Upgrade libexpat in base stage to avoid stale symbol relocation (8.3-cli, 8.4-cli)

[jelen07]

Problem

The 68publishers php images bake in whatever libexpat was current in the Alpine branch at image build time, and that library does not get re-synced afterwards. Meanwhile the Alpine release branch keeps publishing libexpat patch updates. The frozen libexpat.so.1 soname still satisfies apk's dependency check, so a downstream apk add python3 / supervisor pulls a newer pyexpat (built against the branch-current libexpat) without upgrading the stale library. At runtime pyexpat then fails to relocate:

ImportError: Error relocating .../pyexpat...so:
  XML_SetAllocTrackerActivationThreshold: symbol not found

(XML_SetAllocTrackerActivationThreshold was added in libexpat 2.7.2.) This crash-loops anything importing pyexpat — notably supervisord, breaking worker containers built on these images.

Verified per image (apk add supervisor on the published -cli-dev tag, then import pyexpat)

image	alpine	frozen libexpat	after supervisor install	pyexpat
8.1-cli	3.18.2	2.5.0	upgraded to 2.7.0	OK
8.3-cli	3.20.3	2.6.3	stays 2.6.3	crash
8.4-cli	3.21	2.7.0	stays 2.7.0	crash

Fix

Add apk upgrade --no-cache libexpat to the base stage of 8.3-cli and 8.4-cli. This resyncs libexpat to the branch-current 2.7.5 (which has the symbol). It adds no new packages — it only bumps one shared library — and because dev/prod/prod-imagick derive from base, every published tag inherits the fix.

Scope and why not the others

• 8.1-cli (alpine 3.18): not affected — apk already upgrades libexpat to the branch newest (2.7.0) while installing supervisor, and 3.18's python matches it. Note 3.18 caps at 2.7.0 (no symbol), so an upgrade could not help even hypothetically; the real remedy there would be a newer Alpine.
• unit images: run NGINX Unit (web), not supervisor-managed worker fleets, so they do not install python/supervisor.

Constraint to be aware of

apk upgrade can only reach the newest version in the image's pinned Alpine branch. It works here because 3.20 and 3.21 both moved to 2.7.5. If a future need requires a version only available in edge (e.g. 2.8.x), the base image would have to be bumped to a newer Alpine (or the package pulled from another repo) rather than relying on this upgrade.

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR upgrades the libexpat library in base image builds across all PHP Docker images to keep libexpat aligned with current Alpine repositories, preventing runtime relocation failures caused by downstream packages pulling newer library versions.

Changes

libexpat Alpine repository alignment

Layer / File(s)	Summary
libexpat upgrade across PHP versions php/7.4-unit/Dockerfile, php/8.1-cli/Dockerfile, php/8.1-unit/Dockerfile, php/8.3-cli/Dockerfile, php/8.3-unit/Dockerfile, php/8.4-cli/Dockerfile, php/8.4-unit/Dockerfile	All PHP Docker images receive an apk upgrade --no-cache libexpat command in the base stage with explanatory comments. The fix ensures libexpat stays in sync with Alpine repositories to avoid soname relocation mismatches when downstream packages pull newer libexpat/pyexpat combinations.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

📦 Seven containers, one library fix,
libexpat aligned with Alpine's tricks,
No soname drift, no runtime plight,
Just upgrade and apk keeps things right! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change (upgrading libexpat in base stage to avoid stale symbol relocation), though it mentions only 8.3-cli and 8.4-cli while the PR applies to seven variants total.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/libexpat-stale-symbol-relocation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jelen07]

WIP