1.5.0

Security

Upgrade recommended. These affect hosted editors where the editor account is less trusted than the site's code.

• Content paths are validated. Collection names must be declared collections, slugs must be plain relative paths, and every resolved file must stay inside its collection (symlinks included). Previously an encoded collection name could read, write or delete .json/.md files elsewhere in the project, and the collections API could list arbitrary folders.
• Git routes stay inside the content and image paths. The diff route no longer covers the whole project when no file is given; revert and restore act on single files only; pathspecs are literal.
• Image metadata keys and file names are allowlisted (a __proto__ key could pollute the server's object prototype).
• /images and /assets require a session and are served sandboxed (Content-Security-Policy: sandbox, nosniff), so an uploaded SVG cannot run script on the admin origin.
• Cross-origin writes are refused. State-changing API requests must be same-origin (Sec-Fetch-Site / Origin). The session cookie is SameSite=Strict, but that is per site, so sibling origins such as a preview subdomain could previously post forms to the API. express.urlencoded is no longer registered.
• Server data is escaped everywhere the editor builds markup from it.
• Never runs an Astro the site did not install. The publish check, builds, astroadmin dev, the doctor and the NixOS preview unit run the site's own node_modules/astro with auto-install disabled, and refuse clearly if it is missing (bunx could fetch astro@latest).

Features

• View live site link in the editor header, following the open entry and the preview's navigation (PUBLIC_URL).
• astroadmin doctor: versioned checks for site setup and feature coverage (integration, hosted preview config, committed lockfile, publish-check blockers, sharp, the build, click-to-edit coverage and annotation names). Run astroadmin doctor [--json]; the editor also scans each publish check's build and shows a dismissible notice. See docs/doctor.md.
• Click-to-edit conventions documented in docs/inline-editing.md.

Bug Fixes

• The markdown body editor no longer truncates bodies containing </textarea> or HTML entities, and no longer drops a leading blank line on save.
• A click inside a link in the preview navigates without also focusing a field.
• Entries with nested slugs open from the entry picker and from dashboard URLs, and save to the right file.
• The live link no longer doubles a configured base path.
• NixOS module: instance units get libstdc++ so sharp (Astro's image service) can load.
• The doctor and the publish check use synchronous file reads around git and builds, working around a Bun 1.3.x issue where an fs/promises call could never settle while child processes run.