NEW: [OS] CentOS 8.3+ support. [upcp] Automatically log updates and report failures. FIXED: [Bootstrapper] job daemon authentication changes prevented email summaries from generating for Bootstrapper + integrity check emails. [cgroups] a mount change in 3.2.13 attempted to unmount the reference cgroup controller instead of bind-mounted controller within the filesystem template. [UI] downloaded files buffer in-memory potentially resulting in OOM conditions for larger files. [Web Apps] screenshots on CentOS 8 do not honor /etc/hosts restrictions. CHANGED: [Apache] apply 2 GB memory limit to control group slice intended to prevent runaway processes. [Let's Encrypt] disable renewal of SSL for suspended accounts. Move renewal to activation of suspended accounts. A minor change to suspend-rules template is added to allow /.well-known requests to succeed while a site is undergoing activation. [Let's Encrypt] honor global strict_mode/verify_ip settings under [letsencrypt] in config.ini. [Network] switch queueing algorithm to fq, which supports TCP pacing in pre-4.13 kernels necessary for BBR congestion control. [Nexus] report total accounts in addition to total domains. [PowerDNS] report connectivity errors. [Process] always inherit unshared mount's permissions. [UI] use Brotli compression. Periodically cull HTTP processes above resource watermark (195 MB). [Utilities] mapCheck will reverse populate appldb.siteinfo table with any missing domains.