Repository navigation
Return OK for newer PHP patch versions and verify HTTP header handling - #2
Merged
Merged
Conversation
ianw-oai
marked this pull request as ready for review
October 21, 2026 01:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The checker currently only returns
vulnerableorunknown, so even a simulated newer patched PHP version can never returnOK.This adds
ok/ exit code 0 for stable patch versions above the existing cutoff in a listed major/minor branch. Missing headers, no response, unknown branches, and newer prereleases remainunknown/ exit code 3. Conflicting banners cannot hide a vulnerable or unrecognized version behind an OK result.Added dependency-free CLI integration tests using local HTTP servers. They verify
X-Powered-By, case-insensitive header names, Apache-styleServerheaders, numeric patch comparisons, every configured version boundary, 405/501 GET fallback, absent headers, closed connections, timeouts, and JSON/plain-text output.Validation:
node --test --test-reporter=spec phpcheck.test.js— 30/30 tests pass on Node v24.19.0. The same suite against the original code had 12 failures. PHP itself is not installed in the test environment; HTTP fixtures use PHP's documented header format: https://www.php.net/manual/en/ini.core.php#ini.expose-php.The version cutoffs are unchanged.
OKfollows the requested assumption that a newer stable patch in a listed branch contains the fix. PHP's October 20 announcement says affected/fixed versions will be published with the upcoming release, so these cutoffs still need confirmation against that release: https://www.php.net/index.php. The README now makes this limitation explicit.