flake.lock pins nixpkgs a8e753600fb4, which already ships php85 8.5.12
(81513f3640) and upstream's `filter` test fix (a5fc1be5b6). Both commits
are ancestors of the pin, so the local backport in this module was dead
weight at best:
* pkgs/development/interpreters/php/default.nix at the pin already says
php85 = 8.5.12, so the `lib.versionAtLeast` guard was never false and
the `.override { version / phpSrc }` branch never ran;
* pkgs/top-level/php-packages.nix at the pin already carries the
oom_filter_*.phpt substitution.
patchFilterTests appended that same substituteInPlace a second time:
--replace-fail "'-n'," "'-n', '-d', 'extension=$PWD/modules/filter.so',"
The replacement text still contains the `'-n',` it searches for, so the
second pass matched and injected the extension flag twice. php-cgi then
emitted `Module "filter" is already loaded` (E_CORE_WARNING) into the
output the OOM tests capture, all three oom_filter_*.phpt failed against
their --EXPECTF-- section, `make test` exited non-zero and the builder
died with exit code 2:
error: Cannot build '...-php-filter-8.5.12.drv'.
Reason: builder failed with exit code 2.
which then cascaded into php-extra-init-8.5.12.ini, php-with-extensions
and man-paths ("1 dependency failed").
Use the stock pkgs.php85 and let nixpkgs own the extension patches. The
CVE-2026-109618 / CVE-2026-109619 floor is kept, but as an assert, so a
rolled-back pin fails loudly instead of silently rebuilding a version
under another release's extension recipes.
naturallaw777
6151c78dc5