[kvz]

Node 20 CI tooling and the floating PHP/Node Docker inputs predate the October 21 security fixes. Pin CI to Node 22.23.4 and PHP 8.2.35, and the development image to PHP 8.3.36 plus the official Node 22.23.4 runtime. Copy Node/npm from its pinned image so apt repository lag cannot select an older runtime.

These are test/development runtimes. The published PHP >=7.4 support contract and the existing PHP 8.1 compatibility lane are preserved. Node 22 matches the Docker tooling's existing major line.

Validation:

• All six CI matrix jobs pass, including locked/lowest/highest dependency sets on PHP 8.2.35 and the retained PHP 8.1 compatibility lane.
• Existing unit suite with Node signature parity: 30 tests / 117 assertions pass (workstation PHP 8.5.10 and verified Node 26.12.1).
• PHP CodeSniffer, YAML syntax and git diff checks pass.
• The exact PHP Docker tag is now published. The complete amd64 image builds with --pull and reports PHP 8.3.36 and Node 22.23.4. PHP CodeSniffer and all 30 unit/parity tests / 117 assertions also pass inside this image using tracked source and dummy signing credentials. Native ARM image execution was not repeated locally.
• Council review completed; its initial image-availability finding is resolved by the published tag and successful full build and in-image tests.

References: Node security release, PHP releases.

_{🤖 Claimed by kvz on framework1/api2-clone-5, framework1/php-sdk, framework1/clawfleet since 2026-10-21 · resume: codex resume 01a15e32-a05f-7153-89c2-0b1273795a49}

[github-actions]

Coverage report for commit: a9a00e6
File: ./build/logs/clover.xml

Summary - Lines: 90.55% | Methods: 65.22%

Files	Lines	Methods	Branches
lib/transloadit
CurlRequest.php	91.67%	66.67%	100.00%
CurlResponse.php	100.00%	100.00%	100.00%
Transloadit.php	86.67%	55.56%	100.00%
TransloaditRequest.php	92.98%	57.14%	100.00%
TransloaditResponse.php	100.00%	100.00%	100.00%

_{🤖 comment via lucassabreu/comment-coverage-clover}