chore(release): prepare v4.13.0

[mrrobot47]

Summary

• Prepare EasyEngine v4.13.0 release.
• Bump VERSION from 4.12.0 to 4.13.0.
• Bump bundled packages (composer.json + composer.lock, only these four packages change in the lock):
  • easyengine/site-command v3.7.6 → v3.8.0: fix(proxy): only reload nginx-proxy when its config test passes site-command#494, fix(ssl): skip le renewal on alias-domain change for non-le sites site-command#488, feat(site): add alias domain hooks and validate alias domain names site-command#502
  • easyengine/auth-command v1.2.1 → v1.3.0: feat(auth): support http auth and ip whitelist on wildcard subdomains and alias domains auth-command#57
  • easyengine/site-type-wp v1.10.1 → v1.11.0: fix(site): validate alias domain names on site create site-type-wp#239
  • easyengine/site-type-php v1.10.1 → v1.11.0: fix(site): validate alias domain names on site create site-type-php#114
• Update Docker image versions to EasyEngine/dockerfiles v4.13.0 for every image whose directory changed since v4.11.1:
  • easyengine/nginx-proxy v4.11.1 → v4.13.0: jwilder/nginx-proxy 1.11.6 (chore(deps): bump jwilder/nginx-proxy from 1.11.2 to 1.11.6 in /nginx-proxy dockerfiles#345) and the new wildcard auth/ACL lookup (fix(nginx-proxy)!: apply wildcard htpasswd and ACL only to *.X hosts dockerfiles#354)
  • easyengine/php7.4 v4.7.4 → v4.13.0 and easyengine/php8.0 v4.8.1 → v4.13.0: final rebuild on the last Debian 11 security snapshot, PHP unchanged at 7.4.33 / 8.0.30 (fix(php): use final bullseye-security snapshot for 7.4 and 8.0 dockerfiles#355). These are the last builds of both images (ci(php): stop building EOL-base php 7.4 and 8.0 images dockerfiles#356 drops them from the build matrix).
  • easyengine/php8.1 v4.10.2 → v4.13.0: PHP 8.1.34 unchanged, Debian 13 packages upgraded at build time because the EOL upstream base is no longer rebuilt, now Debian 13.7 (chore(deps): bump php 8.2/8.4/8.5 and patch the php 8.1 base dockerfiles#360)
  • easyengine/php8.2 v4.11.0 → v4.13.0: PHP 8.2.34 (chore(deps): bump php from 8.2.31-fpm to 8.2.33-fpm in /php/8.2 dockerfiles#350, chore(deps): bump php 8.2/8.4/8.5 and patch the php 8.1 base dockerfiles#360)
  • easyengine/php8.3 v4.11.0 → v4.13.0: PHP 8.3.33 (chore(deps): bump php from 8.3.31-fpm to 8.3.33-fpm in /php/8.3 dockerfiles#348)
  • easyengine/php8.4 v4.11.0 → v4.13.0: PHP 8.4.26 (chore(deps): bump php from 8.4.22-fpm to 8.4.25-fpm in /php/8.4 dockerfiles#352, chore(deps): bump php 8.2/8.4/8.5 and patch the php 8.1 base dockerfiles#360)
  • easyengine/php8.5 v4.11.1 → v4.13.0: PHP 8.5.11 (chore(deps): bump php 8.2/8.4/8.5 and patch the php 8.1 base dockerfiles#360)
  • easyengine/redis v4.11.0 → v4.13.0: Redis 8.10.1 (chore(deps): bump redis from 8.8.0 to 8.10.1 in /redis dockerfiles#351)
  • easyengine/postfix v4.11.0 → v4.13.0: Debian 13.6 (chore(deps): bump debian from 13.5-slim to 13.6-slim in /postfix dockerfiles#344)
• Keep every other image unchanged. easyengine/mariadb stays at v4.9.1; the MariaDB upgrade is not part of this release.
• Core changes since v4.12.0 already on develop: chore(deps): bump composer/composer from 2.2.28 to 2.2.30 #1933 (composer/composer 2.2.30, fixes the PR and nightly builds), chore(deps-dev): bump squizlabs/php_codesniffer from 3.13.5 to 3.13.6 #1932 (php_codesniffer 3.13.6), ci: update GitHub Actions to Node 24 majors #1934 (GitHub Actions on Node 24).

Release notes

Highlights: HTTP auth and IP whitelists now cover subdomain multisite subsites, alias domains and *.alias wildcard aliases, and follow alias changes; the nginx-proxy wildcard lookup no longer leaks a site's auth to unrelated sibling hosts; nginx-proxy is only reloaded when nginx -t passes; alias domain names are validated on create and update; alias changes on non-LE SSL sites no longer abort halfway. The full PR list is generated by utils/changelog.sh into the draft release when the tag is built.

Upgrade notes

• Breaking (fix(nginx-proxy)!: apply wildcard htpasswd and ACL only to *.X hosts dockerfiles#354): a _wildcard.X htpasswd/ACL file now only applies to hosts that are literally *.X. The lookup is <host>, then _wildcard.X for *.X hosts, then the global default. Hand-made _wildcard.X files that were relied on to protect X itself or other hosts under X need per-host files. Sites managed with ee auth need nothing.
• Auth files are regenerated on upgrade: the container migration 20260924120000_auth-command_regenerate_site_auth_files rewrites the htpasswd and ACL files of every site (site, _wildcard.<site> for subdomain multisites, each alias, _wildcard.X for *.X aliases), removes files of sites without their own entries, and reloads the proxy once. It skips fresh installs and is not reverted on failure.
• Sites are recreated: the image migration recreates nginx-proxy and redis, and the containers of every WordPress and PHP site (postfix changed for all of them). Every site on PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 or 8.5 moves to its new v4.13.0 PHP image.
• Everything must ship together: site-type-wp/php v1.11.0 call functions added in site-command v3.8.0, site delete cleanup of auth moved to auth-command v1.3.0, and the new auth files need the new nginx-proxy template. The container migration runs before the image migration, so if the nginx-proxy pull fails, the old proxy briefly runs with the new files, which its template also applies to sibling hosts. easyengine/nginx-proxy:v4.13.0 and every other bumped tag were checked on Docker Hub.

After merge

• Merge develop into master and push the signed v4.13.0 tag. CI then builds the phar, publishes it to easyengine-builds and creates the draft release, which gets reviewed before publishing.