From c7653a3eeef3b27b532a3abf4b13ff41e7d380eb Mon Sep 17 00:00:00 2001
From: Joey Smith <jsmith@webinertia.net>
Date: Wed, 21 Oct 2026 20:11:03 -0500
Subject: [PATCH] chore: bump the tooling image to PHP 8.5.12 and pin
 extensions

The image pins landed in the compose files of every repo, but the matching
Dockerfile changes were missed in this repo. Without them the tooling image
still builds from php:8.4.24 and installs whatever pcov and xdebug the PECL
channel serves at build time.

Same change as the rest of the fleet:

  PHP_VERSION       8.4.24 to 8.5.12
  COMPOSER_VERSION  2      to 2.10.3
  PCOV_VERSION      pinned to 1.0.12
  XDEBUG_VERSION    pinned to 3.5.3

COMPOSER_VERSION 2.10.3 carries the fix for CVE-2026-40176.
---
 Dockerfile | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 4ff0c47..3434b83 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,12 +14,12 @@
 # .gitattributes), which keeps the container and host line endings consistent.
 # ---------------------------------------------------------------------------
 
-# PHP version to base the image on (latest 8.4 patch release). Keep in sync
+# PHP version to base the image on (latest 8.5 patch release). Keep in sync
 # with the package's supported PHP versions and `config.platform.php`.
-ARG PHP_VERSION=8.4.24
+ARG PHP_VERSION=8.5.12
 
 # Composer version (copied from the official composer image at build time).
-ARG COMPOSER_VERSION=2
+ARG COMPOSER_VERSION=2.10.3
 
 # Named stage so Composer can be copied from it (--from does not support
 # inline variable expansion).
@@ -27,6 +27,11 @@ FROM composer:${COMPOSER_VERSION} AS composer
 
 FROM php:${PHP_VERSION}-cli
 
+# PECL extension versions, pinned so a rebuild cannot silently pick up a
+# different extension release.
+ARG PCOV_VERSION=1.0.12
+ARG XDEBUG_VERSION=3.5.3
+
 # ---------------------------------------------------------------------------
 # System packages + PHP extensions
 # ---------------------------------------------------------------------------
@@ -45,7 +50,7 @@ RUN set -eux; \
         pcntl \
         zip \
     ; \
-    pecl install pcov \
+    pecl install "pcov-${PCOV_VERSION}" \
     && docker-php-ext-enable pcov \
     ; \
     apt-get clean; \
@@ -58,7 +63,7 @@ RUN set -eux; \
 # normal Composer/PHPUnit/Mago runs. Enable it with XDEBUG_MODE=debug (see
 # compose.yml) and connect the IDE to host.docker.internal.
 RUN set -eux; \
-    pecl install xdebug \
+    pecl install "xdebug-${XDEBUG_VERSION}" \
     && docker-php-ext-enable xdebug \
     ; \
     { \