v1.63.0

What's Changed

Added

• Site Health check security_headers_single_on_cache_hit
  (Breeze\Health\SecurityHeadersSingleOnCacheHit, category security,
  needs $site_health). It is registered only when Breeze is active, and it
  does not depend on $security_headers. It sends three anonymous GET
  requests to the home URL: one with a random query (a cache miss), then the
  plain URL twice, so the last one can be a cache hit. It counts each managed
  security header on the miss and on the hit, as repeated lines and as a value
  repeated inside one comma-joined line. A header with exactly one copy on the
  miss and two or more on the hit is recommended. The message names Breeze
  as the likely source and gives a breeze_custom_headers_allow filter that
  drops those headers from what Breeze saves. A header absent on the miss and
  repeated on the hit is named separately, with no filter, because the cache
  file is its only source. A hit that cannot be confirmed (no
  x-cache with HIT, no Age above 0, no Breeze Cache-Provider for a
  cached file), a failed request or a non-2xx answer is recommended
  ("could not verify"), never critical. Detection and advice only.

• Site Health check breadcrumb_list_rendered (Health\Check\BreadcrumbListRendered,
  category seo, needs $site_health). It is registered only while
  $seo_suppress_plugin_breadcrumb removes the SEO plugin's BreadcrumbList:
  the flag is true, an SEO plugin is detected, and the plugin's own breadcrumb
  switch is not on. It sends one anonymous GET to the newest published post
  of the first public post type that has one. It never requests the home page,
  the static front page or the posts page. A JSON-LD node whose @type is or
  contains BreadcrumbList or http(s)://schema.org/BreadcrumbList (top
  level, a list, @graph or nested), or a microdata element with itemscope
  and the schema.org BreadcrumbList URL among its itemtype tokens, is
  good. The word in a string value or in text does not count, and an invalid
  JSON-LD block is skipped. Markup inside an HTML comment or inside a script,
  style or textarea element does not count. No list is recommended and names both
  fixes: render a breadcrumb in the theme, or set
  $seo_suppress_plugin_breadcrumb = false. A failed loopback or a status
  other than 200 is recommended ("could not verify"), never critical. The
  request does not follow redirects. With no published post, the check sends
  no request and reports good. No new flag.

• Seo\BreadcrumbSchema::resolve() returns the running SEO plugin and its own
  breadcrumb switch. boot() now uses it.

• Integration test tier: tests/Integration/, phpunit.integration.xml and composer test:integration. It runs the kit against real WordPress 7.1.1 (core test library from wp-phpunit/wp-phpunit, core from roots/wordpress-no-content, both pinned) and a real database. First tests: the REST page search with the search filter hooked, the frontend search main query, a secondary search query, the filter wiring with $disable_search on, and the flag-gated Site Health check. Without a database the suite skips. A new CI job runs it on PHP 8.3 with a MariaDB service. Test-only: nothing under src/ changes (#217).

Changed

• package_assets_reachable probes the sidebar script
  (assets/js/gutenberg-resizable-sidebar.js) as well as the stylesheet. A host
  rule that denies .js and allows .css no longer passes the check. The result
  is good only when both files answer 200. The message names each file that
  failed. A blocked file (403 or 404) wins over a file that could not be
  verified, and the message names both. PackageAssetsReachable takes one or
  more URLs (string $url, string ...$urls), so a call with one URL still works.
• package_assets_reachable runs the GET fallback only when HEAD answers
  403, 404, 405 or 501. A transport error or any other status on HEAD ends
  that file's probe as "could not verify". A host that times out now costs one
  5 second wait per file, not two. A HEAD that answers 3xx or 5xx gets no
  GET retry. Those answers already ended as "could not verify".

Pull Requests

• #218 — fix(health): probe the sidebar script and narrow the GET fallback
• #219 — feat(health): report a page that loses its BreadcrumbList to the suppression
• #220 — feat(health): report security headers that a Breeze cache hit repeats
• #222 — test: add an integration test tier that runs the kit against real WordPress

Full Changelog: v1.62.0...v1.63.0