CHG: bump (migrations)

REM: preference reset (MetaManager)

FIX: bans_since()- null dereference prior to initialization (rampart)
FIX: missing log name (php)
CHG: update (tests)
CHG: bypass data segment limit on 3.10.x kernels (tests)
CHG: Cap Laravel 8 (Laravel)
CHG: bump imagick to 3.7.0 (php/install-pecl-module)

CHG: isolate virtualcron call from systemd (apnscp/install-services)

CHG: increase 100ms retry on failed service to 750ms as protection against misconfigured service dependency ordering (PHP-FPM)

FIX: non-slave designation forces procfs unmount against all sites on deletion (apnscp/install-services)

FIX: deleting a site lingers queued jobs in atd. Rewrite Util_Process_Schedule to optionally tag job IDs with site identifier. These jobs will be removed at account deletion (Util_Process)
FIX: declaring /sys/fs/cgroup -> /.socket/cgroup as slave mount loses propagation rights when /.socket mounted as slave. Corrects window between apnscp and cgconfig initialization in which PHP-FPM could startup failing on postexec cgclassify step. (apnscp/install-services)
CHG: flip $jailed default to false (Php\Fpm\Configuration)
CHG: rewrite scheduled tasks (site, auth)

CHG: pool_set_state()- create logfile on pool startup failure (php)

CHG: cleanup Node versions on upgrade. Change default behavior to not install system-wide Node. Controllable via node_system_install (bool) and node_prune_system_upgrades (bool) (software/nvm)
CHG: force resets interface configuration (apnscp/bootstrap)

REM: nbproc. No longer present in haproxy v2+. PostgreSQL repository may pull in haproxy v2 during update on Alma/Rocky/C8 machines. haproxy_worker_count moved to nbthread on v1.8+ (software/haproxy)

FIX: SpamHaus flags Cloudflare as public resolver. Postfix DNSBL codes work on first non-zero result rather than specificity. Expand non-error statuses to avoid flagging mail as spam (mail/configure-postfix)

FIX: filter 127.255.255.x responses from SpamHaus (mail/configure-postfix)

CHG: merge shutdown to common function (Opcenter\Account)

FIX: delayed cgroup rbind into vfs results in failed PHP-FPM startup when cgroup,enabled=1 on busy sites. Promote cgroup rbind following cgconfig startup, previously located in apnscpd initialization (system/cgroup)
FIX: spaces in /etc/default/postsrsd treated as command (mail/configure-postfix)
CHG: report fatal() in systemd status (apnscpd)
CHG: move \ListenerServiceCommon to \ListenerService\Daemon (apnscpd)

NEW: -m|--migration flag runs specified migrations. glob-style wildcards are supported. Results are not logged to migrations database. Intended primarily for development purposes to test migrations without specifying the full name (upcp)
CHG: relink /var/lib/mysql/mysql.sock as needed after installation (mysql/install)
CHG: expand supported MongoDB versions to 5.0 (packages/install)
CHG: migrations may be chained with a comma, --extra-vars=migrations=migration1,migration2 (migrator.yml)

FIX: promoting addon domain to primary domain removes zone (dns)
CHG: state may be literal "disabled" or bool (software/argos)

FIX: import_rule statically defines variables that may be included as role directives in playbook. Running php/multiphp dynamically includes roles outside visibility. Revert prior setting that defaults to false (php/install)

FIX: cancelling confirm dialog still processes removal (Settings, Whitelist)

CHG: change_cpassword()- permit locked indicator "!!" (auth)
CHG: trim space from search input (Nexus, Web Apps)
CHG: toggle rspamd service monitoring by mail availability (software/argos)

FIX: restore previous behavior before introduced in 3.2.31. A domain deleted yet not committed via aliases:synchronize-changes may be added (aliases)

CHG: Extend plugin/theme argument to accept $force (default: false) that bypasses skiplist rules. Available only when $plugins is formatted as a complex list. (Wordpress)

CHG: Apply external opener behavior to SSO (Wordpress)
CHG: Reduce scope of external opener decorator to any rel="external" attribute (UI)

CHG: User namespaces can be disabled entirely as mitigation for CVE-2022-0185 and general hardening. Disabling namespaces disables sandboxing in Chrome, which is designed to isolate tabs from malicious code exploiting a vulnerability. When disabled sandboxing must be disabled as well. [screenshots] => sandbox_fallback controls this behavior (BulkCapture)
CHG: purge screenshots on domain/subdomain addition (Opcenter, web)

CHG: detect if sandboxing is available (BulkCapture)

NEW: add "debug" reconfigurable toggling WP_DEBUG (Wordpress)
CHG: templatize buildTaskOrder() to parent (Migration)

NEW: --do=, --list-components. Perform named components from backup. In most situations --no-create --no-scan --no-bootstrap should be included to prevent post-migration hooks from running once the components are processed. --do may be listed multiple times. (Migrations)