v1.10.0

Features

• Relative images — ![](pic.png) next to your markdown file now renders in the preview, via a token-gated asset route resolved against the source file's directory (#17). Requires live-server.nvim v1.5.0+.
• Network access — new host option (default 127.0.0.1); set "0.0.0.0" to view the preview from another machine, e.g. over SSH. Thanks @icyveins7 (#28, #30).
• Custom CSS — new custom_css option layers your stylesheet over the bundled styles (supports ~ and $VAR). Thanks @y2w8 (#21).
• YAML front matter — shown in a collapsible panel and stripped from the render by default; configurable via yaml_mode ("panel" / "hide" / "raw"). Closes #18. Based on work by @Al3cLee (#20).
• allow_raw_html option — set false to render embedded HTML as plain text when previewing untrusted markdown (#27).
• WSL — browser launch now tries wslview → explorer.exe → powershell.exe, and surfaces the preview URL if none work (#26).

Fixes

• Task-list checkboxes now render (the plugin was loaded under the wrong global name). Thanks @tcuthbert (#25).
• Preview no longer gets stuck on "Waiting for content…" after a Neovim restart — the token placeholder collided with a JS sentinel and broke auth on tab reuse (#31).
• Code-block language badge and copy button stay pinned while scrolling wide code, and no longer reset scroll position on live updates. Based on work by @Al3cLee (#20).
• Mermaid diagrams fit one page when printing to PDF. Thanks @harish2704 (#29).

Security

• Removed a stale cors = true that emitted Access-Control-Allow-Origin: *, which could let any website read the auth token cross-origin.
• On a non-loopback host, the token is no longer baked into the served page and the preview page itself is token-gated (the browser bootstraps from the ?t= URL).
• New Security section in the README covering the token model, raw-HTML trade-off, CDN loading, and network-bind exposure.

Note: relative-image support needs live-server.nvim v1.5.0+; the plugin warns once if the installed version is older.