gosite 0.68.0

Includes 0.66.0 and 0.67.0, which were not published as releases.

0.68.0

Analytics: Meta Pixel and store events

• Added: Meta Pixel (meta-pixel, { "pixelId": "..." }, 15 to 20 digits),
  in the marketing category. Nothing from Meta loads, and no _fbp/_fbc
  cookie is written, before marketing consent; withdrawing it clears them. No
  <noscript> image. Offered on thin sites only: a legacy CMS does not list it.
• Added: store events. With Commerce, the product page, add to cart,
  checkout and confirmation send ViewContent, AddToCart,
  InitiateCheckout and Purchase (value, currency, variant ids, item count,
  order id) through analytics.track(), so every enabled provider gets them
  under its own consent. Purchase goes once per order in a browser session,
  with the order id as Meta's eventID.
• Changed: no replay after a late accept. An event raised before the
  visitor answered the banner is dropped, also when they accept later on the
  same page. Before, page-code analytics.track() calls were replayed. This
  applies to every provider.
• Changed: the GTM key in the README is containerId, as the code always
  had it, and an extra config key is kept and named on the Analytics screen,
  as the code did.
• Upgrade (thin sites): gosite generate (adds the gosite.layout marker
  to cockpit/config.core.php), rebuild the CMS image, and update the core
  module (go get github.com/Avanxo-Technology/gosite-cli/core@v0.68.0).
  A theme that replaces the product, checkout or confirmation page must keep
  the new data-analytics-event block.

0.67.0

Replica: protected content and comparison between instances

• Added: protected content per instance. The Replica screen has a
  Protected content card with one switch per content model. A protected
  model refuses every replication write (entries and definitions), whoever
  sends it; local editing and reading are not affected. Nothing is protected by
  default. Each change is in the activity log.
• Added: a push skips protected models and continues. The destination's
  manifest lists them; they are counted as protected, not as errors. A pull
  does not write into a model protected on the local instance.
• Added: replica:diff and the Compare view. Read-only, per entry: only
  here, changed here, changed there, only there, same. Sameness is a hash of
  the content, so a re-save without changes is same.
• Added: push a selection. replica:push <target> <model> --ids=a,b, or
  tick entries in the Compare view.
• Changed: identical entries are skipped as same, in the dry run and in
  the real run, so a run reports what its dry run planned. Against a 1.0.0
  destination the real run still rewrites them.
• Fixed: singletons pair by model. Each instance creates its own singleton
  (for example analyticsConsent), so the two sides had different ids: a push
  left two documents on the destination and the site read either one. A push
  or pull now replaces the destination's singleton, and the next push merges a
  duplicate left by 1.0.0.
• Fixed: a push to a plain Cockpit no longer fails on an empty singleton.
  Its 404 stopped the whole run.
• Upgrade: Replica goes to 1.1.0 and is baked into the CMS image, so rebuild
  the CMS of each site that uses it. Upgrade the destination before the source:
  a 1.0.0 source that pushes to a protected model fails that run with a
  "protected" message and writes nothing for the model; a 1.0.0 destination has
  no protection, and every push says so.

0.66.0

Mailer: send an order's e-mails to the address the buyer chose

• Added: the recipient "The order's receipt address" (order_receipt).
  It sends to the addresses in the order's metadata.receipt_email (one or
  more, separated by commas; invalid ones are dropped), and to the order's
  e-mail when the key is missing or holds none. A checkout can ask the buyer
  where the purchase details go without changing the order's e-mail.
  A migration adds the value to mailer_rule.recipient.
• See gosite docs medusa-mailer.

gosite 0.65.5

Releases 0.65.0 through 0.65.5. No tags existed for 0.65.x before this release, so none of these versions were installable from a tag.

0.65.5

Cache keys carry the environment

• Changed: cache keys include APP_ENV. The page, blog, SEO and purge keys
  are <project>:<env>:cache:. Production and QA sharing one Redis no longer
  read or purge each other's pages. With APP_ENV empty the prefix is
  unchanged. The cache rebuilds after the deploy; app state keys do not move.
  See MIGRATIONS.md, "0.65.5".
• Added: seo.WithCachePrefix. Takes the full cache prefix from
  config.CacheKeyPrefix(). WithProject stays for existing callers.

0.65.4

Analytics: one provider loads once, in a stable order

• Changed: integrations are read in a stable order. Entries sort by provider,
  then by _id, so "the first entry" is the same on every request.
• Added: a duplicate provider is skipped. When two enabled entries for one
  provider both apply to this deployment, the first loads and the rest are
  logged as a warning. This runs in the Go core, so it protects every site that
  takes this core release, whatever the addon version.

