[RobinMJD]

The default Alpine 3.22 image installs PHP 8.3.29. PHP 8.3.36 fixes the publicly disclosed unauthenticated RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619. Alpine 3.24 now provides the patched PHP 8.3 packages on all four architectures used by the release workflow.

Changes

• Move both Alpine build stages to 3.24 and require >=8.3.36 for every directly installed PHP runtime/extension package. Builds fail if a repository cannot provide patched packages; later 8.3 security updates remain eligible.
• Align the existing venv/system Python paths with Alpine 3.24's Python 3.14 and regenerate the committed devcontainer Dockerfile.
• Add regression tests for the installed CLI, FPM and CGI binaries. They run in the normal Alpine CI test environment and fail for missing binaries or an older PHP 8.3 version.
• Wait for the new-device name input to become interactable in its existing Selenium test. Presence alone races the form's rendering in the newer Chromium supplied by Alpine 3.24.

The PHP 8.3 service names, FPM socket, configuration paths and container startup/hardening remain unchanged. The separate Debian build is outside this Alpine-image change.

Validation

• Before the change: all three version regression cases fail against Alpine 3.22 / PHP 8.3.29. After the change: all three pass with PHP 8.3.36.
• Complete hardened image builds pass for linux/amd64, linux/arm64, linux/arm/v7 and linux/arm/v6. Standard Docker platform-emulation smoke checks pass for CLI/FPM/CGI, required extensions, SQLite and representative Python/native dependencies on each image.
• Native arm64 hardened-container smoke passes with a read-only root filesystem, the existing capability set and UID/GID 20211: frontend and backend HTTP responses, FPM configuration, dependency imports/crypto operations, SQLite integrity, and retained test data after restart and image recreation.
• The existing CI test selection, pytest -m 'not (docker or compose or feature_complete)', passes: 1,763 passed, 9 skipped, 80 deselected. The focused device UI / PHP runtime selection also passes: 9 passed.
• Generated devcontainer consistency and git diff --check pass. Hadolint reports the same three existing diagnostics as the unmodified Dockerfile: SC2043, DL3066 and DL3025.

Existing ARMv6 limitation

Standard linux/arm/v6 emulation reports an ARMv7 machine, so that smoke result is not proof of compatibility with a real ARM1176 CPU. A stricter QEMU_CPU=arm1176 check emits an illegal instruction while importing aiohttp in both the published jokobsk/netalertx:26.10.0 image and this candidate. This existing dependency/platform issue is not resolved here; real ARMv6 hardware compatibility is not claimed. The published architecture list is unchanged.

After merging, the release images must be rebuilt/published, and existing installations must pull the fixed image and recreate their containers.

Summary by CodeRabbit

• Updates

  • Updated the application environment to Alpine Linux 3.24 and Python 3.14.
  • PHP runtime components now require version 8.3.36 or newer, including security fixes.

• Bug Fixes

  • Improved reliability of device creation UI validation by waiting for the device-name field to become ready.

• Tests

  • Added runtime checks to verify required PHP binaries are available and meet the minimum secure version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: netalertx/NetAlertX/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2c2f877f-2e43-44c2-9373-274d79eb907d

📥 Commits

Reviewing files that changed from the base of the PR and between 32e2ddd and 90b1c08.

📒 Files selected for processing: 5

• .devcontainer/Dockerfile
• .devcontainer/resources/devcontainer-Dockerfile
• Dockerfile
• test/runtime/test_php_runtime.py
• test/ui/test_ui_devices.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

The container images now use Alpine 3.24, and Python paths target Python 3.14. Runtime PHP packages require version 8.3.36 or newer, with tests checking installed PHP binaries. A device UI test now waits for its name field to become clickable.

Changes: Container Runtime Updates

Layer / File(s)	Summary
Image and Python environment updates Dockerfile, .devcontainer/Dockerfile, .devcontainer/resources/devcontainer-Dockerfile	Builder and runner images now use Alpine 3.24. Python paths now reference Python 3.14 site-packages.
PHP version requirements and validation Dockerfile, .devcontainer/Dockerfile, test/runtime/test_php_runtime.py	Runtime PHP package specifications require version 8.3.36 or newer. An Alpine-gated test checks the required PHP binaries and rejects missing binaries, command failures, unparsable versions, wrong branches, and versions below 8.3.36.

Device UI Test Wait

Layer / File(s)	Summary
Wait for the device-name field test/ui/test_ui_devices.py	The device-creation test waits up to 10 seconds for the name field to become clickable before interacting with it.

Possibly related issues

• netalertx/NetAlertX#1856 — The issue reports Alpine 3.22’s PHP version and CVEs; this change moves to Alpine 3.24 and requires PHP 8.3.36 or newer.

Suggested reviewers: jokob-sk

Priority: ⬆️ High

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 90b1c

No merge-blocking issue was found in the container, PHP validation, or device UI test changes. Merge after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main changes: upgrading to Alpine 3.24 and requiring patched PHP 8.3 packages.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (3 skipped: 3 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

⚠️ This pull request shows signs of AI-generated slop (description_diff_mismatch). It has been flagged by CodeRabbit slop detection and should be reviewed carefully.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}