Vulnerable Go dependencies in FrankenPHP v1.12.7 detected by Trivy

## Vulnerable Go dependencies in FrankenPHP v1.12.7 detected by Trivy

### Description

We are using the official FrankenPHP image:

```dockerfile
FROM dunglas/frankenphp:1.12.7-builder-php8.4.25-alpine
```

and Trivy reports two critical vulnerabilities embedded in the `frankenphp` binary:

```text
usr/local/bin/frankenphp (gobinary)

github.com/getkin/kin-openapi v0.140.0
GHSA-r277-6w6q-xmqw
Fixed version: 0.144.0

golang.org/x/crypto v0.54.0
CVE-2026-56854
Fixed version: 0.55.0
```

### Trivy output

```text
Target: usr/local/bin/frankenphp

github.com/getkin/kin-openapi
Installed Version: v0.140.0
Fixed Version: 0.144.0

golang.org/x/crypto
Installed Version: v0.54.0
Fixed Version: 0.55.0
```

### Questions

* Are these dependencies still present in FrankenPHP v1.12.7?
* Have they already been updated on the `main` branch?
* Is there a planned release containing:

  * `github.com/getkin/kin-openapi >= 0.144.0`
  * `golang.org/x/crypto >= 0.55.0`
* Is there a recommended mitigation until a new release is available?

Thanks for your help.


Navigation Menu

Uh oh!

Vulnerable Go dependencies in FrankenPHP v1.12.7 detected by Trivy #2643