0.15.0-rc1

First release candidate for 0.15.0. The theme is authoring and media: drafts survive a reload, phones can attach photos directly, and uploads render responsively.

⚠️ Breaking changes

• The import-wordpress.php, import-known.php and import-lamb.php shims are removed. Run bin/lamb import <wordpress|known|lamb> <path> instead; the flags and output are the same.
• A theme's feed.php or feed_json.php override is no longer read. Lamb's built-in feeds are used; delete the file from your theme.
• The prebuilt Docker image at ghcr.io/svandragt/lamb is no longer published. Build from Dockerfile.release with docker-compose.yml; images up to 0.14.0 stay pullable.

Added

• The new-entry editor autosaves your draft in the browser, so a reload or accidental navigation doesn't lose the post. The edit form offers a "Restore unsaved changes" link when a saved draft differs from the stored post.
• An attach-photo button on the entry and edit forms opens the phone's camera or photo library.
• Uploaded images get 800px and 1200px WebP variants, and posts render them with srcset so phones download a smaller file.
• sitemap.xml becomes a sitemap index once a site passes 50,000 URLs.
• A "Write your first post" tutorial in the docs.
• The deprecation policy is written down: a deprecation lasts one published release and is removed in the next.

Changed

• The database schema is declared explicitly and frozen. Existing installs get any missing columns added on first boot. Code that writes an undeclared column now fails instead of silently adding one.
• Outbound DNS lookups for feeds and webmentions are capped by DNS_RESOLVE_TIMEOUT (5 seconds), so a stalled resolver can no longer hold the /_cron lock.
• Tag archives covering several tags are sorted by date across all of them.
• Micropub responses send private cache headers.
• The 404 page's search suggestion searches for the words in the missing path rather than the raw path.

Fixed

• WordPress import: images renamed at the source (PNG bytes under a .jpg name) now import; an assets directory that can't be created is logged instead of leaving the image remote; numeric slugs are dropped even without an old path to redirect.
• Search shows one empty-state message, not two.
• Hashtag linking no longer rewrites hashtags inside existing link text.
• Multi-word tags round-trip through add and remove.
• Login throttling: closed a check-then-act race before the password check and fixed the counter's read-increment-write under load.
• Micropub: a token without update scope can no longer tell a real post from a missing one.
• Theme CSS minification no longer strips comment-like text inside string literals and url().
• XML output strips control characters that XML 1.0 forbids, and the sitemap host is escaped.
• Webmention reads on the post page are bounded.

Upgrade notes

• Replace any cron or script calling the import-*.php shims with bin/lamb import.
• If you deploy with Docker, switch from pulling ghcr.io/svandragt/lamb to building the image locally; see docs/docker.md.
• No config changes are needed. DNS_RESOLVE_TIMEOUT is a new tunable constant with a safe default.
• The database now uses SQLite's WAL mode, which keeps lamb.db-wal and lamb.db-shm beside lamb.db. Run bin/lamb as the same user as your web server (for example sudo -u www-data bin/lamb import …). Run as another user, it leaves those files owned by that user and every page then fails with "attempt to write a readonly database" until you delete them. Tracked in #831.