Update ext-mongodb

What version of Cloud Foundry and CF CLI are you using? (i.e. What is the output of running cf curl /v2/info && cf version?

cf curl /v2/info | jq

{
  "name": "...",
  "build": "v60.5.0",
  "support": "",
  "version": 60,
  "description": "",
  "authorization_endpoint": "...",
  "token_endpoint": "...",
  "min_cli_version": null,
  "min_recommended_cli_version": null,
  "app_ssh_endpoint": "...",
  "app_ssh_host_key_fingerprint": "...",
  "app_ssh_oauth_client": "...",
  "doppler_logging_endpoint": "...",
  "api_version": "2.294.0",
  "osbapi_version": "2.15",
  "routing_endpoint": "...",
  "user": "..."
}

cf version: cf version 8.18.4+3fcd823.2026-07-02

What version of the buildpack you are using?
5.1.2

If you were attempting to accomplish a task, what was it you were attempting to do?
I want to install the package mongodb/mongodb that has CVE-2026-81525 fixed. This is currently limited to 1.24.4+ and 2.4.1+, which require ext-mongodb ^1.21.0 and ^2.4 respectively. But currently the buildpack is using 1.18.1 and 2.2.1 depending on which version of PHP you are using.

What did you expect to happen?
To be able to install a version of mongodb/mongodb that has the fix.

What was the actual behavior?
Composer install fails with the exit status 2.

Please confirm where necessary:

• I have included a log output
• My log includes an error message
• I have included steps for reproduction

Steps to reproduce:

I didn't test this, as I ran this on an internal project. But I think it should be accurate.

1. In a local container / project, install a version of ext-mongodb compatible with the fixed mongodb/mongodb. e.g. pie install mongodb/mongodb-extension:2.5.2
2. Create a project and composer require mongodb/mongodb:^2.4.1 on PHP 8.4+ (or ^1.24.4 on PHP 8.2-8.3)
   • Alternatively, use composer require --ignore-platform-req=ext-mongodb 'mongodb/mongodb:^2.4.1' to avoid having to install ext-mongodb
3. cf push the project with its composer.json and composer.lock file

While it's installing, it will run composer install. Here's the relevant part of the logs from running cf logs --recent <my-project>

