v3.6.0 — Stabilize & Harden

Summary

Structural reliability release. No new features. Every change closes a security gap, eliminates an inconsistency class, or removes duplication. E2E browser-tested across 5 parallel test suites (core pages, mobile/responsive, feeds/SEO, theme/dark mode, search/contact/errors).

Highlights

• auth-fetch.js module: single source of truth for mutation fetches — CSRF injection, auth error detection, structured JSON responses
• Upload rate limiting: per-endpoint rate limit, environment-aware defaults
• CSRF enforcement: admin route group now has CSRF middleware at group level
• Content-negotiated errors: all middleware error paths return proper JSON or styled HTML
• Security fix: renderHTML no longer leaks server config (including credentials) in JSON error responses
• SEO fix: duplicate meta tags eliminated across all public pages when SEO service is enabled
• Template fix: html/template type error on canonical URL line no longer crashes page rendering

What Changed

Added

• auth-fetch.js module for centralized mutation fetches
• Upload rate limiting (20 req/5min production)
• abortWithError middleware helper for content-negotiated errors

Changed

• CSRF enforcement at admin route group level
• JS fetch consolidation (removed 6 duplicate getCSRFToken implementations)
• CSS --max-content-width design token (replaces 14 hardcoded 42rem values)
• CollectionPage JSON-LD consolidated to handler pattern
• Service worker cache version bumped to v5

Fixed

• Config leak in JSON error responses (critical security fix)
• Template crash from html/template and with mixed types
• Duplicate SEO meta tags across 9 per-page -head templates
• About page missing og:description and twitter:description
• relativeTime and timeAgo zero time guard
• admin.js CSRF gap on POST requests

Full Changelog

See CHANGELOG.md for complete details.

Full Changelog: v3.5.0...v3.6.0