v0.27.3

CHANGELOG.md

@@ -4,6 +4,22 @@
 > test-only changes and packaging implementation notes were moved to
 > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md).
 
+## 0.27.3
+
+- Fix managed Certbot validation and execution: Certbot 5.8.0 is a console-script application and does not provide `certbot.__main__`, so `python -m certbot` incorrectly failed validation. Managed ACME now executes the final `acme-python/bin/certbot` entry point directly; 0.27.3 creates/rebuilds the environment at its final path so the console-script shebang is valid.
+
+- Improve managed ACME bootstrap on systems with Python/pip but restricted `venv`/PEP 668 behavior: keep installation private, retry the application-local `virtualenv` bootstrap safely when required, and report whether failure happened during environment creation, pip preparation, Certbot installation or validation.
+
+- Separate application-coupled Python scripts into `scripts/runtime`, `scripts/build`, `scripts/deploy` and `scripts/migration`; move QA/dev/audit helpers to `tools/` and platform-specific OPNsense/RouterOS helpers to `integrations/`, with all entry points and release checks updated.
+
+- Fix HTTP/3 `HEAD` cache handling by running the same bounded empty-request-body probe used for `GET`; HTTP/2 and HTTP/3 now apply the same cache semantics instead of treating an unpolled H3 body stream as `request_body`.
+- Reduce persistent COLD-cache index RAM by dropping per-entry `HeaderMap`/validator copies, removing the duplicate key, and storing the SHA-256 digest as 32 bytes. Existing `.json`/`.body` files remain format-compatible; headers and validators are validated and loaded only when a COLD object is actually read.
+- Reduce rate-limit RAM and stale-IP retention by grouping client buckets under one vhost string, sweeping expired fixed-window buckets during requests and periodic maintenance, and shrinking sparse hash tables before allocator trimming. Active fixed-window behavior and the 65,536-client hard bound are unchanged.
+- Exclude rebuildable `acme-python` and `acme_python` managed runtime directories from backups.
+- Confirm response compression remains streaming, uses `CompressionLevel::Fastest`, and does not aggregate complete response bodies; memory use scales with concurrently compressed responses rather than retained cache objects.
+- Promote `https://rustproxy.linuxiarz.pl/` (DEB/RPM) and `https://rustproxy-opn.linuxiarz.pl/` (OPNsense plugin) as the official documented installation/update paths; keep Debian source build/update as an optional path.
+- Keep SQLite schema 8, saved configuration compatibility and the COLD on-disk format unchanged.
+
 ## 0.27.2
 
 - Fix managed ACME issuance/renewal after the 0.27.1 private-Python change: Certbot is now launched through the final managed interpreter (`acme-python/bin/python -m certbot`) instead of the pip console script whose absolute shebang still referenced the temporary `acme-python.installing` path after the atomic directory rename.