v0.1.4-alpha.1

makeitMD renders Markdown sent as a text file, and is built with a Go release
that closes ten advisories the running v0.1.2 is exposed to.

makeitMD has no test bot, so this alpha runs on the production bot. It becomes
v0.1.4 once formulas from docs/examples/formulas.md sent as a file render
correctly on Telegram Desktop, Android and iOS, or is rolled back to v0.1.2.

There is no v0.1.3. That tag was pushed by mistake on 20 October with work
that had not been reviewed, nothing was published from it, and tags here
cannot be deleted.

Added

• Markdown can be sent as a file. A UTF-8 text file of up to 128 KB gets
  the same native rich reply as pasted Markdown, whatever its extension: .md,
  .txt, .tex or none. Text is recognised by its contents, not by the name or
  MIME type Telegram reports. Captions are ignored, and a file is never joined
  to a neighbouring message. An empty, binary or non-UTF-8 file, a PDF and a
  file over the limit each get a short explanation instead. The download has
  15 seconds including getFile, retries a transient failure up to three
  times within that budget, and goes to a private temporary directory that is
  removed afterwards. Accepted files follow the existing conversion retention;
  rejected ones are not stored. In groups a file is not downloaded at all.
• How it works explains files, formulas ($...$, $$...$$ and fenced
  math) and Telegram's limits on a rich message. Formula source is passed to
  Telegram unchanged; \(...\) and \[...\] are not rewritten.

Security

• Go moves from 1.26.6 to 1.26.10 and golang.org/x/text from 0.39.0 to
  0.41.0. On v0.1.2 govulncheck finds ten advisories reachable from
  makeitMD's code, nine in the standard library (among them GO-2026-6611,
  -6612, -6613 and -6617 in net/http and HTTP/2) and GO-2026-6629 in
  x/text; on this version it finds none.

Fixed

• Inline code restored from a client's formatting kept its edge backticks and
  surrounding spaces wrong: a span starting or ending with a backtick merged
  with the delimiter, and a span with a space at both ends lost them. Both now
  come back as the person typed them.

Changed

• Rendering errors now mention Telegram’s rich-message limits as well as
  Markdown syntax. A byte download limit is not a rendered-character limit;
  documents are never silently truncated or split.
• A release waits for CI. release.yml runs ci.yml on the tagged commit
  and publishes nothing unless it passed. When CI cannot run, release.yml can
  be started by hand with the tag and a reason; that run skips CI and prints the
  reason at the top of the release notes. See docs/releases.md.
• The release notes end with the image digest to pin, which docs/releases.md
  already said they did.
• The image carries org.opencontainers.image.version and .revision labels,
  so docker inspect names the build without starting it.
• CI also runs weekly, so a new advisory against a dependency or the standard
  library is noticed while nothing is being pushed.
• Dependabot opens grouped version updates against dev.

Container image

ghcr.io/freshlabdev/makeitmd@sha256:7420a6c99ee31f171a74835ed018aca4534ab5ee63a2a8915f5b5fa55865b2d0