0.13.0-rc2

This pre-release builds on 0.13.0-rc1 with a large round of correctness and hardening fixes across posting, feeds, import/export, and the admin. All changes below are new since rc1.

Upgrade notes

• Lamb now checks at startup that the PDO driver for your database is actually loaded, and stops with a clear message if it isn't. Before upgrading, make sure the matching extension is installed — pdo_mysql for MySQL/MariaDB, pdo_sqlite for SQLite.

Security

• The login hash is no longer left in a world-readable .env.
• Micropub content now has its attributes sanitised, not just its tags, closing an HTML-injection gap.
• The OpenGraph image sizer stays inside the web root.
• The Referer redirect guard rejects protocol-relative paths.
• Reply targets that aren't http(s) URLs are refused.
• Every outbound fetch is now bounded in time as well as in size.
• An imported post can no longer take a slug that shadows a built-in route.

Changed

• Large blogs use far less memory building the sitemap, the tag page, and the tag feed, and when finding related posts — each now reads a page at a time instead of loading the whole archive.
• Conditional requests follow RFC 9110: a changed ETag decides the 304, so browsers and caches revalidate correctly.
• The RSS and Atom feed bodies are capped the same way the JSON feed already was.
• CSS string literals survive asset minification unchanged.

Fixed

Posting and Micropub

• Micropub updates that send content as an object are handled correctly.
• A single malformed byte can no longer delete a Micropub log entry.
• An upload batch is refused before any of it is stored, rather than part-way through.
• An empty upload gets a JSON refusal, like every other error.
• A failed post edit no longer redirects the post's own URL to a 404.
• A post can never store a redirect to itself.
• Task-list checkboxes render under safe mode, and a toggle now targets the checkbox it names.

Content and tags

• Tag matching, category editing, and tag detection all end a tag at the same boundary the renderer does.
• Related-post titles are trimmed on characters, not bytes, so multibyte titles aren't cut mid-character.
• Every theme gets the p-name title it hides on a post page.
• A CRLF post whose heading becomes the title keeps its front matter.
• set_matter() writes its value as YAML instead of interpolating it.

Feeds and webmentions

• The feed crawl watermark no longer steps past an entry the crawl lost, and a crawl attempt is recorded before the fetch, not after.
• A response is checked for the right shape before it's treated as a JSON Feed.
• Deferred outbox rows no longer eat into the webmention send window.

Import, export, and backup

• Export and import agree on the YYYY/MM path shape, so round-trips line up.
• feed_locked is carried through export and restore.
• A manifest date can no longer break the comparisons that depend on it.
• A restore no longer counts an asset it failed to put in place.

Install and migrations

• Boot-time migrations probe before writing.
• The theme migration doesn't run on unparseable config.
• A .env value containing an apostrophe is quoted so it can't break the file.

Plus a sweep of fifteen further silent-failure fixes across the codebase.