From 0b10cd6a04d137c7c7e512a2b601556127f5c34e Mon Sep 17 00:00:00 2001
From: ArthurErlich <a.erlich@live.de>
Date: Thu, 22 Oct 2026 23:59:23 +0200
Subject: [PATCH] fix(docker): always pull the latest PHP 8.4 base image on
 release builds

Picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE)
via the floating 1-php8.4-alpine tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/docker-publish.yml | 1 +
 CHANGELOG.md                        | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index b57d4b0..b954390 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -77,6 +77,7 @@ jobs:
           target: final
           platforms: linux/amd64,linux/arm64
           push: true
+          pull: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           # Registry-based layer cache — survives between runs without a separate cache store.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9d16e6..c58d41e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - `phpstan/phpstan` 2.2.5 → 2.2.16
 - Docker builds copy `symfony.lock` so Flex doesn't re-apply recipes during `composer install`
 
+### Fixed
+
+- Renovate no longer pins `symfony/monolog-bundle` to `~7.4` — it is versioned independently (4.x) and was blocked from updates (#39)
+
+### Security
+
+- Release images are built against the latest picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE)
+
 ## [0.2.1] - 2026-07-31
 
 ### Added