Platform
macOS
Operating system version
macOS Tahoe 26.6.2
System architecture
ARM64 (M1, M2, etc)
Herd Version
1.30.0
PHP Version
PHP 8.4.23, PHP 8.5,PHP 8.6
Bug description
Laravel Herd PHP 8.4.23 on macOS currently bundles ext-mongodb 2.3.3.
The MongoDB PHP library mongodb/mongodb 2.3.0 is affected by security advisory PKSA-61k5-cqr9-b8b4 / CVE-2026-81525. The patched mongodb/mongodb 2.4.1 requires ext-mongodb ^2.4, but Herd currently provides ext-mongodb 2.3.3.
Because of this, I cannot upgrade mongodb/mongodb to the patched version. Composer reports that mongodb/mongodb 2.4.1 requires ext-mongodb ^2.4, while the installed extension version is 2.3.3. This also causes composer audit to fail in CI.
I initially investigated whether the MongoDB extension could be upgraded separately using PECL or PIE. I also tried PIE with mongodb/mongodb-extension:^2.4, but PIE could not find a suitable phpize binary for the Herd PHP installation.
I then checked how MongoDB is actually loaded by Herd. Running "php -n --ri mongodb", which prevents PHP from loading php.ini, still reports MongoDB extension version 2.3.3. Running "php -i" also shows that Herd PHP was compiled with "--enable-mongodb".
I checked the Herd PHP 8.4 php.ini as well. There is no extension=mongodb.so entry. The only explicitly loaded extensions in my php.ini are Herd's own extension and Xdebug.
Therefore it appears ext-mongodb 2.3.3 is compiled directly into the Herd PHP binary rather than being a separately loaded PECL/PIE extension. Because of this, installing a newer mongodb.so through PECL/PIE also does not appear to be an appropriate way to replace the bundled version.
Could the bundled MongoDB extension please be updated to ext-mongodb 2.4 or newer in the Herd PHP builds?
Alternatively, if there is an officially supported way to upgrade a bundled extension such as ext-mongodb using PECL or PIE without conflicting with the version compiled into Herd PHP, could you please provide the recommended procedure?
Steps to reproduce
Relevant log output
Platform
macOS
Operating system version
macOS Tahoe 26.6.2
System architecture
ARM64 (M1, M2, etc)
Herd Version
1.30.0
PHP Version
PHP 8.4.23, PHP 8.5,PHP 8.6
Bug description
Laravel Herd PHP 8.4.23 on macOS currently bundles ext-mongodb 2.3.3.
The MongoDB PHP library mongodb/mongodb 2.3.0 is affected by security advisory PKSA-61k5-cqr9-b8b4 / CVE-2026-81525. The patched mongodb/mongodb 2.4.1 requires ext-mongodb ^2.4, but Herd currently provides ext-mongodb 2.3.3.
Because of this, I cannot upgrade mongodb/mongodb to the patched version. Composer reports that mongodb/mongodb 2.4.1 requires ext-mongodb ^2.4, while the installed extension version is 2.3.3. This also causes composer audit to fail in CI.
I initially investigated whether the MongoDB extension could be upgraded separately using PECL or PIE. I also tried PIE with mongodb/mongodb-extension:^2.4, but PIE could not find a suitable phpize binary for the Herd PHP installation.
I then checked how MongoDB is actually loaded by Herd. Running "php -n --ri mongodb", which prevents PHP from loading php.ini, still reports MongoDB extension version 2.3.3. Running "php -i" also shows that Herd PHP was compiled with "--enable-mongodb".
I checked the Herd PHP 8.4 php.ini as well. There is no extension=mongodb.so entry. The only explicitly loaded extensions in my php.ini are Herd's own extension and Xdebug.
Therefore it appears ext-mongodb 2.3.3 is compiled directly into the Herd PHP binary rather than being a separately loaded PECL/PIE extension. Because of this, installing a newer mongodb.so through PECL/PIE also does not appear to be an appropriate way to replace the bundled version.
Could the bundled MongoDB extension please be updated to ext-mongodb 2.4 or newer in the Herd PHP builds?
Alternatively, if there is an officially supported way to upgrade a bundled extension such as ext-mongodb using PECL or PIE without conflicting with the version compiled into Herd PHP, could you please provide the recommended procedure?
Steps to reproduce
Relevant log output