[sunnywu]

Pins the WordPress integration-test fixture base image from the floating php:8.3-cli-alpine tag to php:8.3.36-cli-alpine3.23.

8.3.36 is the fixed release for CVE-2026-109618 and CVE-2026-109619 (8.3.x before 8.3.36 is affected). The floating tag already resolves to 8.3.36 today; pinning makes the patched version explicit so Dockerfile-based scanners stop flagging it. The image is only used by the integration tests and is never deployed.

🤖 Generated with Claude Code

[aram356]

Thanks for the contribution, @sunnywu.

php:8.3-cli-alpine already resolves to 8.3.36: on Docker Hub its amd64 image has the same digest as php:8.3.36-cli-alpine (sha256:74c3e6f3f78d...). CI builds this fixture on fresh runners with no image cache, so every run already pulls the patched release. Pinning the tag would stop the fixture from picking up the next PHP and Alpine fixes on its own, so we'd like to keep the floating tag (inline suggestion on the FROM line).

🔧 wrench: To keep the base image current without manual bumps, please add a Docker entry to .github/dependabot.yml in this PR instead:

  - package-ecosystem: "docker"
    directory: "/crates/trusted-server-integration-tests/fixtures/frameworks/wordpress"
    schedule:
      interval: "weekly"

Patch releases keep arriving through the floating tag, and Dependabot opens a PR when a newer PHP line is published (it should propose 8.5-cli-alpine today).