SpawnWP 0.5.53

0.5.53 — Debian 13 runtime candidates

All five PHP runtimes target Debian 13. PHP 7.4 uses explicitly audited Sury
packages containing backports for CVE-2026-109618 and CVE-2026-109619. PHP 7.4
remains end-of-life; these two fixes do not make it generally supported or safe for
production. It requires image-specific acceptance and should be used only in an isolated
LAB.

What happens to existing sites

Updating SpawnWP does not automatically replace the PHP image or version used by sites
you already have. They keep their current PHP image and version until you prepare a Debian
13 runtime and apply it to each site in Cockpit. Cockpit backs up the site and checks it
during the change; the previous PHP image is available for rollback. New sites use the
runtime selected at creation. Adminer has a separate image update action and is not
updated by changing PHP.

Runtime preparation and site selection are separate operations. Sites retain an
immutable image reference; applying a prepared image verifies FastCGI, HTTP and
database readiness and restores the previous image if verification fails. Down
sites stay Down. Existing custom runtime files require manual migration review.

The per-site Nginx candidate is updated to 1.30.6 on Alpine 3.24 and can be applied
separately from PHP. MariaDB and Mailpit data formats are not migrated. Adminer's
own PHP is independently verified before an image is applied.

Xdebug changes are mounted per site and take effect after restarting PHP. Email
capture is installed before either standard or captured blueprints activate
plugins. PHP INI overrides survive managed runtime updates.

See runtime migration for preparation, backup, rollout,
validation and rollback. The native amd64/arm64 matrix exercises all five PHP branches
and every supported PHP transition. Existing sites retain their selected images
until their owner explicitly prepares and applies a new runtime. The update recreates
PHP for the existing WP-Cron correction only if the running container still disables
WP-Cron, and keeps that site's PHP image pinned during the operation.