v0.15.0

Everyone is signed out once when a site upgrades to this release (the session cookie is renamed, see below). After that, upgrades no longer sign anyone out.

What's Changed

• Keep sessions across restarts and container upgrades in #673 (closes #667)
• Ship no personal media; upload page heroes from the page editor in #676 (closes #669)
• Compose file and template.env: SQLite on one volume by default in #674 (closes #656)
• Document moving an existing site into GOBLOG_DATA_DIR in #675 (closes #670)

Sessions survive restarts and upgrades

Two things signed everybody out:

• The install wizard's database step rewrote .env with only the database settings, dropping the session key. The first restart after an install made a new one. The step now replaces only its own lines.
• The session cookie was named after the machine's hostname, which Docker makes up for every new container, so any upgrade that replaced the container signed everybody out. It is now always goblog_session. Changing the name is what signs everyone out this one time.

Upload a page's hero image or video

The page editor's hero field has a file input: choose an image or a video and it is uploaded and the URL and type are filled in. Until now a hero had to be a URL to a file someone had put on the server.

No personal media in the image

goblog shipped the original author's photos and two videos (63 MB), used his photo as the default landing image and his photo and video as the heroes of a fresh install's About and Writing pages. They are gone; the default landing image is a neutral placeholder at the same path.

Six templates in the default theme that nothing rendered (about, archives, posts, presentations, projects, tags) are removed along with their handlers.

Docker Compose

docker-compose.yml now runs goblog alone with SQLite and GOBLOG_DATA_DIR on a named volume, with a commented-out PostgreSQL service. It used to start MySQL and phpMyAdmin and load template.env into goblog's environment. template.env defaults to SQLite.

Upgrading

• If a page's hero is one of the removed files (/img/hero_rigolet.jpg, /img/aidecentralized.jpg, /img/jason.jpg, /img/code.jpg, /vid/redtree.mp4, /vid/mesh.mp4), upload your own copy and point the page at it before upgrading, or the hero will be broken.
• If your theme overrides one of the removed templates it keeps working; a theme that includes one of them by name would fail validation (none of the directory themes do).
• Moving an existing Docker site into a single data directory is optional; see UPGRADING.md.

Full Changelog: v0.14.0...v0.15.0

v0.14.0

Upgrade recommended for every site. This release closes two install-wizard endpoints that stayed open on installed sites (#663).

What's Changed

• Close the database wizard's endpoints once the site is installed in #663 — security
• Install without GitHub: a setup code, then an admin account with a password in #664 (closes #654, #658)
• GOBLOG_DATA_DIR: one directory for everything goblog writes in #661 (closes #653)
• A fresh install works on MySQL; install smoke test for all three databases in #652 (closes #651)
• Session cookie works over plain http on a local-network host in #672 (closes #665)
• Neutral install defaults instead of the author's personal details in #660 (closes #657)
• The wizard no longer asks for social profile URLs in #662
• The wizard no longer logs the login code and GitHub's token response in #659 (closes #655)

Security: wizard endpoints on installed sites

POST /wizard_db and POST /test_db belong to the install wizard's database step. They took no credentials and nothing turned them off once a site was installed. Both now answer 403 on a site that has a database and an admin.

Installing no longer needs a GitHub OAuth app

While a site has no admin, goblog prints a setup code to its log at startup:

GoBlog setup code: ABCD-EFGH-JKMN

The wizard asks for it before anything else, so only someone who can read the server's log can install the site. Until now the wizard, including saving settings and uploading files, worked for anyone who found a half-installed site.

The wizard's last step creates an admin account with an email and a password, signs you in and finishes. GitHub is still offered as the alternative. The login page has a password form, and goblog reset-admin-password prints a new password if you forget it (with Docker: docker exec <container> ./goblog reset-admin-password).

One volume keeps a Docker site

docker run -p 7000:7000 -e GOBLOG_DATA_DIR=/data -v goblog-data:/data compscidr/goblog:latest

With GOBLOG_DATA_DIR set, .env, the SQLite database, uploads and installed plugins and themes all live under that directory. The old one-line quick start wrote them inside the container, so replacing the container lost the site. When the variable is not set, every path is where it was.

MySQL works

A fresh install on MySQL failed at the migration step, and every settings query failed after that because key is a reserved word there. Both are fixed. A new CI job installs goblog from the Docker image on SQLite, MySQL and PostgreSQL on every push: it walks the wizard, creates the admin, replaces the container, signs in and resets the password.