0.65.3

S3 uploads are private by default

• Changed: S3_ACL controls the ACL. Uploads send no ACL unless S3_ACL is
  true, yes, 1 or on (any letter case). The old default public-read
  failed on buckets where ACLs are disabled, and the upload reported success
  with no stored asset. See MIGRATIONS.md, "0.65.3".
• Added: gosite_env_flag() in both Cockpit config files. One reader for
  boolean environment variables, with a test in tests/thin.bats.

0.65.0

Forms: a webhook body Mattermost accepts, and a default for every form

• Added: webhookFormat on Form settings. json (the original flat body,
  unchanged and still the default), mattermost (an incoming-webhook message,
  {text, attachments}) or none. Mattermost and Slack answer 400 to the flat
  body, and the addon only logs that, so a form pointed at a chat hook looked
  configured and delivered nothing. An unknown value falls back to json.
  The mattermost body carries only the submitted fields: no IP, no user agent.
• Added: a default webhook for every form, from FORMS_WEBHOOK_URL,
  FORMS_WEBHOOK_FORMAT and FORMS_WEBHOOK_SECRET on the CMS service, so a
  form created later inherits it. A form's own webhook / webhookFormat wins;
  webhookFormat: none opts one form out. All three are empty in new sites.
• Fixed: Forms model migrations never ran after the first request. A
  boolean in app memory skipped ensureModels(), so a field added to
  formSettings never reached an existing site and Content dropped it on save.
  The addon now compares a MODELS_VERSION.
• Existing sites: see MIGRATIONS.md, "0.65.0 — Forms webhook format".

gosite 0.64.0

gosite 0.64.0

Source archive of the CLI (src/) at main.

Changes since 0.63.0

• PostHog session recording switch in the Analytics addon: the entry has a Record sessions switch that sets session_recording for the browser.
• One PostHog plugin per provider: the browser mounts only the first of two entries of the same provider, and both entries get an admin warning when they overlap in environment. Two plugins used to break all analytics on the page.

Related

• core/v0.57.3 carries the same src/addons source for sites that pin the core addon.

gosite 0.63.0

gosite 0.63.0

Source archive of the CLI (src/) at tag v0.63.0.

Changes since 0.60.0 in the CLI

• Fix: locks hold under uutils mkdir (0.62.1).

Related work in the repository (not in the CLI archive)

• Medusa storefront features in services/medusa: sign-in by e-mail code, local delivery priced by area and weight, local delivery by map point, and bulk orders.

Verify the download against gosite-0.63.0.tar.gz.sha256 before installing manually. gosite update checks it automatically.

gosite 0.60.0 — gosite versions

Image versions: gosite versions

• Added: gosite versions local|prod. Compares every image reference with
  the newest Docker Hub tag in the same line. Read-only by default.
  • local covers the shared infrastructure compose and each project's
    docker-compose.yml, deploy/Dockerfile.dev and deploy/Dockerfile.cms.
  • prod covers docker-compose.prod.yml, docker-compose.qa.yml,
    deploy/Dockerfile and deploy/Dockerfile.cms in each registered project.
    The repository is the source of truth for these files.
• Added: gosite versions prod --patch DIR. Writes one unified diff per
  file for updates inside the current major.minor line. Diff paths are relative
  to the project, so git apply works from the project directory. Minor and
  major updates are reported but never written.
• Added: --strict. Exits non-zero when any reference is not current, for
  use in a pre-deploy check.
• Status values: current, patch, minor, major, floating (no version
  in the tag), unknown and unchecked (registry other than Docker Hub, or the
  API could not be reached). Variant tags such as -windowsservercore or
  -alpine3.24 are never compared with the plain tag.
• Known limit: Docker Hub returns at most 100 tags per name prefix. A repository
  with many matching tags (for example golang under 1) can hide a newer tag;
  the check does not detect that case.
• No change to generated sites and no runtime change. Nothing is applied
  automatically.

gosite 0.57.0

Agent context: AGENTS.md, CLAUDE.md and gosite docs

• Added: gosite docs [topic]. Lists the agent notes shipped with the CLI
  (src/knowledge/) or prints one. Inside a site it also says on stderr when
  the site was made by another gosite version.
• Added to new sites: AGENTS.md and CLAUDE.md (imports AGENTS.md), for
  thin and legacy scaffolds. The repository gets a pull request template with a
  Proof section.
• Changed in this repository and both scaffolds: MEMORY.md is renamed to
  AGENTS.md, which Claude Code (through CLAUDE.md), OpenCode and omp load on
  every turn. The legacy AGENTS.md is trimmed to under 80 lines; its detail
  (the rules, common tasks and Cockpit addons) moved to ARCHITECTURE.md.
• Existing sites: see MIGRATIONS.md, "0.57.0 — agent context". No runtime file
  changes.

