Bump FrankenPHP to v1.13.2 (security release) #254

FrankenPHP v1.13.2 was released on 2026-10-21 as a security release. The FrankenPHP images still build with frankenphpRef = "v1.13.1" (docker-bake.hcl), so ghcr.io/shopware/docker-base:*-frankenphp does not include these fixes yet.

Since #249, PHP 8.5.12 is already in the images, so PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is covered. The remaining issues are in FrankenPHP itself. Two of them affect any Shopware setup running FrankenPHP in worker mode:

• GHSA-4gfw-9v29-gp9h: error_get_last() and libxml_get_errors() were not cleared between worker requests, so they could leak fragments of a previous client's input and server paths into the next request served by the same thread.
• GHSA-fq24-r53r-xcx3: requests queued while waiting for a PHP thread were not dropped when the client disconnected, so an unauthenticated client could keep the thread pool busy.

The release also fixes GHSA-ccgp-ch9h-533f, a process crash on cyclic arrays, and GHSA-6q3j-62j9-f9hh, which concerns embedded apps.

Could frankenphpRef be bumped to v1.13.2, and the FrankenPHP images rebuilt? We run docker-base:8.5-frankenphp in production in worker mode and would rather keep using the upstream image than maintain our own base.

Thanks for the quick PHP 8.5.12 rebuild yesterday!