Also

• Over plain http on an IP address or a local name (.local, .lan, a bare host name), the session cookie is no longer marked Secure, so a home-server install can log in. On a public host name it still is; SESSION_SECURE=true or false overrides either way.
• A fresh install starts as "My Blog" with a placeholder About page, instead of the original author's name, tags, profile links and biography.
• The session key is no longer written to the log.

Upgrading

Nothing to do beyond replacing the binary or image. A site that already has an admin sees no setup code and no change to its login page. The database gains one column (blog_users.password_hash), added automatically.

Existing Docker deployments keep working with their current mounts. To move one into a single data directory, see #670.

Not included

• Forest, Minimal and the site theme do not show the password form yet (#666). A site whose only login is a password still gets goblog's own login page, and /login?password=1 always works.
• The wizard's database step drops the session key from .env, so the first restart after an install signs everyone out (#667).

Full Changelog: v0.13.2...v0.14.0

v0.13.2

What's Changed

• Home: Person structured data for personal sites by @compscidr in #647

Full Changelog: v0.13.0...v0.13.2

v0.13.1

What's Changed

• Home: Person structured data for personal sites by @compscidr in #647

Full Changelog: v0.13.0...v0.13.1

v0.13.0

What's Changed

• README: lead with the project name, move upgrade notes to UPGRADING.md by @compscidr in #642
• Home: stop clipping the site tags line at 355px by @compscidr in #643
• "Powered by goblog": link goblog.live, render from a shared partial, add a setting to hide it by @compscidr in #644
• Sitemap: real lastmod dates, no duplicates, no tag pages by @compscidr in #645
• Stop re-escaping post slugs on every save by @compscidr in #646

Full Changelog: v0.12.0...v0.13.0

v0.12.0

What's Changed

• Finish GitHub's OAuth flow server-side, against a state in #638 (closes #637) — security
• Start GitHub's OAuth flow server-side, and let the wizard report its own failures in #636 (closes #631, #632)
• Restart the login when a callback carries no state at all in #640
• Build the GitHub button's URL in Go, not in four templates in #639
• Take the CDN stylesheets off the critical path in #635 (closes #630)

Signing in with GitHub is goblog's job now

The flow used to finish in the browser: the login page read ?code= out of the query and posted it to /api/login, which exchanged it and set the session. Nothing tied that code to the visitor who started the flow, so a code obtained for one account could be replayed into another visitor's browser, leaving them signed in as somebody else.

/login/github now mints an unguessable state, keeps it in the session and sends it to GitHub; the code is exchanged only if that state comes back unchanged, and it is spent either way. /api/login has been removed — it accepted a bare code as a form post and set the session from it, which a cross-site form could exploit without the login page being involved at all.

Along the way the authorize URL stopped being assembled in each theme's inline script, where window.location went into redirect_uri unescaped and a next containing & broke the URL outright.

Pages stop waiting on cdnjs

Render-blocking CSS on a public page drops from 67.6 KB to 31.3 KB (gzipped). Measuring what each sheet actually matched gave three different answers rather than one loading trick:

sheet	gzip	rules matched
bootstrap	30.7 KB	2.4%	stays blocking — those rules do the layout
font-awesome	20.2 KB	0.8%	loads async
tachyons	13.1 KB	0.9%	removed — all goblog used of it was four rules
bootstrap-social	3.0 KB	0%	login page only

Tachyons' four rules now live in www/css/base.css, served by goblog rather than added to a theme, so every theme keeps working with no release.

Also

• The install wizard can report its own failures. Both database handlers returned nothing when the form could not be read, which gin sends as a bare 200 — so the Test Database button turned green on a request the server never looked at. The client half threw on any non-JSON error response, so the button went red and the reason never appeared.

⚠️ Update your theme

If you run goblog-theme-forest or goblog-theme-minimal, install the new version:

• goblog-theme-forest v1.3.0
• goblog-theme-minimal v1.1.0

Older versions of those themes build the GitHub authorize URL themselves, with no state, and their sign-in button has no URL to point at. goblog recovers from the first of those automatically — a callback arriving with no state restarts the login (#640), so you will not be locked out — but it costs an extra round trip to GitHub and the button itself is still stale. Both themes now declare min_goblog_version: 0.12.0, so the directory will offer them only once you are on this release.

goblog-site-theme needs nothing: it is tracked from main, which already has the change.