   2026-09-16T16:48:26.30+0900 [STG/0] OUT -----> Php Buildpack version 5.1.2
   2026-09-16T16:48:26.30+0900 [STG/0] OUT -----> Supplying PHP
   2026-09-16T16:48:26.30+0900 [STG/0] OUT Loading user configuration from .bp-config/options.json
   2026-09-16T16:48:26.30+0900 [STG/0] OUT Running extension Configure phase
   2026-09-16T16:48:26.31+0900 [STG/0] OUT -----> Composer requires PHP 8.4.*
   2026-09-16T16:48:26.31+0900 [STG/0] OUT Selected PHP version: 8.4.25
   2026-09-16T16:48:26.31+0900 [STG/0] OUT Installing PHP 8.4.25
   2026-09-16T16:48:26.31+0900 [STG/0] OUT -----> Installing php 8.4.25
   2026-09-16T16:48:26.31+0900 [STG/0] OUT Download [https://buildpacks.cloudfoundry.org/dependencies/php/php_8.4.25_linux_x64_cflinuxfs5_89fefb63.tgz]
   2026-09-16T16:48:29.63+0900 [STG/0] OUT Applying user PHP configuration overrides
   2026-09-16T16:48:29.65+0900 [STG/0] OUT Enabling fpm.d config includes
   2026-09-16T16:48:29.65+0900 [STG/0] OUT Web server: nginx
   2026-09-16T16:48:29.65+0900 [STG/0] OUT Installing Nginx 1.31.4
   2026-09-16T16:48:29.65+0900 [STG/0] OUT -----> Installing nginx 1.31.4
   2026-09-16T16:48:29.65+0900 [STG/0] OUT Download [https://buildpacks.cloudfoundry.org/dependencies/nginx-static/nginx-static_1.31.4_linux_x64_cflinuxfs5_badfd1bc.tgz]
   2026-09-16T16:48:29.78+0900 [STG/0] OUT Applying user nginx configuration overrides
   2026-09-16T16:48:29.78+0900 [STG/0] OUT Nginx installed successfully
   2026-09-16T16:48:29.78+0900 [STG/0] OUT Running extension Compile phase
   2026-09-16T16:48:29.78+0900 [STG/0] OUT -----> NewRelic services not detected.
   2026-09-16T16:48:29.78+0900 [STG/0] OUT -----> Installing PHP for Composer
   2026-09-16T16:48:29.78+0900 [STG/0] OUT -----> Installing php 8.4.25
   2026-09-16T16:48:29.78+0900 [STG/0] OUT Copy [/tmp/cache/final/dependencies/6d068bcb3e78d92d203d67541bd7385b7b0c7f27edda7e9e4841b20c67f36107/php_8.4.25_linux_x64_cflinuxfs5_89fefb63.tgz]
   2026-09-16T16:48:32.28+0900 [STG/0] OUT Configured PHP with extensions
   2026-09-16T16:48:32.28+0900 [STG/0] OUT -----> Installing composer 2.10.2
   2026-09-16T16:48:32.28+0900 [STG/0] OUT -----> Installing composer 2.10.2
   2026-09-16T16:48:32.28+0900 [STG/0] OUT Download [https://buildpacks.cloudfoundry.org/dependencies/composer/composer_2.10.2_linux_noarch_any-stack_5ee7125f.phar]
   2026-09-16T16:48:32.38+0900 [STG/0] OUT -----> Installing Composer dependencies
   2026-09-16T16:48:32.59+0900 [STG/0] ERR Installing dependencies from lock file
   2026-09-16T16:48:32.59+0900 [STG/0] ERR Verifying lock file contents can be installed on current platform.
   2026-09-16T16:48:32.72+0900 [STG/0] ERR Your lock file does not contain a compatible set of packages. Please run composer update.
   2026-09-16T16:48:32.72+0900 [STG/0] ERR Problem 1
   2026-09-16T16:48:32.72+0900 [STG/0] ERR - mongodb/mongodb is locked to version 2.4.2 and an update of this package was not requested.
   2026-09-16T16:48:32.72+0900 [STG/0] ERR - mongodb/mongodb 2.4.2 requires ext-mongodb ^2.4 -> it has the wrong version installed (2.2.1).
   2026-09-16T16:48:32.72+0900 [STG/0] ERR To enable extensions, verify that they are enabled in your .ini files:
   2026-09-16T16:48:32.72+0900 [STG/0] ERR - /tmp/php.ini
   2026-09-16T16:48:32.72+0900 [STG/0] ERR You can also run `php --ini` in a terminal to see which files are used by PHP in CLI mode.
   2026-09-16T16:48:32.72+0900 [STG/0] ERR Alternatively, you can run Composer with `--ignore-platform-req=ext-mongodb` to temporarily ignore these required extensions.
   2026-09-16T16:48:32.73+0900 [STG/0] OUT -----> Composer command failed
   2026-09-16T16:48:32.73+0900 [STG/0] OUT **ERROR** Extension compilation failed: extension composer compile failed: failed to run composer: composer install failed: exit status 2
   2026-09-16T16:48:32.87+0900 [STG/0] ERR Failed to compile droplet: Failed to run all supply scripts: exit status 14
   2026-09-16T16:48:32.88+0900 [STG/0] OUT Failed to read buildpack config.yml for buildpack key https://github.com/cloudfoundry/php-buildpack.git#v5.1.2: open /tmp/contents3276677846/deps/0/config.yml: no such file or directoryExit status 223
   2026-09-16T16:48:33.65+0900 [STG/0] OUT Cell 64fe9cc7-bc38-432a-9909-dd6fdde53503 stopping instance 58e66cd9-3315-46d0-b341-9fbd926bb1af
   2026-09-16T16:48:33.65+0900 [STG/0] OUT Cell 64fe9cc7-bc38-432a-9909-dd6fdde53503 destroying container for instance 58e66cd9-3315-46d0-b341-9fbd926bb1af
   2026-09-16T16:48:33.72+0900 [API/5] OUT Staging failed for build 58e66cd9-3315-46d0-b341-9fbd926bb1af
   2026-09-16T16:48:33.74+0900 [API/5] ERR Failed to stage build: staging failed

As it notes, --ignore-platform-req=ext-mongodb could be added to the COMPOSER_INSTALL_OPTIONS, but I don't know if they'd be compatible with the older version of ext-mongodb.

The issue points to the PHP buildpack's extension Configure and Compile phases and the ext-mongodb versions 1.18.1 and 2.2.1. Start by locating where those versions are selected, then verify staging with the listed Composer mongodb/mongodb requirements. Done means compatible fixed package versions install without ignoring the ext-mongodb platform requirement.