Ridu v0.20.0

Ridu 0.20.0

Ridu now requires Go 1.26.9, which fixes standard-library vulnerabilities that Ridu's servers
reach. S3 upload storage works with Railway buckets, the Railway guide's configuration passes
Railway's healthcheck, and date-time queries match stored values however they were written.

Security

Go 1.26.9 and 1.27.2 fix eleven standard-library vulnerabilities that Ridu's code reaches: in
HTTP/2 and HTTP/1 serving and proxying, Range and MIME header parsing, TLS Encrypted Client Hello
and, on Windows, os.Root (GO-2026-6603,
6604, 6605,
6607, 6608,
6609, 6610,
6611, 6612,
6613 and 6617). No
Go 1.25 release fixes them. Ridu's minimum Go version and its release builder move from 1.25.13 to
1.26.9. The ridu binaries of 0.19.0 and earlier were built with Go 1.25.13 and are affected, and
so is any application built with a Go release before 1.26.9, or with Go 1.27.0 or 1.27.1.

Fixes

• The S3 storage adapter addressed every bucket path style, https://<endpoint>/<bucket>/<key>.
  Railway buckets (Tigris) refuse that style, so the readiness check failed with 403 Forbidden
  and the deploy never became ready. Buckets are now addressed virtual-hosted style by default,
  https://<bucket>.<endpoint host>/<key>, which AWS S3, Railway buckets and Cloudflare R2
  accept. s3.Config.PathStyle keeps the path form. See
  S3-compatible storage.
• S3 requests were signed for a path without its leading slash when the endpoint had no path, so
  the service computed a different signature. Requests are now signed for the path they are sent
  to.
• The Railway guide set RIDU_ALLOWED_HOSTS to the public domain alone. Railway's healthcheck
  sends Host: healthcheck.railway.app, and Ridu checks the host before it routes /readyz, so
  every deploy failed its healthcheck. The guide now sets
  RIDU_ALLOWED_HOSTS=${{RAILWAY_PUBLIC_DOMAIN}},healthcheck.railway.app. See
  Set production variables.
• Ridu refused unlisted hosts without logging anything. It now logs the first refusal of each
  host the allowed hosts omit, naming the host and RIDU_ALLOWED_HOSTS, for up to 32 hosts.
• Date-time fields stored values as written. query.DateTime sends UTC with milliseconds, so it
  missed values saved without milliseconds or with an offset, and range filters and sorting could
  put values out of time order. Ridu now stores every date-time value in one form, UTC with
  milliseconds such as 2026-09-08T10:00:00.000Z, on SQLite, PostgreSQL and MongoDB. See
  Defaults, timezones, and sorting.
• Custom field examples and the text editor that ridu new scaffolds bind with a Svelte function
  binding, bind:value={() => field.value ?? "", (next) => field.set(next)}.

Breaking changes and upgrade

Update the Go module and all Ridu npm packages to 0.20.0 together, regenerate application contracts,
and rebuild the admin and application binary.

• Ridu requires Go 1.26.9 or newer. go get github.com/riducms/ridu@v0.20.0 raises an existing
  project's go line to 1.26.9, and new projects start there. Go 1.27.0 and 1.27.1 meet that
  minimum but still have the vulnerabilities, so build and deploy with Go 1.26.9 or a later 1.26
  release, or with Go 1.27.2 or later.
• S3 storage addresses buckets virtual-hosted style by default. Set PathStyle: true in
  s3.Config for MinIO and other emulators addressed by IP address or a single host name, and for
  a bucket whose name contains a dot. Without it, s3.New refuses an IP-address endpoint, or a
  dotted bucket over HTTPS. Endpoint never includes the bucket.
• REST, the local API and the SDK return date-time values in the stored form: a value written as
  2026-09-08T11:00:00+01:00 reads back as 2026-09-08T10:00:00.000Z. Values stored before
  0.20.0 keep their text until their document is saved again, so save documents again if you
  filter or sort on their date-time fields.
• On Railway, add healthcheck.railway.app to RIDU_ALLOWED_HOSTS.

This is a pre-1 release with breaking contracts; keep the coordinated packages aligned. Production
still runs as a Go binary with its static admin embedded, without a JavaScript server.