Repository navigation
[FEAT] Install BookStack's composer dependencies with --no-dev #302
Description
Is this a new feature request?
- I have searched the existing issues
Wanted change
Install BookStack's composer dependencies with --no-dev. The image runs composer install -d /app/www/ without it, so BookStack's development dependencies ship in it: phpunit, larastan and with it phpstan, whose vendor/phpstan/phpstan/turbo-ext/ holds native extensions for every platform, among them Windows DLLs built against PHP 8.3 to 8.6.
Reason for change
Container scanners (syft and grype here) read the PHP versions out of those DLLs and report PHP's vulnerabilities, CVE-2026-109618 and CVE-2026-109619 among them, in an image whose PHP (php85 8.5.12-r0 in 26.09.2) is not affected. Every user of a scanner has to ignore them by hand.
BookStack's own installation guide runs composer install --no-dev.
The Snipe-IT image made the same change in linuxserver/docker-snipe-it#39 and still installs with --no-dev.
Proposed code change
In both Dockerfile and Dockerfile.aarch64, line 48:
- composer install -d /app/www/ && \
- composer install --no-dev -d /app/www/ && \
Activity
github-actions commentedon Oct 28, 2026
Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.
ssddanbrown commentedon Oct 28, 2026
Alternatively, the newer more efficient direct zip download process could be used instead:
https://www.bookstackapp.com/blog/php-dependency-improvements/
This would also only install required (non dev) PHP deps.
aptalca commentedon Oct 28, 2026
@ssddanbrown thanks for the heads up. I implemented downloading the vendor zip and checking the checksum (with a fallback to composer if curl or checksum fails) in #303
@mrtxmrtx thanks for pointing it out. Can you test the PR build from #303 (comment) and confirm it works?
Thanks
mrtxmrtx commentedon Oct 28, 2026
Thanks!
Tested the PR image on amd64: no dev dependencies or DLLs in /app/www/vendor anymore, grype no longer reports the PHP CVEs, and a fresh install with MariaDB works fine (login, books, search).
Works for me.