NEW: [.htaccess Manager] Search applet. [Argos] systemd-resolved monitoring. [Auth] Add [auth] => server_key support for extended cp-proxy usage. See apisnetworks/cp-api repository. [Cron] [crond] => autostart controls automatic startup of crond process when crontab,enabled=1. [dns] dns:flush()- empty authoritative cache if supported. Only PowerDNS is supported at this time. [dns] dns:empty_zone()- delete all records in a zone. dns:reset()- call empty_zone() then provision zone with default records. [DNS] dns.powerdns-version scope. Set PowerDNS daemon version on server. [DNS] Dns\Record::add(). Similar to merge, except properties are only set if unset. [Lararia] route/view dynamic namespaces. Path resolution determined at call-time, caching for the remainder of the request lifecycle. Additional dynamic namespaces @NAMESPACE-NAME(PARAMETER) may be registered against Lararia\Routing\NamespacedRouteCollection or Lararia\View\NamespacedViewFinder. Corresponding bindings are superceded by these classes. [Laravel] Lumen subtype dection. [Metrics] metrics.enabled scope. Toggles metrics support, including purge on disablement. [php] php:pool-name()- get pool name from path. [PHP] ionCube v12 support. Supports PHP 8.1. 8.0 is not included from vendor. [PHP] SourceGuardian support. Activated when php_install_sourceguardian is true. [Rampart] Speculative whitelisting. When an IP is unbanned, the address is temporarily added to ignorelist for [rampart] => speculative_whitelist seconds. See docs/FIREWALL.md [UI] Relocate Web App compact display to shared view, master::shared.compact. [UI] Sticky session tracking. When IP restrictions are enabled for a user, track the most recent login automatically adding the IP if detected. Requires enablement under Settings. [UI] Content security reporting support. Configured in [frontend] => content_security_policy_report_only. [upcp] Add -f/--force flag. Applies --extra-vars=force=yes to Bootstrapper invocation as well as upcp --reset prior to codebase updates. [upcp] Add -v/-vv/-vvv flags. Controls verbosity of migrations and Bootstrapper usage. [WordPress] Add "language" reconfigurable to set default WordPress language. May be hooked into wordpress:install() to override default language after setup. FIXED: [Aliases] Calling aliases:add-domain() after removing a domain before aliases:synchronize-changes() blocks on bad assertion (related #e4959bb3). [Bootstrapper] Workaround for Ansible filtering localized "No packages match". [Cloudflare] Origin marker usage mandatory. [Cloudflare] Soft-deletion compatibility. Zones deleted are now retained within Cloudflare's system for an extended duration. Zones recreated during this time are subject to dns:reset(). [Cron] Starting virtualcron in at least one persistent environment resulted in invalid "failed" state. [Database Backups] Pipeline non-zero exit treats corrupted database backup as success. [DNS] Bulk updates fail on subsequent matches in same zone. [Domains] Addon domain creation in user home blocks o+x applicatin when PHP-FPM enabled. [Email] Mailbox restoration during provider change from null to builtin improperly tried to restore mailbox backup. [File Manager] ASCII encoding preferred over UTF-8 when UTF-8 best candidate. [Internal] Expired afi instance sends invalid ghosted session. [Internal] Difficulty arises during deserialization when the context isn't known at object instantiation; an ephemeral function broker is created to replace the session. Function broker's ID is replaced with this ID while the global auth context is preserved causing a mismatch in Preferences sanity check. [Mail] Expose additional environment variables to maildrop: $SENDER, $EXTENSION, $RECIPIENT, $NEXTHOP, $SENDER. See docs/admin/LDA.md [Mail] maildrop unconditionally queries authlib per compile-time settings. Introduce new flag, -x, to bypass authlib lookup when mail_enabled=0. [Metrics] Wrap monotonic values exceeding 2^31-1. [MySQL] Tables with non-alphanumeric characters fails rename. [Nextcloud] config_is_read_only enforced in occ usage. Implement direct parser to lock/unlock before occ invocation. [Node] Ignore exit code 3 in software/nvm role when no Node versions installed on system. [NSS] CentOS Stream introduces new directive usage. [PHP] Permissions block enumerating multiPHP versions from UI. [PowerDNS] Canonicalize SOA RNAME. Required in 4.6+. [PostgreSQL Manager] Database prefix lists mysql,dbaseprefix. [Proxy] mod_remoteip presence in cp-proxy documentation replaces remote address IP with X-Forwarded-For when remote address matches proxy address. Various checks always assume X-Forwarded-For is valid but can be poisoned if supplied in addition to mod_remoteip usage. Check loaded modules to determine whether X-Forwarded-For is a safe header when [core] => http_trusted_forward is set. [Scopes] Observe explicit quotes in cp.config. [Scopes] mail.enabled must trigger software/haproxy to update monitoring. [Setup Instructions] FTP login references ftp,ftpserver. [SpamAssassin] sa-compile idempotency check in mail/spamassasin. [SSL Certificates] Primary domain deauthorized from handling mail deselects all mail-related subdomains from other domains. [SSL Certificates] Mail domains omitted from SSL selection when primary domain is delisted from Mail