v2026.10.7

Security

• The container runs on a Python base image with patched Perl packages
  (CVE-2026-13221, CVE-2026-8376, CVE-2026-42496 and four more), and the
  admin build uses source-map-js 1.2.2 (GHSA-68fv-2mgg-jv7q).
• Published sites may run WebAssembly ('wasm-unsafe-eval'), so a
  Pagefind search works on a site with "Shield from other sites" off;
  JavaScript eval() stays blocked.
• A 304 carries the same content CSP and Referrer-Policy as the full
  answer, so turning a site switch or secret links on or off reaches pages
  a visitor already has in their cache.
• The front page, the code page for a secret link and the neutral 404 on
  the content host run no script and admit only their own stylesheet, by
  hash, instead of sharing the published sites' policy.

Changed

• The publish action's pull request comment calls the version it shows
  "Plak version": Plak's id for that upload, next to the commit.

CLI 2026.10.7

Plugin unchanged (2026.10.4)

API 1.1.0

Container image

• plak: ghcr.io/digigilde/plak:2026.10.7, digest sha256:11a045f3a0e6f247c95233df7e87e5882895108ced8aca0a18b22291f553b433

Verify where it was built: gh attestation verify oci://ghcr.io/digigilde/plak@sha256:11a045f3a0e6f247c95233df7e87e5882895108ced8aca0a18b22291f553b433 -R DigiGilde/plak
Its SBOM (CycloneDX): the same command with --predicate-type https://cyclonedx.org/bom