SummerCMS 0.2.0

Highlights

From 0.2 the minor version goes up when an upgrade can refuse a previously valid config or changes documented behaviour; patch versions are safe to take without reading. This release has two such changes, described in the new Upgrading to 0.2 docs.

Changed

• In production, start-up refuses a token cookie that is not Secure, including one inferred insecure from an http or empty app.url. Set app.url to the https URL, or auth.cookie.secure explicitly.
• With supports_credentials: true, start-up refuses loose CORS origins: wildcards other than a whole leftmost host label, unanchored allowed_origins_patterns, and rules matching outside the configured domains. The error names the key and index.
• Site-cache purges after an admin save are queued after commit and coalesced; serve drains the queue on shutdown, and purges never follow redirects.
• While storage.uploads.public_url is set, protected uploads are refused (attach.ErrProtectedNeedsPrivateBucket).
• golem15.journal.site_cache.* keys are deprecated aliases of site_cache.purge_url and purge_token.

Fixed

• cors:<profile> headers are sent on every response of the route, including refusals and recovered panics.
• A zero bouncer.CookieConfig writes SameSite=Lax and Secure.
• /api-docs runs only nonce-carrying scripts.
• A boot warning when turnstile routes have no secret.

Docs also cover features added since 0.1.14.