v0.29.0

CHANGELOG.md

@@ -4,6 +4,18 @@
 > test-only changes and packaging implementation notes were moved to
 > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md).
 
+## 0.29.0
+- Group vhost hostnames and WWW redirect controls in Frontends. Each exact domain shows both redirect directions as selectable source → destination cards, even while redirects are off. Implicit `www.` targets are supported without adding an extra hostname. Other aliases continue serving the same application without cross-domain redirects; wildcard targets are excluded.
+
+- Add one-click per-vhost canonical www/non-www redirection. The first exact DNS hostname is canonical and its companion hostname redirects permanently while retaining the request target; Force SSL and canonicalization collapse into one redirect where possible.
+- Add a dedicated Custom location Redirect action with configurable permanent/temporary status, absolute HTTP(S) target, optional capture rewrite regex and query preservation.
+- Default HTTP health-check `Host` to the first exact vhost DNS hostname when no explicit health-check Host override is configured.
+- Add an opt-in per-vhost forced-cache target list for narrowly scoped URLs that must be cacheable despite request query/Cookie/Authorization/client-cache directives. Response `Set-Cookie`, `private`, `no-store` and other response-side safety exclusions still block storage, and credential/cookie values remain representation variants.
+- Read bounded logrotate `.gz` access/error/per-vhost log rotations from Stored Logs without accepting arbitrary filesystem paths or unbounded decompression.
+- Cover static maintenance HTML returned with an explicit status such as `503 Service Unavailable`.
+- Preserve valid nested-URL query strings end to end and retain rejection of literal/encoded backslashes and other ambiguous path encodings.
+- Keep SQLite schema 9, saved-configuration compatibility and Cold Cache format 3 unchanged.
+
 ## 0.28.2
 
 - Harden external certificate-file loading for Certbot/system-managed PEMs without requiring an exact chmod. POSIX ACL read access and group-readable private keys are supported; private keys still reject world-read and all external certificate/key files reject group/world-write.