fix: expose dotenv variables via getenv() for WordPress library compatibility

Use createUnsafeImmutable instead of createImmutable to ensure environment
variables loaded by dotenv are available via getenv() in addition to $_ENV
and $_SERVER.

Many WordPress plugins and libraries (e.g. Wonolog) rely on getenv() and
silently fall back to defaults when the variable is missing, causing
hard-to-diagnose configuration bugs.

Thread-safety is not a concern for standard WordPress deployments using
PHP-FPM or CLI (single-threaded per request). Only affected on Apache
mod_php with MPM worker/event, which is not a typical WordPress SAPI.

Author: frugan-dev

.env.dist

@@ -1,7 +1,15 @@
+# ---------------------------
+# WP Boot
+# ---------------------------
+
 # Enable/disable WordPress sync to public directory
 # Set to 'true' to enable automatic sync via post-cmd.sh
 WP_BOOT_SYNC_ENABLED=false
 
+# ---------------------------
+# WordPress
+# ---------------------------
+
 DB_HOST=
 DB_NAME=
 DB_USER=
@@ -34,6 +42,10 @@ NONCE_SALT=''
 DISALLOW_FILE_MODS=false
 DISALLOW_FILE_EDIT=true
 
+# Disable WordPress pseudo-cron (triggered on every page request) in favor of a
+# real system cron job. Improves performance by removing per-request cron overhead.
+# Requires a cron job to be set up manually (see crontab).
+# https://roots.io/bedrock/docs/wp-cron/
 DISABLE_WP_CRON=false
 
 # false, true, minor

.github/dependabot.yml

@@ -11,7 +11,7 @@ updates:
     assignees:
       - "frugan-dev"
     commit-message:
-      prefix: "chore"
+      prefix: "deps"
       include: "scope"
     labels:
       - "dependencies"
@@ -27,7 +27,7 @@ updates:
     assignees:
       - "frugan-dev"
     commit-message:
-      prefix: "chore"
+      prefix: "ci"
       include: "scope"
     labels:
       - "dependencies"

.gitignore

@@ -5,7 +5,7 @@
 
 # Composer
 /vendor
-composer*.lock
+*.lock
 auth.json
 
 # Claude

bootstrap.php

@@ -112,7 +112,19 @@ function fixMissingEnvVars(
 $envs = array_unique(array_filter($envs));
 
 try {
-    $dotenv = Dotenv\Dotenv::createImmutable(__DIR__, $envs, false);
+    // NOTE: We use createUnsafeImmutable (not createImmutable) so that
+    // dotenv-loaded variables are also exposed via getenv() in addition
+    // to $_ENV / $_SERVER. Many WordPress plugins and libraries read
+    // configuration via getenv() and silently fall back to defaults when
+    // the variable is missing — causing hard-to-diagnose bugs.
+    //
+    // Thread-safety caveat: getenv()/putenv() are documented as not
+    // thread-safe in phpdotenv. This only matters on PHP ZTS builds with a
+    // multi-threaded SAPI (e.g. Apache mod_php with MPM worker/event).
+    // Standard PHP-FPM and CLI deployments — the expected targets for
+    // WordPress installations using wp-boot — are single-threaded per
+    // request and unaffected.
+    $dotenv = Dotenv\Dotenv::createUnsafeImmutable(__DIR__, $envs, false);
     $dotenv->load();
     $dotenv->required(['DB_HOST', 'DB_NAME', 'DB_USER', 'DB_PASSWORD']);
 } catch (Exception $e) {