Not included

Bootstrap, being the layout framework, still blocks rendering. Auto-updating installed themes and plugins — which would have prevented the theme mismatch above rather than recovering from it — is tracked in #641.

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

• Defer the CDN scripts by @compscidr in #629 (closes #624)
• Editor: stop scaling heading sizes in the markdown source view by @compscidr in #628

Pages stop waiting on cdnjs

Every page loaded jQuery, Bootstrap and — on posts — highlight.js as plain <script src>, each blocking the parser until it arrived. All 25 external script tags now carry defer, so the HTML parses while they download.

Deferred scripts run in order, after parsing and before DOMContentLoaded, so the inline calls that touch them wait for that event: hljs.highlightAll(), the login page's OAuth exchange and email form, the SimpleMDE editors, setupEditorTabs, the settings page's Bootstrap tab restore and the wizard's jQuery. Templates that only declare functions for onclick are untouched — those run when the user clicks and have to stay global.

Three lint tests over the shipped templates guard the arrangement, because it breaks silently: the page still renders, it just stops highlighting code or saves the wrong text.

The editor is a source view again

SimpleMDE's stylesheet scaled headings inside the editing surface to 200/160/125/110% — a leftover from when the browser rendered markdown. Since 0.10.0 the Preview tab renders through the server, so those sizes were a second, disagreeing rendering, and the line height lurched as you typed past a #. Headings are now the same size as body text and keep their bold weight; **bold**, *italic* and the code background are unchanged, as are the toolbar and paste-to-upload.

⚠️ Update your theme first

If you run goblog-theme-forest or goblog-theme-minimal, install the new version before upgrading:

• goblog-theme-forest v1.2.1
• goblog-theme-minimal v1.0.1

Those themes carry their own copies of footer.html, login.html and post.html, whose inline scripts call jQuery and highlight.js during parse. On 0.11.0 with an older theme, posts lose syntax highlighting and the GitHub login button does nothing. Both theme releases are backward compatible, so they can be installed before this upgrade.

goblog-site-theme needs nothing — it is tracked from main, which already has the change.

Not included

Bootstrap, Font Awesome and Tachyons are <link rel="stylesheet"> elements, and defer does not apply to stylesheets. They are still render-blocking — tracked in #630.

Full Changelog: v0.10.0...v0.11.0

v0.10.0

What's Changed

• Post, page and comment bodies are rendered to HTML on the server with goldmark, instead of being shipped as raw markdown and rendered in the browser by showdown.js. Crawlers, link-preview bots and reader modes now see the content. by @compscidr in #627

Embeds work again. DOMPurify was stripping every <iframe> and <script> from post bodies client-side, so YouTube and Instagram embeds have been silently broken. Posts and pages now render unsanitised — their authors are admins — while comments are sanitised with bluemonday, because commenters are not.

The editor has Write/Preview tabs. SimpleMDE's live side-by-side preview, which re-rendered as you typed using a different markdown implementation, is gone. Preview calls the new admin-only POST /api/v1/preview, which renders through exactly the same code as the published page.

For theme authors

search.html-style client rendering is over: use {{ .post.HTML }}, {{ .page.HTML }} and, per comment, {{ .HTML }}, and drop the showdown and DOMPurify script tags. .Content still works, so an un-migrated theme keeps rendering in the browser — it just stays invisible to anything that does not run JavaScript. See Writing a theme, which also documents the sanitisation boundary.

Note for goblog.live and jasonernst.com: both run themes that ship their own post.html and page_content.html, which shadow the default theme — they need their own updates before this release changes anything on those sites.

Fixes #617.

Full Changelog: v0.9.3...v0.10.0

v0.9.3

What's Changed

• Admin pages now send a signed-out visitor to the login page and back again, instead of showing a bare "Not Authorized"; someone signed in without an admin account gets a page explaining why. The JSON API still answers 401. by @compscidr in #623
• Theme static files answer HEAD requests, like every other route by @compscidr in #622

Fixes #620.

Full Changelog: v0.9.2...v0.9.3

v0.9.2

What's Changed

• _head: a page that sets no title (every admin page) showed GoBlog: %!s(<nil>) in the browser tab since v0.9.0; it now shows the site title alone, and no dangling colon when either half is missing. by @compscidr in #619

Full Changelog: v0.9.1...v0.9.2