What's Changed

Disable PHP OPcache JIT by default

PHP 8.3's JIT tracing mode has known memory corruption bugs that can cause recurring PHP-FPM worker crashes. Since WordPress workloads see negligible benefit from JIT, it's now disabled by default.

Users who want JIT can re-enable it via group_vars:

php_opcache_jit: 'tracing'
php_opcache_jit_buffer_size: 256M

Background: https://discourse.roots.io/t/php-8-3-jit-tracing-recurring-crash-at-theme-php-325-4gb-allocation/30241

Add support for Composer custom-headers authentication

#1652

Full Changelog: v1.29.0...v1.30.0

What's Changed

New Features

• Add HTTP/3 support (#1531) @strarsis
• Add opt-in WordPress runtime hardening controls (#1649) @retlehs

Bug Fixes

• Remove raw string for ansible_become_pass (#1651) @strarsis

Full Changelog: v1.28.0...v1.29.0

What's Changed

Features

• Ansible 2.19 support by @swalkinshaw in #1620
• WordPress sites git branch: Default to main by @retlehs in #1629
• Add Redis PHP session storage support by @retlehs in #1639
• Deny access to .txt and .md files in plugin directories by @AltanS in #1625
• Use sudo for become method by @swalkinshaw in #1624
• Set cli_ask_pass default in Users role by @swalkinshaw in #1637

Bug Fixes

• Fix ansible_user detection condition by @swalkinshaw in #1635
• Fix Redis object cache password not passed to WordPress env by @retlehs in #1638
• Fix fastcgi cache caching redirect responses by @retlehs in #1641
• Fix NGINX HTTP response splitting in multisite subdirectory rewrite by @retlehs in #1640
• Fix fastcgi cache serving stale content for unpublished pages by @retlehs in #1642

Dependencies

• Update dependency ntp to v4 by @renovate[bot] in #1631

Full Changelog: v1.27.0...v1.28.0

What's Changed

• Drop Vagrant support by @retlehs in #1622
• Remove dot in network database message by @Dyras in #1621
• Remove memcached_fs_file_max setting by @swalkinshaw in #1619
• Remove timezone validation by @swalkinshaw in #1618
• Remove SSH settings validation by @swalkinshaw in #1614
• fix: add missing ssl directives by @LucasDemea in #1476
• Use double quotes for env values by @swalkinshaw in #1617
• Set php-fpm log_level default to fix 'unknown value' by @dalepgrant in #1615
• Set git depth to 1 for deploy role by @dalepgrant in #1616
• Update dependency python to 3.14 by @renovate[bot] in #1562
• Revert "Improve common var definitions" by @swalkinshaw in #1613
• Add a User-Agent header to test_challenges.py by @antti-ucla in #1595
• Remove complex duplicate sites validation by @swalkinshaw in #1612
• Add select_sites custom filter by @swalkinshaw in #1611
• Improve common var definitions by @swalkinshaw in #1593
• Update actions/setup-python action to v6 - autoclosed by @renovate[bot] in #1596
• Refactor User password hash creation by @swalkinshaw in #1607
• Remove FLUSHDB from redis_disabled_commands by @zak-wearecore in #1609

New Contributors

• @antti-ucla made their first contribution in #1595

Full Changelog: v1.26.1...v1.27.0

What's Changed

• Add WordPress sites to /etc/hosts by @retlehs in #1606
• Set php_fpm_process_control_timeout to 10 to prevent deploy downtime by @Dyras in #1603
• Flush cache after deploy by @retlehs in #1604

Full Changelog: v1.26.0...v1.26.1

What's Changed

• Update actions/checkout action to v5 by @renovate[bot] in #1591
• Replace deprecated distutils version usage by @swalkinshaw in #1590
• ✨ Add Redis object cache support by @retlehs in #1589
• Fix HSTS header omitted parts by @biinari in #1592
• Change npm command to 'npm ci' in build example by @retlehs in #1597
• Add ansible-core version constraint by @retlehs in #1600

Full Changelog: v1.25.0...v1.26.0

What's Changed

• Allow removal of old SSH keys on provision by @dalepgrant in #1576
• Filter Nginx includes by sites present on target server by @dalepgrant in #1573
• Allow cleaning apt sources on provision by @dalepgrant in #1578
• ⬆️ Use PHP 8.3 by default by @retlehs in #1580
• wp-cli-version-check.yml: Use gh to fetch WP CLI release info by @tangrufus in #1585
• Add X-Cache-Enabled HTTP header by @strarsis in #1513
• Run ferm role when letsencrypt tag is defined on provision by @zak-wearecore in #1588
• Update acme_tiny_repo by @johnkraczek in #1582

New Contributors

• @zak-wearecore made their first contribution in #1588
• @johnkraczek made their first contribution in #1582

Full Changelog: v1.24.1...v1.25.0

What's Changed

• Update WP-CLI version to 2.12.0 (#1574)

Full Changelog: v1.24.0...v1.24.1

What's Changed

• Use proper $host for FastCGI SERVER_NAME param by @strarsis in #1552
• Fix Python string escape sequences by @swalkinshaw in #1554
• Mitigate REST API cache poisoning via Method Override by @AltanS in #1556
• Update dependency ntp to v2.7.0 by @renovate in #1553
• Update dependency swapfile to v2.0.42 by @renovate in #1549
• 🔧 FastCGI Cache: Stop ignoring Cache-Control headers by @retlehs in #1555
• Update build-before.yml for Sage 11 by @retlehs in #1559
• 🔧 PHP 8.4 support by @retlehs in #1560
• Remove Let's Encrypt contact email support by @swalkinshaw in #1558
• Remove OCSP stapling by @swalkinshaw in #1557
• Remove "production" from asset compilation titles by @joshuafredrickson in #1566
• 🩹 Add retry to adding PPA's by @retlehs in #1568
• Refactor PHP role to support future versions by default by @dalepgrant in #1511
• Flush rewrite rules at the end of each deploy by @joshuafredrickson in #1567
• Replace link for creating CSP by @Dyras in #1564

New Contributors

• @AltanS made their first contribution in #1556

Full Changelog: v1.23.0...v1.24.0

What's Changed

• Ubuntu 24.04 support by @retlehs (#1519)
• Update WP-CLI to v2.11.0 by @retlehs (#1533)
• Update MariaDB to 10.11 by @retlehs (#1520)
• Fix undefined method exists? error by @1dkfa (#1524)
• Do not run Composer as root/super user! by @adleviton (#1527)
• Use http2 and http3 nginx directives by @strarsis (#1529)
• Update dependency composer to v1.9.2 by @renovate (#1539)
• Update dependency swapfile to v2.0.38 by @renovate (#1540)
• Update dependency ntp to v2.5.0 by @renovate (#1541)
• Conditionally add HTTPS inbound allow firewall rule by @strarsis (#1530)
• Fix tags for common variable validations by @swalkinshaw (#1544)
• Allow overriding "pm" PHP-FPM's pool config by @gutobenn (#1542)

New Contributors

• @Dyras made their first contribution (#1522)
• @1dkfa made their first contribution (#1524)
• @adleviton made their first contribution (#1527)
• @gutobenn made their first contribution (#1543)

Full Changelog: v1.22.1...v1.23.0