gosite 0.56.0

Commerce: images in the bucket, the Admin in QA and production

• Product images are stored in the site's bucket. Medusa reads the same
  S3_* variables as the CMS and uploads to medusa/ under S3_PREFIX (QA:
  qa/medusa/ by default), in dev, QA and production. Before, an upload from
  the Admin or /admin/uploads stayed inside the container (lost on every
  deploy) with a localhost:9000 URL. Without STORAGE_ADAPTER=s3 Medusa
  keeps its local provider; S3_PUBLIC_URL is required with S3.
• shop.<domain> in QA and production. The Medusa service gets a Traefik
  router on SERVICE_FQDN_SHOP for /app, /admin, /auth and /hooks
  only (payment webhooks included); /store stays internal. Router names
  follow the QA/production rule (<project>-qa-shop / <project>-shop).
  Verified that the Admin signs in on its own origin without ADMIN_CORS.
• Existing Commerce sites: see MIGRATIONS.md (Coolify needs
  SERVICE_FQDN_SHOP; images uploaded before this release are gone).

gosite 0.55.2

• Fix: the store pages answered 502 on every real store. Medusa v2 sends a
  variant's options as a list of option values; core decoded them as a map, so
  /tienda, /producto/:handle and the buy island failed as soon as Medusa
  returned a product (the seed's demo product included). Sites get the fix by
  moving core: and go.mod to 0.55.2. The test fixture is now a real Medusa
  2.21 response.
• Knowledge: src/knowledge/medusa-admin-api.md. How to load a catalogue
  through Medusa's Admin API (by script or AI): the Secret API Key and its
  Basic-auth form, the gosite sales channel, variants, prices in the major
  unit, stock levels, idempotent updates by handle. New sites' MEMORY.md
  points to it.
• Known issue: images uploaded to Medusa (Admin UI or /admin/uploads)
  are stored inside the container and get a localhost:9000 URL, so they are
  lost on redeploy. Use image URLs from the site's own storage until uploads
  go to MinIO.

gosite 0.55.1

• gosite list shows the store. A site with the Commerce addon gets a
  third status dot (its Medusa container) and a Shop: line with the Medusa
  Admin URL, https://shop.<domain>/app.
• gosite-medusa is published. Every vX.Y.Z release now pushes
  ghcr.io/avanxo-technology/gosite-medusa:X.Y.Z (amd64 + arm64), so sites
  pull the store engine instead of building it; 0.55.0 was published after the
  fact. The Medusa inside is recorded as the image label
  dev.avanxo.medusa.version. Dependabot proposes @medusajs/* upgrades
  weekly as one PR.
• Medusa 2.21.0 → 2.21.2 in gosite-medusa:0.55.1. Checked on a fresh
  store, a restart and a 2.21.0 store upgraded in place (its migration
  create-super-admin-role runs; the seed reuses every record).

gosite 0.55.0 — Commerce (preview) and SMTP for the CMS

Cockpit sends e-mail over SMTP. Cockpit had no mailer config and fell back to PHP mail(), which the CMS image cannot deliver, so Forms notifications never arrived (the submission was always stored). SMTP_HOST now switches it to SMTP, with SMTP_PORT (587), SMTP_ENCRYPTION (tls / ssl / none), SMTP_USER, SMTP_PASSWORD, SMTP_FROM and SMTP_FROM_NAME. The dev, QA and prod composes pass them to the CMS, empty by default. Without SMTP_HOST, nothing changes.

Commerce: a store per site (preview). A new optional addon for thin sites: its own Medusa v2 per site and environment, with Postgres and Redis on an internal network; a server-rendered storefront in core (listing, detail, cart, guest checkout); Wompi and manual payments. gosite addons add Commerce <site> requires commerce_region: co|us.

It is a preview because the build on Coolify, the Traefik labels for shop.<domain>, and Wompi refunds against the sandbox remain unverified, and Stripe is not implemented.

Existing sites: nothing is required. Thin sites get SMTP on the next gosite generate; for legacy sites, see MIGRATIONS.md → 0.55.0.

Tagged core/v0.55.0 on the same commit. Details in CHANGELOG.md.