Lamb 0.13.0

Lamb 0.13.0 is a large maintenance and hardening release: importers and a full
site export, tighter Micropub handling, faster feeds and listings on big sites,
and a broad security and bug-fix sweep. The minimum PHP version is now 8.4.

Upgrade notes

• PHP 8.4 or newer is now required. Update your runtime before upgrading.
• Make sure your database's PDO driver is installed. Lamb now fails fast if
  the driver it connects through is missing — pdo_sqlite for the default
  SQLite setup, pdo_mysql for MySQL. The Docker image already includes them.
• The WordPress, Known, and Lamb importers now require experimental_features
  to be enabled in your site configuration. Turn it on before running an import.
• Subdirectory installs: a site_url that carries a path now logs a warning
  instead of failing silently. Micropub under a subpath is still limited.

Added

• Site export. A new endpoint exports your whole site as Markdown posts plus
  a JSON manifest, ready to archive or move.
• Restore from a Lamb export. import-lamb.php imports an export archive
  back into a Lamb install, assets included.
• Known importer. Bring posts across from a Known site.
• Login throttling. Repeated failed admin logins from one address are now
  rate-limited.
• Reply context in feeds and Micropub. in-reply-to is carried through the
  Atom and JSON feeds and the Micropub property paths, so replies keep their
  context.
• Richer Micropub responses. A successful create (201) now returns a JSON
  body with preview and edit links.
• LAMB_MAX_UPLOAD_PIXELS. A new limit on upload dimensions, alongside a
  lighter WebP conversion path.

Changed

• Images now reserve their box with intrinsic width and height, reducing layout
  shift as a page loads.
• Preview links, private pages, and menu pages are kept out of search and tag
  listings.
• Micropub q=config now requires a token, per the spec.
• Faster on large sites: the sitemap, tag pages, tag feed, and related-post
  lookups now page through the database instead of loading whole archives into
  memory, the post table is indexed, and the sitemap is cached.
• Conditional requests use the ETag to decide a 304, following RFC 9110.
• The release Docker image now runs as a non-root user.

Fixed

• The admin login hash is no longer written to a world-readable .env.
• Editing a post no longer mangles the body or serves a stale rendered version,
  and front matter survives edits to posts saved with Windows line endings.
• A rejected image upload no longer pastes its error message into your post.
• Micropub updates no longer drop front matter or report phantom successes, and
  malformed update actions are refused instead of returning a 500.
• A failed media upload now answers with the correct error, and a failed post
  edit no longer points its own URL at a 404.
• Imported hashtags no longer arrive escaped or duplicated.
• 404 page, OpenGraph timestamps, menu-page filtering, task-list checkboxes, and
  category editing all have correctness fixes.
• Feed ingestion is steadier: outbound fetches are bounded in time, feed bodies
  are capped, and the crawl watermark no longer skips or repeats items.
• A post can no longer redirect to itself, and an imported slug can no longer
  shadow a built-in route.

Security

• Outbound fetches are pinned to the resolved IP, closing a DNS-rebinding SSRF
  gap, and every outbound fetch is bounded in time.
• Protocol-relative and non-http(s) targets are rejected in the redirect guard
  and in reply links.
• Micropub content HTML is sanitised at the attribute level, not just tags.
• The OpenGraph image sizer is confined to the web root.

Full commit history: 0.12.0...0.13.0