The 8.5.12 pin in 39ed0cc/be9afb2 builds the interpreter but the system build
stopped in php-filter's checkPhase:
FAILED TEST SUMMARY
filter.default=encoded doesn't reach hard limit [tests/oom_filter_default_encoded.phpt]
filter_input() doesn't reach hard limit [tests/oom_filter_input.phpt]
filter_input_array() doesn't reach hard limit [tests/oom_filter_input_array.phpt]
make: *** [Makefile:133: test] Error 1
Not a fault in the pin. nixpkgs configures PHP with `--disable-all` and builds
every extension as a shared module, while these three tests — added by the
upstream fix for CVE-2026-109618 — deliberately spawn `php-cgi -n` with no
php.ini. With no ini there is no shared filter module, so filter_input() is
undefined, the request never reaches the code under test, and the expected
"Allowed memory size ... exhausted" never appears.
nixpkgs shipped the remedy with the version bump in a5fc1be5b6 ("php: fix
`filter` tests", 2026-10-21 14:27 UTC), which adds the module to the child's
command line. The pinned nixpkgs revision (7694c4f6b853, 2026-10-16) predates
it, so apply the same substitution locally.
The override has to rewrite the filter derivation inside `extensions` rather
than go through buildEnv's `packageOverrides`: that argument is threaded into
the unwrapped PHP only, while the extension set is folded from mkPhp's own
packageOverrides, so passing it there is accepted and silently ignored.
Drop this block once flake.lock is past a5fc1be5b6 — otherwise both patch the
same files and the substitution is applied twice.
Verified by evaluating both derivations against the pinned revision: the
filter derivation now carries the substitution, php-with-extensions is
8.5.12, and the 45-extension set is unchanged.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on 2026-10-21 to fix two
critical vulnerabilities in PHP itself:
CVE-2026-109618 RCE via OOM corruption (GHSA-w8hw-w9fx-j79w)
CVE-2026-109619 RCE via stale global state (GHSA-6wmf-4rv5-p3rp)
Both are unauthenticated RCE, CVSS v4.0 9.2, and PHP states that updating is
the only complete mitigation. The advisories name PHP-FPM as susceptible, so
the phpfpm-nextcloud and phpfpm-wordpress pools are in scope, not just the
Apache/mod_php configuration the public write-ups focus on.
nixpkgs bumped php85 in 81513f364091c759812f716cef3c175109d07342 on the same
day, but the revision this flake pins (7694c4f6b853, 2026-10-16) predates it
and still reports php85 8.5.11 — as does the pinned nixos-26.05 rev, so
`pkgs.stable` is not a way out of this either. Rather than pin the whole
nixpkgs input forward and freeze every other package, pin the interpreter:
• phpSecurityFloor records the first patched 8.5.x release.
• phpBase falls through to pkgs.php85 untouched when nixpkgs has caught up,
so the workaround retires itself; bump the floor only upward.
• `.override` rather than `overrideAttrs`: php85 is a makeOverridable
buildEnv, so version/phpSrc reach generic.nix while the default extension
set survives. overrideAttrs would keep the new source but drop `enabled`,
silently removing gd, intl, pdo_pgsql and the rest from both pools.
Nothing else changes: one interpreter, one extension set, one php.ini, and
every consumer (both FPM pools, the Nextcloud cron job, occ and wp-cli) still
resolves through config.sovran_systemsOS.phpPackage, so CLI and FPM stay in
lockstep at 8.5.12.
The source is php-8.5.12.tar.bz2 from php.net, hashed here. Hydra cannot have
this exact derivation, so the first rebuild compiles PHP plus bz2, apcu, redis,
imagick and memcached locally — a one-off cost, after which it is a store path
like any other and the configuration stays reproducible.
`nixos-rebuild switch` is enough: the phpfpm units change closure and restart,
no reboot and no staged generation required.
Sovran Systems
naturallaw777
copilot-swe-agent[bot]andnaturallaw777