No impact incident

CloudLinux: dnf update aborts on CL9 + EPEL: ea-php81-85-php-gd and alt-php GD require libavif.so.15, EPEL 9 libavif 1.1.1 clashes with alt-common libavif/svt-av1-libs

Affected: EasyApache4 PHP packages

Current status of CloudLinux: Operational — live CloudLinux status

Timeline

1. Sep 29, 2026, 15:33 UTC
   investigating
   On CL9 cPanel servers with EPEL enabled (default best=True), `dnf update` / upcp aborts completely: "package ea-php8X-php-gd ... requires libavif.so.15()(64bit), but none of the providers can be installed". To let updates proceed, add this line to the [epel] section of /etc/yum.repos.d/epel.repo and run your update again: excludepkgs=libavif* svt-av1* This is a temporary workaround. Remove the exclude once the fix (ALTPHP-2626) is released. A regular dnf update will then complete normally.
2. Sep 29, 2026, 16:28 UTC
   investigating
   We are continuing to investigate this issue.
3. Oct 1, 2026, 20:51 UTC
   monitoring
   We have rebuilt every GD package against libavif.so.16 and now ship the same versions as EPEL, so the dependency conflict no longer occurs. - If you applied the temporary workaround, remove the excludepkgs=libavif* svt-av1* (or exclude= ) line from the [epel] section of /etc/yum.repos.d/epel.repo (and from any other repo file you edited). - Run dnf clean metadata && dnf update --nobest . It now completes with no libavif , svt-av1 or libdav1d problems. A server that never had the workaround just needs dnf update --nobest . - Restart the PHP handlers so the GD module loads the new library. /scripts/restartsrv_httpd and /scripts/restartsrv_apache_php_fpm . To confirm you have the fix: rpm -q --requires ea-php8X-php-gd | grep avif should show libavif.so.16 . Known residual issue: After the libavif fix, dnf update may now stop on the alt-phpXX database add-ons, for example: package alt-php84-mariadb1011-8.4.25-1.el9.x86_64 from @System requires alt-php84-common = 8.4.25, but none of the providers can be installed This is a separate packaging issue: the mariadb/mysql add-ons have not yet been rebuilt to the matching versions. This is being addressed under an internal task (ALTPHP-2631). As a temporary measure, run dnf update --nobest . This applies the rest of the update from the stable repositories and leaves only the not-yet-rebuilt add-ons at their current version. Once the rebuilt add-ons land, a plain dnf update completes with nothing skipped.
4. Oct 2, 2026, 17:36 UTC
   monitoring
   Two new security builds of the GD extension in the PHP ELS repository, alt-php74-gd-7.4.33-75 and alt-php81-gd-8.1.34-32, were built against an older version of the libavif image library than the rest of your system uses, so dnf was unable to install them. Our developers have already prepared corrected builds (alt-php74-gd-7.4.33-78 and alt-php81-gd-8.1.34-36), which also include the security fixes from the affected builds. They have already been released and are available in the stable repository.
5. Oct 12, 2026, 11:48 UTC
   resolved
   All corrected ea-php and alt-php GD builds and the rebuilt alt-php database add-ons are now in the stable repositories, so a plain dnf update completes with nothing skipped and --nobest is no longer needed. If you added excludepkgs=libavif* svt-av1* as a workaround (in epel.repo or the [main] section of dnf.conf ), remove it before updating. This incident has been resolved.

Updates as published by CloudLinux (original).