v1.1.0

Features

• (server) Send CSP, frame-ancestors, and nosniff headers on the SPA
• (server) Guard against DNS-rebinding and cross-origin writes with a host allowlist

Bug fixes

• (chores) Compute dueIn in the local timezone so the day count is right off-UTC
• (widget) Recover panics in background job goroutines so one bad job can't crash the server
• (ci) Grant contents:read so tonk can fetch discord.yml

Refactoring

• Migrate Discord notifications to shared tonk layer

Documentation

• Add an HTTP API reference for the platform and widget routes
• Document TZ so non-Docker installs don't silently run on UTC
• (spike) Evaluate a utilities-trends widget against project scope

Maintenance

• (mealplan) Cover entry validation and the week window
• (guestbook) Cover message/color/position validation on the handler
• Cache bun install and Playwright chromium
• Pin staticcheck via a go.mod tool directive for reproducible lint
• (restore) Cover doRestore set-aside, sidecar handling, and validation
• (tonk) Add issue notifications, replacing the GitHub webhook
• (tonk) Add pull-request lifecycle Discord notifications
• Adopt the tonk brand defaults for discord posts
• Gate release and demo deploys on green checks
• Migrate to tonk v2
• (ci) Remove temporary secret export workflow
• (ci) Add temporary encrypted secret export for tonk re-keying
• Namespace Discord webhook secrets with TONK_ prefix
• Notify discord of failures, recoveries, and releases

What's Changed

• ci(tonk): add pull-request lifecycle Discord notifications by @zandoh in #2
• ci(tonk): add issue notifications by @zandoh in #3

New Contributors

• @zandoh made their first contribution in #2

Full Changelog: v1.0.2...v1.1.0