From 307bd23500fde0d6f665fb078612b5ae312cf91c Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Wed, 21 Oct 2026 17:43:08 +0200
Subject: [PATCH] freshrss: start again on 1.30.3 with fixed PHP

freshrss/freshrss:1.30.3, released today, runs PHP 8.4.27 from Debian
trixie security (8.4.27-1~deb13u1), which fixes CVE-2026-109618 and
CVE-2026-109619. Pin it instead of :latest so the running version is the
checked one. Its ca-certificates (20250419+deb13u1) also no longer
carries the roots above the compromised eMudhra intermediates.
---
 freshrss/freshrss-deployment.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/freshrss/freshrss-deployment.yaml b/freshrss/freshrss-deployment.yaml
index 6517555..d2f9e35 100644
--- a/freshrss/freshrss-deployment.yaml
+++ b/freshrss/freshrss-deployment.yaml
@@ -8,9 +8,7 @@ metadata:
     io.kompose.service: freshrss
   name: freshrss
 spec:
-  # Stopped until PHP is patched (CERT-EU 2026-018, CVE-2026-109618,
-  # CVE-2026-109619). Set back to 1 once the image ships a fixed PHP.
-  replicas: 0
+  replicas: 1
   selector:
     matchLabels:
       io.kompose.service: freshrss
@@ -74,7 +72,9 @@ spec:
               value: "server-cache:persistent"
             - name: TZ
               value: Europe/Amsterdam
-          image: freshrss/freshrss:latest
+          # 1.30.3 ships PHP 8.4.27, which fixes CVE-2026-109618 and
+          # CVE-2026-109619.
+          image: freshrss/freshrss:1.30.3
           name: freshrss
           ports:
             - containerPort: 80