Routing. [Subdomains] "user ownership" setting has no effect on document root. [Traceroute] Use positional arguments in traceroute address to ensure appropriate escaping as reported by cmg. [UI] Security key usage in Terminal, rspamd may expire before it is rolled over. Bad logic checks makes retrieval from master httpd process impossible in /proc/PID/environ. [Webapps] CLI installation ignores app-specific reconfigurables. [WordPress] Renaming a site to a directory whose source name contained part of the target directory incorrectly detected as nested. CHANGED: [ApisCP] Change default mutex from posixsem to pthread. On posixsem, semaphore ownership is not recovered in a thread in the process holding the mutex segfaults resulting in a hang. With pthread, C7+ implements pthread_mutexattr_setrobust_np(). If the thread dies it passes onto the next owner with EOWNERDEAD. [ApisCP] Reduce RSS usage by moving OPCache to file-cache. [Backend] TSTP/CONT signals are forwarded to job runner service from apnscpd process. [Backend] Unlink apnscp.sock on shutdown, avoid conflict with hydration. [Bootstrapper] Apply migrations occuring after image marked for hydration. [Bootstrapper] Removing packages from filesystem template triggers fsmount reload. [cgroups] Allow group to write its pids to tasks, including Dovecot mail processes. Once a group is bound it can only migrate to a new group. Permissions on other groups prevent migration locking a PID to a controller taskset. [CLI] rmspam purges matching pattern in maildrop queue. [Composer] Prefer reading version from composer.lock. [Composer] Use PHP wrapper assigned for path if multiPHP present. [Config] Blacklist directives in config.ini support partial matching such as foo* or !foo*. [DAPHNIE] Deleting time-ordered data deletes underlying chunks. [Database Backups] Attempt automatic repair of corrupted databases. [Discourse] Switch Ruby versions on demand if available during upgrade. [DNS] gethostbyname_t(), gethostbyaddr_t() report failing nameserver. Both API functions follow timeout defined in [dns] => lookup_timeout. [DNS] Implement get_server_from_domain(), get_all_domains(), get_parent_domain(), domain_hosted(), domain_on_account() in multi-server setups. [Hooks] Multiple hooks may be registered to an API call. [Hooks] Fill omitted arguments on callback. [Let's Encrypt] Trigger SSL bootstrap only on domain addition. Previously deletions were included. [Manage Users] Apply username input validation on entry. [Map] Harden map symlink checks. [Miscellaneous] Update AlmaLinux, Rocky Linux conversion scripts. [MySQL] Process condition in which MySQL database rename destination is to empty directory. [node] installed()- value return changed from boolean to null|string, value that matches version filter if found. [Opcenter] Report pid when global lock held. [Opcenter] Resolve multiple typing errors when changing plans from one deleted directly in the filesystem. artisan opcenter:plan --delete should be used for sanity checks prior to deletion. Fallback to system default, then apply hard reset (--reset) against new plan. [php] version() reports PHP-FPM pool version instead of system version. [PHP] Extensions downloads from pecl.php.net observe transient network outages. [PHP] Ignore Remi presence when php_enabled is set to false. Implied when has_dns_only enabled. [PHP Pools] Catch connection errors on cache inspection. [PowerDNS] Downgrade duplicate record to warning. PowerDNS utilizes both negative and positive query caches with different TTL values (60/20 default). Querying for a record, adding, then querying again responds with NXDOMAIN resulting in potential duplicate operation. In future these lookups should be made directly against the master - whether hidden or exposed. [PowerDNS] Reduce client instantiations. [Rampart] Prevent direct management of named ipset or iptables lists in [rampart] => blacklist. [Rampart] Reimplement entry parser as line parser. Approximate 50% speedup in entry processing. [ruby] installed()- value return changed from boolean to null|string, value that matches version filter if found. [Scopes] Changing timezone resarts rsyslog/systemd-journald, see fail2ban/fail2ban#1986. [Scopes] dns.ip4-proxy and dns.ip6-proxy may now be set "null" to clear value. [Subdomains] Link subdomain into all_subdomains/ inside respective useer home. [upcp] ANSIBLE_STDOUT_CALLBACK may be overwritten from environment. [vsftpd] Define tcp_wrappers depending upon CentOS release. Clears potential in-place upgrade from 7 -> 8 in which tcpwrapper support is disabled. [Webapps] API improvements. WebappUtilities::getAuthContextFromDocroot() creates a new context based on document root ownership. DatabaseGenerator::connect() creates PDO connection using sourced credentials from webapp::db_config(). Separate PhpWrapper/ComposerWrapper utility classes. [WordPress] Toggle WP_AUTO_UPDATE_CORE when same-user and panel autoupdates disabled or unprivileged and autoupdates enables. REMOVED: [ClamAV] freshclam cronjob superseded by clamav-update systemd timer. [Cloudflare] Host app. Officially abandoned by Cloudflare. [Lararia] jenssegers/blade package replaced with in-house implementation. [Filesystem Template] sudo remained accessible in virtual environments provisioned between Feburary 7 and July 14.