[mrrobot47]

Summary

• Prepare EasyEngine v4.13.3: a security release for the PHP vulnerabilities fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 2026-10-21 (CVE-2026-109618 / GHSA-w8hw-w9fx-j79w and CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp, both CVSS 9.2; PHP advisory).
• Bump VERSION from 4.13.2 to 4.13.3.
• Images (img-versions.json): easyengine/php8.2, php8.3, php8.4 and php8.5 move to v4.13.3, built on php:8.2.35-fpm, 8.3.36-fpm, 8.4.27-fpm and 8.5.12-fpm (chore(deps): bump php to 8.5.12 in /php/8.5 dockerfiles#362, Exclude Postfix from default EE install. #363, Add HHVM to EE #364, High CPU (php5-fpm) After User Comments on Wordpress Blog? #365; tag v4.13.3). No other image changes.
• Bump bundled packages (composer.json + composer.lock; only these two packages and content-hash change in the lock):
  • easyengine/site-type-wp v1.12.1 → v1.12.2: fix: disable session.upload_progress for new and existing sites site-type-wp#246
  • easyengine/site-type-php v1.12.1 → v1.12.2: fix: disable session.upload_progress for new and existing sites site-type-php#120
• The site-type releases switch off session.upload_progress.enabled for new sites and, through a container migration, for every existing WordPress and PHP site on all PHP versions, which is the mitigation PHP's advisory recommends for CVE-2026-109619. A custom.ini that already sets the option globally is left alone.
• All other command packages are unchanged.

Upgrade notes

• ee cli update recreates every enabled site on PHP 8.2–8.5 on the patched image (the image migration). Disabled sites pick it up with ee site enable <site> --refresh.
• Sites on PHP 8.1 and older get no PHP fix (PHP made no official release for them); the session upload progress change applies to them too.
• On macOS, a site's custom.ini isn't loaded, so the session setting has no effect there.

Testing

• Published images: smoke.sh --pull on easyengine/php8.2/8.3/8.4/8.5:v4.13.3. Each runs the expected PHP version, loads exactly the same modules as the current images, passes php-fpm -t and serves a page through nginx, with no startup warnings.
• Migration: live upgrade from 4.13.2 on a test host with WordPress and PHP sites on PHP 5.6, 7.4, 8.1 and 8.4 (enabled, disabled, explicit On, custom settings, [PATH=] section): the setting is added and takes effect, uploads keep working, an injected failure rolls back to byte-identical files, and a re-run is a no-op.

[Copilot]

🔵 Needs a closer look

The security-sensitive image upgrades and bundled configuration migrations warrant final human validation of deployment and rollback behavior.

No open issues 🎉

What changed in this PR

Prepares EasyEngine v4.13.3 with updated PHP security images and bundled site packages that mitigate session upload progress vulnerabilities.

Changes:

• Bumps EasyEngine to v4.13.3.
• Updates PHP 8.2–8.5 images to v4.13.3.
• Pins PHP and WordPress site packages to v1.12.2, leaving other packages unchanged.

File	Description
VERSION	Sets release version to 4.13.3.
img-versions.json	Updates four PHP security image tags.
composer.lock	Locks updated site packages and refreshes the content hash.
composer.json	Pins both site packages to v1.12.2.

_{Review effort: Balanced}