BOA-5.88.822 — Clarity Edition

BOA-5.88.822 PRO/LTS is the Clarity Edition — 174 commits across three repositories (boa 164, provision 9, hosting_custom_settings 1), a combined feature and bugfix release. Everything in it ships in both PRO and LTS; no action is required beyond the ordinary upgrade.

Why "Clarity"? BOA has always had a second, hidden layer of configuration: small marker files whose mere presence switched behaviour on, documented nowhere. This release converts thirty-five of them into named, documented settings in the one file operators already edit, /root/.barracuda.cnf. Every switch now has a name, a one-line explanation, and a default you can see. Existing servers convert themselves automatically on the next upgrade, with a record of what was converted — and until the old markers are retired in a future release, a marker still wins while it exists, so nothing changes on a server you leave alone.

Security this cycle is real but undramatic. All four maintained PHP branches move to their current upstream security releases (8.2.33, 8.3.33, 8.4.24, 8.5.9) — and because BOA now ships them as prebuilt packages, the new builds install in moments during the ordinary upgrade instead of compiling for the better part of an hour. Every site keeps the PHP version pinned for it. On Devuan Excalibur, a kernel security update arrives the same calm way: staged automatically by the security-updates channel and activated only through BOA's graceful boa reboot flow, so nothing restarts by surprise.

The protection layer learns three new tricks. Firewall temporary bans can no longer be crowded out of memory mid-flood, so a distributed attack stays banned. The adaptive defences now treat IPv6 exactly like IPv4 — including the standing exemption for legitimate search crawlers. And coordinated content harvesting — scraping spread across many quiet addresses that no per-IP limit can see — is now detected and reported with evidence. Alongside these, web requests get a 30-second cap on database query time, so one runaway query cannot stall a site; command-line work keeps unlimited time, and any site can adjust its own cap.

Backdrop CMS support takes a real step forward. Backdrop core is now packaged, versioned and delivered exactly like the Drupal cores, and its contrib layer moves to the same shared, symlinked bundle model — one pinned store linked into every Backdrop platform and refreshed on every upgrade. The practical win: the cache integration is now updatable in place across all Backdrop platforms, instead of being frozen into each one at build time.

The self-healing suite grows judgement. Watchdogs now confirm a fault is real before acting on it: a transient database blip is ridden out instead of answered with a full restart and a cold cache, and a genuine outage is repaired at the database alone rather than the whole stack. A memory emergency is answered by freeing the single largest safe process — never your sites, never the database, never a running backup. Repairs that start repeating latch themselves off and say why. The result is fewer interruptions, and one clear alert per incident instead of a stream.

Drupal 7 background-batch storms are handled at both ends. A site driving batches against its own address can saturate a server in a way no firewall can ban. BOA now refuses the flood at the web-server edge before it costs anything (measured on a live storm shape: 386 requests/second attempted, 5.6 admitted), and a new monitor can clear a storm already under way by removing only the batch it has proven dead — restarting nothing.

Migrations get materially safer. Accounts now arrive at the new server as themselves — identity, per-site PHP versions, credentials and suspension state all carried automatically. Operators declare per account what happens to the old address (temporary, permanent, or HA switch), customers get a truthful notice about it, and a certificate mirror keeps long-lived proxies serving valid HTTPS. Whole-server cutovers no longer lock the source database during large file transfers, and every abort path explains how to put the source back.

Database tuning stops estimating and starts measuring. A log-only sensor accumulates each server's own evidence, the tuning advisor turns it into exact configuration lines — and applies nothing itself — and the SQL memory budget follows the dataset a server actually hosts rather than a fixed slice of its RAM. Seven optional pins let an operator override exactly one derived value without giving up managed configuration.

And a fix worth naming on its own: one-time login links on Drupal 7 sites — drush uli and the links the panel mints — had regressed and are now dependable again, restored with a stable pinned salt that later configuration changes cannot invalidate.

Also in this release: Drupal 11.4.4 as a full dev/stage/prod platform triple, Unbound in the prebuilt package set, search-crawler access restored across sitemaps, feeds, assets and multilingual paths, and the leftover Import/Purge panel tasks opened to standard roles. The complete technical index is in the CHANGELOG.

Component Versions

Upgrade Instructions

Run inside a screen session as root:

screen
wget -qO- https://files.boa.io/BOA.sh.txt | bash
barracuda up-lts
octopus up-lts all force
boa reboot

Silent, logged variant (emailed on completion — useful for cron):

screen
wget -qO- https://files.boa.io/BOA.sh.txt | bash
barracuda up-lts log
octopus up-lts all force log

Full upgrade documentation: https://docs.boa.io/operating/os-lifecycle/manual-boa-upgrade

Links

• Documentation: https://docs.boa.io
• News & announcements: https://omega8.cc/news
• Full changelog: https://github.com/omega8cc/boa/blob/5.x-dev/CHANGELOG.txt
• Commit history: https://github.com/omega8cc/boa/commits/5.x-dev/