[BUG] Rebuild with PHP 8.5.9 and update the bundled Guzzle dependency #165

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The public image lscr.io/linuxserver/heimdall:latest at digest sha256:97d0cdf2a70da1f276da96051f47926f68b880293b3e1bd3e4d209e11573fb93 contains:

• PHP 8.5 packages at 8.5.8-r0; Alpine provides 8.5.9-r0 with fixes for CVE-2026-17543 and CVE-2026-7260.
• guzzlehttp/guzzle 7.13.3; fixed release 7.15.2 or newer is available for CVE-2026-69246.

The image label is v2.8.1-ls357, its creation timestamp is 2026-07-24T19:51:13.558936256Z, and the detected base is Alpine 3.24.1. This is a package-maintenance report; no Heimdall application-level exploitability is claimed.

Expected Behavior

The current public image should contain the fixed PHP and Guzzle versions, or a newer release line containing those fixes.

Steps To Reproduce

1. Inspect the immutable public image digest listed above for the x86-64 platform.
2. Scan the artifact with Trivy 0.73.0.
3. Observe PHP 8.5.8-r0 and guzzlehttp/guzzle 7.13.3.
4. Compare them with the fixed versions listed above.

The PHP advisories are reported once per installed PHP subpackage; those repetitions represent the same two advisories.

Environment

• OS: Public image artifact; detected base is Alpine 3.24.1
• How docker service was installed: Not applicable; reproduction operates on the public registry artifact and does not require a running container

CPU architecture

x86-64

Docker creation

Not applicable; no container needs to be created to reproduce the package-version findings.

Container logs

Not applicable; the finding is present in the immutable image layers before container startup.

Suggested remediation

1. Rebuild from current Alpine repositories so all PHP 8.5 packages are at least 8.5.9-r0.
2. Update the bundled Guzzle dependency to a fixed release.
3. Publish an immutable digest and verify the installed versions.