v0.3.0

Markdown documents can be brought into knot — as a file, or by pasting the source.

Added

• Import a Markdown file as a page. "Import Markdown…" sits next to Export on
  the doc page, for editors and owners. 1 MB limit. Importing into a page that
  already has content asks first; the previous version stays in History.
• Markdown-aware paste. Pasting Markdown source now produces real headings,
  lists, tables and task items instead of literal ## Heading text. Left alone
  when the clipboard carries rich text, inside a code block, and on ⌘⇧V.
• POST /api/docs/{id}/markdown accepts ?mode=replace, which clears the page
  before applying. The default stays append, so existing callers — including
  create-from-template — are unchanged.

Fixed

• Importing over a page that had content duplicated it instead of replacing.
  The endpoint only ever merged into the live document; its one caller always
  targeted an empty page, so the path was never exercised.
• Checklists built server-side rendered as plain bullets. from_markdown
  stores checked as the string "true"/"false", but the editor matched only
  the boolean form. Affected imported files and pages created from a template.
  The Markdown round-trip and the task index were correct throughout; only the
  rendering was wrong.
• A full-document replace is attributed to the user who made it, rather than
  landing in doc_updates with a null author.
• h2 0.4.15 → 0.4.19 (RUSTSEC-2026-0258,
  unbounded empty DATA frames) and chacha20 0.10.1 → 0.10.2 (yanked). Both
  transitive, via hyper and rand.

Changed

• pnpm lint runs in CI, and the backlog it had accumulated unseen is cleared.
  Two of those were real defects: onClick and onPickTemplate are typed to
  return void, so their inline async handlers left promise rejections
  unhandled — a failed request surfaced as an unhandled rejection instead of the
  intended error toast.
• excalidraw.spec resets per test instead of per file. Its two "flaky" specs
  were deterministic failures: every test bootstraps through /setup, and
  POST /auth/setup returns 410 once a user exists, so tests 2 and 3 sat on the
  setup page until they timed out. The playwright job dropped from ~10m to ~5m.

---

Container image

ghcr.io/opendefensecloud/knot:0.3.0 — multi-arch (amd64/arm64), cosign-signed, with SBOM + SLSA provenance.

Helm chart

helm install knot oci://ghcr.io/opendefensecloud/charts/knot \
  --version 0.3.0 \
  -n knot --create-namespace \
  --set database.url='postgres://…' \
  --set session.key="$(openssl rand -base64 32)" \
  --set baseUrl=https://knot.example.com

Full values: chart README.

What's Changed

• fix(e2e): reset per test in excalidraw.spec by @christianhuening in #7
• feat: import a Markdown file as a page by @christianhuening in #9

Full Changelog: v0.2.1...v0.3.0