roots/trellis v1.32.2

on GitHub

What's Changed

Disable PHP session upload progress by default

PHP recommends keeping session.upload_progress.enabled off. The CVE-2026-109619 advisory recommends disabling it even after patching, and the PHP Foundation recommends keeping it off until the next PHP release to block another vector (CVE-2026-115560). WordPress doesn't use this feature.

Trellis now sets it to Off by default. If you need it, set php_session_upload_progress_enabled: 'On'. (#1697)

PHP-FPM now also reloads when its php.ini changes, so changes to PHP settings like upload_max_filesize take effect without a manual restart.

To apply on existing servers:

trellis provision --tags php production

If you haven't upgraded PHP for the October 21 security release yet, do both in one step:

trellis provision --extra-vars apt_package_state=latest --tags php production

Then restart PHP-FPM on the server (e.g. sudo service php8.4-fpm restart) and confirm the version with php -v.

Full Changelog: v1.32.1...v1.32.2