v1.14.0

1.14.0 (2026-09-23)

Features

• site: Make the site servable under a strict CSP, and serve it
• site: Publish security.txt at the URI researchers actually check
• db: Version the schema so it can change after it has data
• site: Trap form spam, and support an unauthenticated relay

Bug Fixes

• db: Make one place own the write, and prove it matches the table
• site: Forbid storing the pages that echo what someone typed
• api: Answer an unsupported method with 405, and /api/ in one shape

v1.13.1

1.13.1 (2026-09-11)

Bug Fixes

• seo: Repair the logo and supply the social and icon assets
• site: Stop the logo 500ing on the two pages that accept input

v1.13.0

1.13.0 (2026-09-10)

Features

• site: Make vigario.tech the canonical domain

Bug Fixes

• seo: Point the structured-data logo at a file that exists

v1.12.0

1.12.0 (2026-09-10)

Features

• site: Add the Jesus is Lord tagline, drop the retired org link

Build & Packaging

• Stop bundling SSR deps in dev, which broke astro dev

v1.11.0

1.11.0 (2026-09-09)

Features

• Rebuild the site on Astro, with no UI framework
• release: Build a self-contained artifact, without the build toolchain
• release: Verifiable releases — forge-signed commit, attestation, per-file manifest
• health: Prove a submission would survive, not just that a file opens

Bug Fixes

• site: Derive the notification address, and offer the source
• config: Call the validator that never ran, and enforce the never-erase rule
• release: Stop pushing the lockfile through argv

Build & Packaging

• Retire the RPM pipeline
• deps: Update dependencies to latest, except three that cannot go
• deps: Update dependencies and action majors
• deps: Bring everything current, including the release path