Security: Disable session upload progress by default and upgrade FrankenPHP to 1.13.2

docs/content/docs/8.reference/1.environment-variable-specification.md

@@ -128,6 +128,7 @@ Setting environment variables all depends on what method you're using to run you
 `PHP_REALPATH_CACHE_TTL`<br />*Default: "600"*|The duration of time, in seconds for which to cache realpath information for a given file or directory. `600` is the value Symfony's performance guide recommends for applications that open many PHP files. (<a target="_blank" href="https://symfony.com/doc/current/performance.html#configure-the-php-realpath-cache">Symfony docs</a>) (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.realpath-cache-ttl">Official docs</a>)|all
 `PHP_SESSION_COOKIE_HTTPONLY`<br />*Default: "On"*|Add the `HttpOnly` flag to the session cookie so browser scripts cannot read it. On by default as recommended by PHP. Only applies to native PHP sessions. Laravel manages its own session cookie flags. (<a target="_blank" href="https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-httponly">Official docs</a>)|all
 `PHP_SESSION_COOKIE_SECURE`<br />*Default: "false"*|Specifies whether the session cookie should only be sent over HTTPS. Off by default so local development over HTTP works. Set to `true` in production when serving over HTTPS. Only applies to native PHP sessions. Laravel manages its own session cookie flags. (<a target="_blank" href="https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-secure">Official docs</a>)|all
+`PHP_SESSION_UPLOAD_PROGRESS_ENABLED`<br />*Default: "0"*|Track file upload progress in `$_SESSION`. Off by default following <a target="_blank" href="https://www.php.net/archive/2026.php#2026-10-23-1">PHP's October 23, 2026 security advisory</a>. Set to `1` only if your app reads upload progress from the session and never changes `session.serialize_handler` at runtime. Only applies to native PHP sessions. (<a target="_blank" href="https://www.php.net/manual/en/session.configuration.php#ini.session.upload-progress.enabled">Official docs</a>)|all
 `PHP_UPLOAD_MAX_FILE_SIZE`<br />*Default: "100M"*|The maximum size of an uploaded file. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.upload-max-filesize">Official docs</a>)|all
 `PHP_ZEND_DETECT_UNICODE`<br />*Default: ""*|Check for BOM (Byte Order Mark) and see if the file contains valid multibyte characters. This detection is performed before processing of __halt_compiler(). Available only in Zend Multibyte mode. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.zend.detect-unicode">Official docs</a>)|all
 `PHP_ZEND_MULTIBYTE`<br />*Default: "Off"*|Enable or disable Zend Multibyte. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.zend.multibyte">Official docs</a>)|all

src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini

@@ -1547,7 +1547,7 @@ session.trans_sid_tags = "a=href,area=href,frame=src,form="
 ; Development Value: On
 ; Production Value: On
 ; https://php.net/session.upload-progress.enabled
-;session.upload_progress.enabled = On
+session.upload_progress.enabled = ${PHP_SESSION_UPLOAD_PROGRESS_ENABLED}
 
 ; Cleanup the progress information as soon as all POST data has been read
 ; (i.e. upload completed).

src/variations/cli/Dockerfile

@@ -65,6 +65,7 @@ ENV APP_BASE_DIR=/var/www/html \
     PHP_REALPATH_CACHE_TTL="600" \
     PHP_SESSION_COOKIE_HTTPONLY="On" \
     PHP_SESSION_COOKIE_SECURE=false \
+    PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \
     PHP_UPLOAD_MAX_FILE_SIZE="100M" \
     PHP_ZEND_DETECT_UNICODE="" \
     PHP_ZEND_MULTIBYTE="Off" \

src/variations/fpm-apache/Dockerfile

@@ -106,6 +106,7 @@ ENV APACHE_DOCUMENT_ROOT=/var/www/html/public \
     PHP_REALPATH_CACHE_TTL="600" \
     PHP_SESSION_COOKIE_HTTPONLY="On" \
     PHP_SESSION_COOKIE_SECURE=false \
+    PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \
     PHP_UPLOAD_MAX_FILE_SIZE="100M" \
     PHP_ZEND_DETECT_UNICODE="" \
     PHP_ZEND_MULTIBYTE="Off" \

src/variations/fpm-nginx/Dockerfile

@@ -180,6 +180,7 @@ ENV APP_BASE_DIR=/var/www/html \
     PHP_REALPATH_CACHE_TTL="600" \
     PHP_SESSION_COOKIE_HTTPONLY="On" \
     PHP_SESSION_COOKIE_SECURE=false \
+    PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \
     PHP_UPLOAD_MAX_FILE_SIZE="100M" \
     PHP_ZEND_DETECT_UNICODE="" \
     PHP_ZEND_MULTIBYTE="Off" \

src/variations/fpm/Dockerfile

@@ -76,6 +76,7 @@ ENV APP_BASE_DIR=/var/www/html \
     PHP_REALPATH_CACHE_TTL="600" \
     PHP_SESSION_COOKIE_HTTPONLY="On" \
     PHP_SESSION_COOKIE_SECURE=Off \
+    PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \
     PHP_UPLOAD_MAX_FILE_SIZE="100M" \
     PHP_ZEND_DETECT_UNICODE="" \
     PHP_ZEND_MULTIBYTE="Off" \

src/variations/frankenphp/Dockerfile

@@ -2,7 +2,7 @@
 ARG BASE_OS_VERSION='trixie'
 ARG PHP_VERSION='8.5'
 ARG BASE_IMAGE="php:${PHP_VERSION}-zts-${BASE_OS_VERSION}"
-ARG FRANKENPHP_VERSION='1.13.1'
+ARG FRANKENPHP_VERSION='1.13.2'
 ARG GOLANG_VERSION='1.27'
 
 ########################
@@ -223,6 +223,7 @@ LABEL org.opencontainers.image.title="serversideup/php (frankenphp)" \
     PHP_REALPATH_CACHE_TTL="600" \
     PHP_SESSION_COOKIE_HTTPONLY="On" \
     PHP_SESSION_COOKIE_SECURE=false \
+    PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \
     PHP_UPLOAD_MAX_FILE_SIZE="100M" \
     PHP_ZEND_DETECT_UNICODE="" \
     PHP_ZEND_MULTIBYTE="Off" \