v1.64.0

What's Changed

Added

• $breeze_skip_server_headers (default true, a named exception in
  AGENTS.md). Breeze pings the site's own home URL, saves every allowed header
  it sees under breeze_custom_headers, and replays the list on each cache
  hit. A header the web server also sends then appears twice. The kit removes
  the server's headers from Breeze's list (breeze_custom_headers_allow). The
  names follow $security_headers. Off: the theme sends none, so the kit drops
  the managed set without Permissions-Policy. On: nothing is dropped. The
  timber_kit_breeze_server_headers filter can change the resolved list. A
  Breeze config written before the filter still holds the headers, because a
  purge does not rewrite it. The kit rebuilds it once, after the response,
  from a front-end request only. It never rebuilds from WP-CLI, cron,
  wp-admin, the login page, AJAX or REST, so a deploy in maintenance mode
  cannot make Breeze save an empty list. Set the flag to false to keep
  Breeze's own list and restore its config. A header that only PHP sends must
  not be dropped: on a hit PHP does not run.

Pull Requests

• #225 — feat(breeze): keep headers the web server sends out of Breeze's replay list

Full Changelog: v1.63.1...v1.64.0