Lamb 0.13.0-rc1

A release candidate for 0.13.0. Try it on a test install before you put it on
a site you care about, and report anything that looks wrong.

The headline is that you can now get your content out of Lamb and back into it:
a full site export, and importers that read it back. Login also gets a
brute-force throttle, and Micropub gains several fixes.

Upgrade notes

• Lamb now needs PHP 8.4 or newer (8.4 and 8.5 are supported). Upgrade PHP
  before you pull this release — on an older PHP the site will not start.
• The importers are behind an experimental flag. Set
  experimental_features = true in Settings to use the WordPress, Known, or
  Lamb importers. The flag resets itself to false when the set of
  experimental features changes, so you opt in again rather than silently
  covering something new.
• Micropub q=config now needs a token. A client that queried it without
  one gets a 401 — the spec requires the token, and it was leaking your
  configuration to anonymous callers.
• Docker users need to do nothing: the release image now serves as www-data
  instead of root, and fixes the ownership of existing volumes on first start.

Added

• Export your site. /export (login required) downloads the whole blog as
  a zip of Markdown files plus a JSON manifest and your uploaded assets.
• Import a Lamb export. php import-lamb.php <archive> restores an export
  into an install — for moving hosts, or seeding a test copy from live.
• Import from Known. A CLI importer for a Known site, alongside the
  existing WordPress one.
• --replace for the importers. Re-run an import over posts you brought in
  before instead of skipping them.
• Login brute-force throttle. After repeated failed logins from one
  address, further attempts are refused for a while with a 429. The check
  runs before the password is hashed, so a flood costs the server nothing.
• Micropub clients get a useful reply on create. A 201 now carries a JSON
  body with the new post's permalink, plus preview and edit URLs.
• in-reply-to survives the round trip. Replies keep their context through
  the feeds and through every Micropub property path.
• LAMB_MAX_UPLOAD_PIXELS. Lower the ceiling on how large an image the
  WebP conversion will decode, for a memory-constrained host.

Changed

• Preview links and private pages tell search engines not to index them.
• Menu pages no longer clutter search results and tag listings.
• Feed ingestion tracks the newest item it has seen rather than the clock, so a
  slow or backdated feed no longer loses items.
• Images reserve their space before they load, so the page stops jumping.
• The release Docker image drops root and serves as www-data.
• make-password.php refuses to overwrite an existing .env. Pass --force
  if you really mean to replace it.
• bin/upgrade explains itself when it stops on a checkout owned by another
  user, instead of failing quietly and leaving you on the old version.
• Logging in with LAMB_LOGIN_PASSWORD unset now says the password is not
  configured, instead of reporting a wrong password.
• Setting site_url to a URL with a path now warns you. Lamb serves from the
  root of a domain; the path was being discarded silently.

Fixed

• Micropub updates. An update no longer drops the post's front matter, and
  a failed update no longer reports success.
• The post editor. Editing a post no longer mangles the body, and a saved
  post is stamped with the current render version.
• Rejected image uploads. The error message no longer gets pasted into the
  post you were writing; you see why it was refused.
• Malformed Micropub updates are refused with an error instead of a 500.
• OpenGraph timestamps were swapped, so scrapers read a post's edit time as
  its publication date.
• The 404 page showed a raw HTTP status line as its title and offered a
  search for "404".
• Imported hashtags arrived escaped and duplicated.
• Known imports kept <wbr> layout hints in the text and lost the slugs of
  status posts.
• A DNS-rebinding hole in outbound fetches. Webmention and feed requests
  now connect to the address that was checked, so a hostile host cannot swap it
  for an internal one between the check and the request.
• WebP conversion no longer buffers the image twice, so a large upload needs
  less memory to convert.