v0.18.0

0.18.0 (2026-10-03)

⚠ BREAKING CHANGES

• cms: the isPublicDocument export is removed; use isServed for whether a document has a public URL and isListed for whether the site lists it.

Features

• cms: accept a post's location and add settings > privacy to decide what is shared (a186370)
• cms: accept everything quill's note, article and media flows send (4186943)
• cms: create an access token from connected apps (f6340c1)
• cms: let listed apps sign in without pkce (d38685b)
• cms: list each post type's properties in micropub q=config (732058f)
• cms: post-type property lists in q=config and access tokens from connected apps (5c9b28d)
• cms: read posts with read-of and read-status from micropub and the editor (e29f524)
• cms: strip upload metadata, photos in feeds, and location with a privacy page (2afd371)
• cms: support quill and let listed apps sign in without pkce (4015b55)
• cms: unlisted posts, served at their url and left out of every list (51cdb1b)

Bug Fixes

• cms: answer 400 when a token-less form body cannot be read (5c47c39)
• cms: answer 404 for a post object on a site with no accounts (c41f2d2)
• cms: carry a post's photos in the rss, atom and json feeds (ac08e46)
• cms: harden how micropub reads a request body (f417f5c)
• cms: keep a read post's line, summary and webmention in step with the read (d17198d)
• cms: leave unlisted posts out of eleventy collections (cb5802e)
• cms: print relative body urls absolute in feeds (22f2185)
• cms: print relative body urls absolute in feeds (fd3a333)
• cms: refuse an oversized micropub create before reading its body (9896756)
• cms: strip location and camera metadata from uploads (0b0d68b)
• cms: unlisted posts in eleventy, a 404 for objects with no accounts, and read post gaps (1aefd24)