Bug: 1-php8.4-alpine remains on x/net 0.59.0 after 1.13.1 build #2710

What happened?

The floating Docker tag dunglas/frankenphp:1-php8.4-alpine still resolves to an image that contains golang.org/x/net v0.59.0. Trivy reports the fixed high-severity CVE-2026-78669 against that binary.

#2707 updated the dependency. It merged as 77b32f5517ec419725a945d12bc48ba10eabce6f. The v1.13.1 source tag contains golang.org/x/net v0.61.0. The v1.13.1 Docker-image build completed successfully. Its explicit image tag, dunglas/frankenphp:1.13.1-php8.4-alpine, is available.

Could 1-php8.4-alpine be repointed to the v1.13.1 image? Alternatively, could the intended major-tag policy be documented? The current state leaves users of the documented major tag on an older image despite the nightly-rebuild statement in SECURITY.md.

This is related to #2459. That issue tracks a different HTTP/2 denial-of-service concern, so this is not a duplicate.

Build Type

Docker (Alpine)

Worker Mode

No

Operating System

GNU/Linux

CPU Architecture

x86_64

PHP configuration

Not applicable. The discrepancy is visible in the published image and its source tag.

Relevant log output

usr/local/bin/frankenphp (gobinary)
Library: golang.org/x/net
Vulnerability: CVE-2026-78669
Severity: HIGH
Installed Version: v0.59.0
Fixed Version: 0.60.0