v0.9.0

0.9.0 (2026-09-29)

⚠ BREAKING CHANGES

• cms: under https the session cookie is renamed to __Host-geekity_session, so every signed-in user is signed out once after upgrading, with a notice on the login form.
• cms: ConversationContext now requires contentDir, so a direct caller of createConversation must pass the site's content directory.

Features

• cms: harden the admin session cookie, cross-site checks and logout (de7255f)
• cms: remove commenter and contact data past retention, erase on request (c35b3c4)
• cms: scaffold a starter privacy page linked from the footer (ad7f05f)
• cms: send public security headers that do not constrain themes (a5f9e66)
• cms: serve remote avatars from the site to keep readers private (8916062)
• cms: serve security.txt and change-password well-known urls (4119d5f)
• cms: show approved fediverse quotes of a post as mentions (685703b)