v0.18.1

2026.03.10 / v0.18.1

• [BREAKING] Minimum Node.js is v24.x LTS
• [Fix] Filepath location for language translations
• [Fix] Path traversal vulnerability
• [Fix] Sitemap string escaping
• [Fix] Better escaping and sanitization for markdown rendering
• [Fix] GitHub Actions repository permissions: read-only
• [Fix] Search ReDoS with lunr
• [Fix] Login password comparison
• [Fix] Path traversal outside of content directory
• [Fix] Authentication redirect continues with flow
• [Fix] Prevent error details leakage
• [Fix] Editor escaping Markdown content and base_url
• [Fix] Ensure redirect "return" is relative path only
• [Fix] Using callback for logout
• [Fix] Explicitly specify "Lax" for cookies
• [Add] Rate Limiting (200 req/min)
• [Add] Configuration verification function
• [Add] CSP Nonce with res.locals.csp_nonce
• [Edit] Refactoring (simplify, use native functions)
• [Deps] Upgrading marked from v16.4.2 to v17.0.2

v0.18.0

2025.09.15 / v0.18.0

This is a modernization refactor.

• [BREAKING] Default port is 8080 and not 3000
• [BREAKING] Minimum Node.js is v22.x LTS
• [BREAKING] Rename branch to "main" from "master"
• [BREAKING] Packages removed: pm2, commander, tail, serve-favicon
• [BREAKING] bin/raneto removed as it is out of scope. Please do not use PM2 and instead use npm start, containers, systemd, etc.
• [BREAKING] Modernizing, moving to ESModules, require => import, const/let, node: import prefix, module.exports => export, 'use strict'; etc.
• [BREAKING] CSP (Content Security Policy) is now enforcing
• [New] Theme redesign
• [New] Table of Contents Link Targets (marked-gfm-heading-id)
  • contributed by @dkuhlman
• [New] Multi-architecture container builds
• [New] File-based sessions to prevent requiring login on restart
• [Fix] Better searching (fuzzy, partial matches)
• [Misc] Replacing underscore with lodash and sanitize-html
• [Misc] Remove node-fetch, using native Node.js version
• [Misc] Remove extend, explicitly declaring @eslint/js dependency
• [Misc] Remove hogan-express in favor of mustache-express
• [Misc] Change "Meta information" to "metadata"
• [Misc] Upgrading to Express v5.x
• [Misc] Dependency upgrades
• [Add] Container build (raneto:latest) on push to main
• [Add] Container build (raneto:tag) on tag creation
• [Fix] Windows support (mainline versions only)

v0.17.8

2024.02.22 / v0.17.8

• [New] ShowOnMenu by @mgdesign #388
• [Misc] Upgrading to latest Node.js LTS v18.x and v20.x
• [Misc] Linting / Prettier

v0.17.7

2024.02.21 / v0.17.7

• [Fix] Markdown content parser/sanitization (863aaf5)
• [Misc] Dependency upgrades (ed4f097)

v0.17.6

2023.11.06 / v0.17.6

• [Misc] Dependency upgrades

v0.17.5

2023.06.20 / v0.17.5

• [Misc] Dependency upgrades

v0.17.3

2023.04.11 / v0.17.3

• [New] Linter Updates
  -- dddade7 (ESLint 1)
  -- 5637568 (ESLint 2)
  -- 878e95b (Prettier)
• [Fix] Commander/PM2 (Unsupported)
  -- 19605c2
• [Misc] Dependency upgrades
  -- Packages current as of today (exception: glob)
  -- 66e08c6 (Container Image)
  -- bf6d33e (NPM Packages)
• Extract themes/ to new repository/package @raneto/theme-default
• Extract example/ to new repository
• [Removed] Package gulp-shell
• [Removed] Package markdown-it

v0.17.2

2022.08.28 / v0.17.2

• [Fix] Crash for ignored directories by @pmoleri #369
• [Docs] Updated, first pass
• [Misc] Pipelines fixed after Travis CI shutdown
• [Misc] Dependency upgrades
  -- Packages current as of today (exception: bootstrap)

v0.17.1

2022.08.02 / v0.17.1

IMPORTANT - SECURITY FIXES

• [SECURITY] Sanitization, DoS, Best Practices by @J-GainSec #368
  -- Mitigation @ryanlelek #370
• [New] Finnish Translation by @Mixerboy24 #363 Oksanen / LocalghostFI Ltd
• [Fix] Redirect Fix on server restart, suggested by @leofranke95 #340
• [Fix] Docker image build process by @jj-style #355
• [Fix] Top bar navigation by @norogoth #357 #358
• [Fix] Add Page to Current Category @Meiwer #364

Fully up to date modules as of 2022-08-02
(except 3 held modules due to breaking changes)

-- Ryan

v0.17.0

2021.03.28 / v0.17.0

Possible breaking changes, based on your implementation

• [Edit] Listening on 127.0.0.1 instead of all interfaces #345

Fully up to date modules as of 2020-03-28

-- Ryan