v1.0.0

[1.0.0] - 2025-08-10

This is the first stable release after a major security and functionality overhaul.

Security

• Prevented Directory Traversal: Implemented a custom router to validate request paths, blocking access to files outside the intended directory.
• Prevented Cross-Site Scripting (XSS): Integrated the bluemonday library to sanitize all HTML rendered from Markdown, mitigating XSS risks.
• Hardened Browser Auto-Open: Re-implemented the browser auto-open feature with strict URL validation and command path verification to prevent command injection vulnerabilities.
• Disabled Unsafe Links: The Markdown renderer now disables links to local non-Markdown files and requires user confirmation before opening external links in a new tab.
• Updated Dependencies: Updated all dependencies to their latest versions to patch known vulnerabilities.
• Addressed gosec Findings: Fixed all issues reported by the gosec static analysis tool, including potential Slowloris attacks and unhandled errors.

Fixed

• Markdown Rendering Engine: Replaced the blackfriday parser with goldmark and its GFM extension. This fixed numerous rendering bugs, including incorrect handling of code blocks within lists, unwanted line breaks, and improved standards compliance.
• Shutdown Mechanism: Fixed a bug where the shutdown button was not working due to an uninitialized channel.

Changed

• Improved Layout: Increased the maximum width of the Markdown rendering area to 1140px for better readability on wider screens.