Exponential 6.0.13 #

Released 2026-04-18. Tag v6.0.13.

Read this page before you upgrade from 6.0.12: it fixes security findings and changes how sort columns are checked.

In short #

Security hardening (seven findings fixed), PHP 8.4 deprecations, the test tool chain moved to PHPUnit 10 and then 13, sixty PHP string functions as template operators, and SQLite fixes (absolute database paths, schema reading).

Upgrading #

Custom sort column names must match [a-zA-Z0-9_.]. Other names are skipped with a debug warning. Search your templates and code for sort columns of your own before you upgrade. See the hardening specification.

Added #

• PHP string functions as template operators, with rstring and ristring. See PHP string functions as template operators. (4220e2ff90)

Updated #

• SQL and shell injection fixes (findings SEC-01 to SEC-06). See Specification: the 6.0.13 security and stability hardening. (221caccf31)
• Guards against null and undefined values (findings UND, LOG, NUL, PRG). See the hardening specification. (dbb64b1692)
• PHP 8.4 deprecations fixed. See the hardening specification. (2b98050cc4)
• SOAP stubs, guards in the setup wizard, and null safety in the kernel and content classes. See the hardening specification. (5a4c83fb30)
• The session handler's read() returns an empty string, gc() uses time(), and eZCurrentAccess is guarded. See PHP 8 support. (6586f6bacc, 06c9f9d430)
• The API client no longer fails on curl requests. (0b7ccae3bc)
• The test suite runs on PHPUnit 13, and the PHPUnit requirement is raised so that a Composer security advisory no longer blocks the installation. See PHPUnit 13 support. (daea5d5556, 90645c554d)
• SQLite: eZSQLite3DB has its autoload entry, the database path may be absolute, and the database directory is created with its parents. See SQLite database support. (cefe8f13a2, ae5feaf6a7)

Not listed above #

18 changes of this release bring no separate user benefit: 12 documentation, 2 tooling and repository, 2 version bookkeeping and 2 merge commits. Every change of the release (30 in this range) is in the ledger of the root repository.

Related pages #

• Releases before and after: 6.0.12, 6.0.14.
• The story: February 2026, March 2026, April 2026.
• Hardening in detail: Security hardening 6.0.13.