these images should be replaced, no?
It's not completely clear where you're looking, and as such which images are being used.
For the Wikimedia provided images we're now packaging PHP 7.4.28, and it's entirely possible that in the 12 days since the last commit to that repo, the images have already been rebuilt etc...