Runtimes
A vulnerability in PHP, Node.js or Python itself is not in any lockfile. php2shell (CVE-2026-109618 and CVE-2026-109619, October 2026) hit every PHP from 5.4 to 8.5.11, whatever packages a project used.
Projects do write down which runtime they run on: in a Dockerfile, .nvmrc, composer.json. dagsec reads those files and checks each version.
dagsec only reads what the repository says. It never connects to your servers or sites to find out what they run.
What dagsec reads
| Runtime | Files |
|---|---|
| PHP | Dockerfile (FROM php:…), .php-version, composer.json (config.platform.php, else the lowest version require.php allows) |
| Node.js | Dockerfile (FROM node:…), .nvmrc, .node-version, package.json (engines.node) |
| Python | Dockerfile (FROM python:…), .python-version, runtime.txt, pyproject.toml (requires-python) |
| Go | Dockerfile (FROM golang:…), go.mod (toolchain, else go) |
| Java | Dockerfile (FROM eclipse-temurin:…, openjdk, amazoncorretto, ibmjava, ibm-semeru-runtimes), .java-version |
| Ruby | Dockerfile (FROM ruby:…), .ruby-version, Gemfile (ruby "…") |
Any file named Dockerfile, Dockerfile.*, *.dockerfile or Containerfile counts, in every directory dagsec scans.
A version can be named three ways:
| Written as | Example | What dagsec checks |
|---|---|---|
| Exact | php:8.2.10-apache, .nvmrc with 18.17.0 | Known vulnerabilities, a newer patch, end of support |
| Series | php:8.2-apache, node:20-alpine | End of support. The image moves to the series' newest patch when you rebuild. |
| Minimum | "php": ">=8.1", requires-python = ">=3.9" | Whether that lowest version is still supported |
Where the answers come from
- endoflife.date: each release series' newest patch and the date its security support ends.
- OSV.dev: known vulnerabilities in exact versions. Runtime data comes from Bitnami's vulnerability database; Go's comes from Go's own database for its standard library.
- CISA KEV: vulnerabilities that attackers are exploiting right now.
What fails a check
| Finding | In a PR check |
|---|---|
| A vulnerability on CISA's KEV list | Fails |
| Known vulnerabilities, a missed patch release, or ended support | Warning: listed in the report, doesn't fail |
In the PR comment, the runtimes table shows each version, the file and line it came from, and the version to move to:
| Runtime | Version | Where | Status | Upgrade to | Vulnerabilities |
|---|---|---|---|---|---|
| PHP | `8.2.10` | `Dockerfile:1` | a newer patch release is out | 8.2.35 | 51 known, **under active attack: CVE-2024-4577** |
| Node.js | `16.20.0` | `.nvmrc:1` | no longer supported (since 2023-09-11) | a supported release series | 54 known, **under active attack: CVE-2023-44487** |The same list is in the dashboard under Runtimes, and in the JSON report as runtimes; see the report reference.