v0.10.0

What's Changed

• Post, page and comment bodies are rendered to HTML on the server with goldmark, instead of being shipped as raw markdown and rendered in the browser by showdown.js. Crawlers, link-preview bots and reader modes now see the content. by @compscidr in #627

Embeds work again. DOMPurify was stripping every <iframe> and <script> from post bodies client-side, so YouTube and Instagram embeds have been silently broken. Posts and pages now render unsanitised — their authors are admins — while comments are sanitised with bluemonday, because commenters are not.

The editor has Write/Preview tabs. SimpleMDE's live side-by-side preview, which re-rendered as you typed using a different markdown implementation, is gone. Preview calls the new admin-only POST /api/v1/preview, which renders through exactly the same code as the published page.

For theme authors

search.html-style client rendering is over: use {{ .post.HTML }}, {{ .page.HTML }} and, per comment, {{ .HTML }}, and drop the showdown and DOMPurify script tags. .Content still works, so an un-migrated theme keeps rendering in the browser — it just stays invisible to anything that does not run JavaScript. See Writing a theme, which also documents the sanitisation boundary.

Note for goblog.live and jasonernst.com: both run themes that ship their own post.html and page_content.html, which shadow the default theme — they need their own updates before this release changes anything on those sites.

Fixes #617.

Full Changelog: v0.9.3...v0.10.0