beyondcode / beyondcode/herd-community

[Bug]: Bundled ext-mongodb 2.3.3 prevents upgrading mongodb/mongodb to 2.4.1

Open
#1,749 0 comments 3 reactions 0 assignees View on GitHub
macOS
Dominant language
No language data
Stars
122
Forks
1
PR merge metrics
No merged PRs in 30d

Description

### Platform

macOS

### Operating system version

macOS Tahoe 26.6.2

### System architecture

ARM64 (M1, M2, etc)

### Herd Version

1.30.0

### PHP Version

PHP 8.4.23, PHP 8.5,PHP 8.6

### Bug description

Laravel Herd PHP 8.4.23 on macOS currently bundles ext-mongodb 2.3.3.

The MongoDB PHP library mongodb/mongodb 2.3.0 is affected by security advisory PKSA-61k5-cqr9-b8b4 / CVE-2026-81525. The patched mongodb/mongodb 2.4.1 requires ext-mongodb ^2.4, but Herd currently provides ext-mongodb 2.3.3.

Because of this, I cannot upgrade mongodb/mongodb to the patched version. Composer reports that mongodb/mongodb 2.4.1 requires ext-mongodb ^2.4, while the installed extension version is 2.3.3. This also causes composer audit to fail in CI.

I initially investigated whether the MongoDB extension could be upgraded separately using PECL or PIE. I also tried PIE with mongodb/mongodb-extension:^2.4, but PIE could not find a suitable phpize binary for the Herd PHP installation.

I then checked how MongoDB is actually loaded by Herd. Running "php -n --ri mongodb", which prevents PHP from loading php.ini, still reports MongoDB extension version 2.3.3. Running "php -i" also shows that Herd PHP was compiled with "--enable-mongodb".

I checked the Herd PHP 8.4 php.ini as well. There is no extension=mongodb.so entry. The only explicitly loaded extensions in my php.ini are Herd's own extension and Xdebug.

Therefore it appears ext-mongodb 2.3.3 is compiled directly into the Herd PHP binary rather than being a separately loaded PECL/PIE extension. Because of this, installing a newer mongodb.so through PECL/PIE also does not appear to be an appropriate way to replace the bundled version.

Could the bundled MongoDB extension please be updated to ext-mongodb 2.4 or newer in the Herd PHP builds?

Alternatively, if there is an officially supported way to upgrade a bundled extension such as ext-mongodb using PECL or PIE without conflicting with the version compiled into Herd PHP, could you please provide the recommended procedure?

### Steps to reproduce

Image
Image

### Relevant log output

```shell

```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the bundled extension behavior with `php -n --ri mongodb` and `php -i` for the Herd PHP 8.4 build, then trace the PHP build configuration that enables MongoDB. Confirm how the extension is packaged and whether PECL or PIE can replace it safely. Done means Herd provides ext-mongodb 2.4 or newer and `mongodb/mongodb` 2.4.1 can install without Composer audit failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
mongodb, php
Domain
backend, build-system, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.