Skip to content

v2026.10.31

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Oct 10:23
· 88 commits to beta since this release
v2026.10.31
7bdbf00

Added

  • site-id for the publish action and --site-id for the CLI, and the
    site id on the Deploy tab and in the API.
  • A group admin can change a group's name and a site admin a site's title,
    on the group's and the site's Settings tab, saved without a button. The
    audit log keeps the previous name or title.

Changed

  • A new repository link requires the site id, and so does every existing
    link of a repository that is linked to several sites: a workflow of such
    a repository publishes again once it names the site id. Other existing
    links keep working without it until another repository is linked or a
    site admin requires it.
  • Versions are stored under the site's id, so a site created again under a
    deleted name starts empty. The upgrade moves the existing directories and
    needs the content volume. After it, the previous image no longer starts.
  • The summary under an access choice no longer repeats the option just
    chosen, on a site's Access tab, in the publish sheet and for a group's
    default access. A warning says when nobody can view the site, and the
    publish sheet only says what happens after publishing.
  • On a group's Settings tab the secret links and invitees switches of the
    default access sit under their own "Uitzonderingen" heading.
  • The What's new page no longer opens with the version you use; the footer
    shows it.
  • The root of the content host redirects to the landing page of the admin
    environment, which now also says where the name comes from and lets a
    visitor without an account switch between Dutch and English.
  • The header of the API docs uses the colours, wordmark and text sizes of the
    admin environment, in light and in dark mode.
  • The admin environment uses the system font instead of RijksSans, which is
    licensed for Rijksoverheid publications only.
  • On ZAD the content volume is 10Gi and a site may again hold 500 MiB
    across all its versions, the PLAK_SITE_MAX_BYTES default.
  • The image runs Python 3.15 on Debian 13 (trixie), without pip.
  • Deleting a site moved from the site's Overview tab to its new Settings tab.

Fixed

  • Production runs the image its release names. It ran a build of the same
    commit without its version, so the footer showed "Wat is er nieuw"
    instead of the version.
  • Files left behind by an interrupted publish, cleanup or delete no longer
    count against a site's storage quota: the nightly cleanup sets them aside
    and removes them a week later.
  • A lone surrogate in a group name, site title, identifier, secret link
    label or audit lookup reason is refused with a 422 instead of a server
    error.

Security

  • On the content host a HEAD request gets the headers of the GET instead
    of a 405, under the same gate and audit, so link checkers and monitors
    see what a browser sees. The admin host and the login paths are
    unchanged.
  • The image patches OpenSSL (CVE-2026-84782) and moves certifi to
    2026.10.23 (PYSEC-2026-4320), also in the CLI; the SPA builds with
    vite 8.3.5 and undici 8.12.3.
  • joserfc moves to 1.7.7, which rejects an oversized token before it
    splits it (GHSA-9pg5-8c7x-5hfx).
  • pyasn1 moves to 0.6.5 (CVE-2026-119194, CVE-2026-119195, CVE-2026-119196,
    CVE-2026-119197).
  • The SPA's tests run with glob 14.0.3 (GHSA-3g3m-2fjr-6pw4) and minimatch
    11.0.3 (GHSA-g3hv-75wg-m249).
  • A page never sees a secret link that was not meant for it: Plak takes a
    key in the shape of a secret link out of the address before it answers,
    also one a mail client cut short and also on a refusal, and refuses
    service worker scripts, which could read a link before Plak does.
  • A workflow that names its site id publishes only to that site: Plak
    accepts a CI token bound to it, so a renamed, deleted or mistyped
    address can no longer send its build to someone else's site.

CLI 2026.10.31

Plugin 2026.10.31

API 1.2.0

Container image

  • plak: ghcr.io/digigilde/plak:2026.10.31, digest sha256:c56af18fd66f34526e589d8cb21503408dcea0b10ebcff61a606ec2e163a4204

Verify where it was built: gh attestation verify oci://ghcr.io/digigilde/plak@sha256:c56af18fd66f34526e589d8cb21503408dcea0b10ebcff61a606ec2e163a4204 -R DigiGilde/plak
Its SBOM (CycloneDX): the same command with --predicate-type https://cyclonedx.org/bom

Assets 2
Loading