v0.10.2

What's Changed

Preview mode isolation

Preview reviews now load from a separate host (e.g. preview.crit.md) so uploaded HTML/JS cannot access session cookies on the main app origin. Self-hosters can configure PREVIEW_HOST; docs cover reverse-proxy setup and ICO registration.

• feat: isolate preview mode on a dedicated host (#291) by @tomasz-tomczyk in #291
• fix: allow preview host in CSP frame-src (#292) by @tomasz-tomczyk in #292
• fix: address release audit findings for preview and host gate (#294) by @tomasz-tomczyk in #294
• docs: document PREVIEW_HOST self-hosting and ICO registration (#293) by @tomasz-tomczyk in #293

General

• fix: resolve relative markdown image paths in hosted reviews (#280) by @tomasz-tomczyk in #280
• docs: add Codex plugin docs to integrations page (#278) by @tomasz-tomczyk in #278
• chore: skip GitHub stars/changelog pollers on self-hosted (#277) by @tomasz-tomczyk in #277
• feat: add articles landing page and first tutorial (#281) by @tomasz-tomczyk in #281
• fix: load articles from release priv and add release smoke CI (#282) by @tomasz-tomczyk in #282

Internal refactors

• chore(deps): bump actions/cache from 5 to 6 (#279) by @dependabot in #279

Dependency updates

• chore(deps): bump phoenix_live_view from 1.2.3 to 1.2.5 (#283) by @dependabot in #283
• chore(deps): bump markdown-it from 14.2.0 to 14.3.0 in /assets (#284) by @dependabot in #284
• chore(deps): bump mermaid from 11.15.0 to 11.16.0 in /assets (#285) by @dependabot in #285
• chore(deps): bump mdex from 0.13.1 to 0.13.3 (#286) by @dependabot in #286
• chore(deps): bump @sentry/browser from 10.59.0 to 10.63.0 in /assets (#287) by @dependabot in #287
• chore(deps): bump req from 0.6.1 to 0.6.2 (#288) by @dependabot in #288
• chore(deps): bump tailwind from 0.5.0 to 0.5.1 (#289) by @dependabot in #289
• chore(deps): bump swoosh from 1.26.1 to 1.26.3 (#290) by @dependabot in #290

Full Changelog: v0.10.1...v0.10.2