From 1800e0d1c2a9571d6879b1964b0870157e47babe Mon Sep 17 00:00:00 2001
From: rahul <rahul.tiwari@repl.it>
Date: Thu, 22 Oct 2026 08:11:54 +0000
Subject: [PATCH 1/2] security: refresh Composer fallback CA data

Assisted-by: Replit
---
 pkgs/modules/php/default.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/modules/php/default.nix b/pkgs/modules/php/default.nix
index d59ab8a4..5c08e984 100644
--- a/pkgs/modules/php/default.nix
+++ b/pkgs/modules/php/default.nix
@@ -3,6 +3,15 @@
 let
   php-version = lib.versions.majorMinor php.version;
   phpactor = pkgs.phpactor.override { inherit php; };
+  composer-ca-bundle = pkgs.fetchurl {
+    url = "https://raw.githubusercontent.com/composer/ca-bundle/1.6.0/res/cacert.pem";
+    hash = "sha256-eW8Tib/qE8DtePZjt2W6r/VKUI5Ug3hr1uznPF4+PL4=";
+  };
+  composer = php.packages.composer.overrideAttrs (old: {
+    postInstall = (old.postInstall or "") + ''
+      cp ${composer-ca-bundle} $out/share/php/composer/vendor/composer/ca-bundle/res/cacert.pem
+    '';
+  });
 in
 {
   id = "php-${php-version}";
@@ -14,7 +23,7 @@ in
 
   replit.packages = [
     php
-    php.packages.composer
+    composer
   ];
 
   replit.runners.php = {

From f19d320aa48048b2194fc8467374a1955997505a Mon Sep 17 00:00:00 2001
From: rahul <rahul.tiwari@repl.it>
Date: Thu, 22 Oct 2026 08:21:23 +0000
Subject: [PATCH 2/2] php: upgrade Composer CA bundle to 1.6.0

Assisted-by: Replit
---
 pkgs/composer/ca-bundle-1.6.0.patch | 41 +++++++++++++++++++++++++++++
 pkgs/modules/php/default.nix        | 13 +++++----
 2 files changed, 47 insertions(+), 7 deletions(-)
 create mode 100644 pkgs/composer/ca-bundle-1.6.0.patch

diff --git a/pkgs/composer/ca-bundle-1.6.0.patch b/pkgs/composer/ca-bundle-1.6.0.patch
new file mode 100644
index 00000000..accd3dc8
--- /dev/null
+++ b/pkgs/composer/ca-bundle-1.6.0.patch
@@ -0,0 +1,41 @@
+--- a/composer.lock
++++ b/composer.lock
+@@ -8,16 +8,16 @@
+     "packages": [
+         {
+             "name": "composer/ca-bundle",
+-            "version": "1.5.12",
++            "version": "1.6.0",
+             "source": {
+                 "type": "git",
+                 "url": "https://github.com/composer/ca-bundle.git",
+-                "reference": "00a2f4201641d5c53f7fc0195e6c8d9fcc321a78"
++                "reference": "2c99cf2e92516985dea4914812b93d9daf01cdd6"
+             },
+             "dist": {
+                 "type": "zip",
+-                "url": "https://api.github.com/repos/composer/ca-bundle/zipball/00a2f4201641d5c53f7fc0195e6c8d9fcc321a78",
+-                "reference": "00a2f4201641d5c53f7fc0195e6c8d9fcc321a78",
++                "url": "https://api.github.com/repos/composer/ca-bundle/zipball/2c99cf2e92516985dea4914812b93d9daf01cdd6",
++                "reference": "2c99cf2e92516985dea4914812b93d9daf01cdd6",
+                 "shasum": ""
+             },
+             "require": {
+@@ -64,7 +64,7 @@
+             "support": {
+                 "irc": "irc://irc.freenode.org/composer",
+                 "issues": "https://github.com/composer/ca-bundle/issues",
+-                "source": "https://github.com/composer/ca-bundle/tree/1.5.12"
++                "source": "https://github.com/composer/ca-bundle/tree/1.6.0"
+             },
+             "funding": [
+                 {
+@@ -76,7 +76,7 @@
+                     "type": "github"
+                 }
+             ],
+-            "time": "2026-05-19T11:26:22+00:00"
++            "time": "2026-10-20T20:14:05+00:00"
+         },
+         {
+             "name": "composer/class-map-generator",
diff --git a/pkgs/modules/php/default.nix b/pkgs/modules/php/default.nix
index 5c08e984..854ddc7b 100644
--- a/pkgs/modules/php/default.nix
+++ b/pkgs/modules/php/default.nix
@@ -3,14 +3,13 @@
 let
   php-version = lib.versions.majorMinor php.version;
   phpactor = pkgs.phpactor.override { inherit php; };
-  composer-ca-bundle = pkgs.fetchurl {
-    url = "https://raw.githubusercontent.com/composer/ca-bundle/1.6.0/res/cacert.pem";
-    hash = "sha256-eW8Tib/qE8DtePZjt2W6r/VKUI5Ug3hr1uznPF4+PL4=";
-  };
   composer = php.packages.composer.overrideAttrs (old: {
-    postInstall = (old.postInstall or "") + ''
-      cp ${composer-ca-bundle} $out/share/php/composer/vendor/composer/ca-bundle/res/cacert.pem
-    '';
+    src = pkgs.applyPatches {
+      name = "composer-${old.version}-ca-bundle-1.6.0-source";
+      src = old.src;
+      patches = [ ../../composer/ca-bundle-1.6.0.patch ];
+    };
+    vendorHash = "sha256-OWut8wZ9nq/7EiZecdhc4RsDhFJ2xlx1iTCXuHk7x14=";
   });
 in
 {