Vulnerable Go dependencies in FrankenPHP v1.12.7 detected by Trivy

Vulnerable Go dependencies in FrankenPHP v1.12.7 detected by Trivy

Description

We are using the official FrankenPHP image:

FROM dunglas/frankenphp:1.12.7-builder-php8.4.25-alpine

and Trivy reports two critical vulnerabilities embedded in the frankenphp binary:

usr/local/bin/frankenphp (gobinary)

github.com/getkin/kin-openapi v0.140.0
GHSA-r277-6w6q-xmqw
Fixed version: 0.144.0

golang.org/x/crypto v0.54.0
CVE-2026-56854
Fixed version: 0.55.0

Trivy output

Target: usr/local/bin/frankenphp

github.com/getkin/kin-openapi
Installed Version: v0.140.0
Fixed Version: 0.144.0

golang.org/x/crypto
Installed Version: v0.54.0
Fixed Version: 0.55.0

Questions

• Are these dependencies still present in FrankenPHP v1.12.7?

• Have they already been updated on the main branch?

• Is there a planned release containing:

  • github.com/getkin/kin-openapi >= 0.144.0
  • golang.org/x/crypto >= 0.55.0

• Is there a recommended mitigation until a new release is available?

Thanks for your help.