[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"journal-post-summercms-0-2-0":3},{"author":4,"categories":8,"content":9,"content_html":10,"created_at":11,"excerpt":12,"featured_image_url":9,"featured_images":13,"id":14,"is_pinned":15,"metadata":9,"next_post":16,"previous_post":20,"published":24,"published_at":25,"reading_time":6,"related_posts":26,"slug":27,"sources":9,"tags":28,"title":29,"translations":9,"updated_at":11},{"first_name":5,"id":6,"last_name":5,"login":7},"",1,"jakubzych@gmail.com",[],null,"\u003Ch2>Highlights\u003C\u002Fh2>\n\u003Cp>From 0.2 the minor version goes up when an upgrade can refuse a previously valid config or changes documented behaviour; patch versions are safe to take without reading. This release has two such changes, described in the new Upgrading to 0.2 docs.\u003C\u002Fp>\n\u003Ch2>Changed\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>In production, start-up refuses a token cookie that is not Secure, including one inferred insecure from an http or empty \u003Ccode>app.url\u003C\u002Fcode>. Set \u003Ccode>app.url\u003C\u002Fcode> to the https URL, or \u003Ccode>auth.cookie.secure\u003C\u002Fcode> explicitly.\u003C\u002Fli>\n\u003Cli>With \u003Ccode>supports_credentials: true\u003C\u002Fcode>, start-up refuses loose CORS origins: wildcards other than a whole leftmost host label, unanchored \u003Ccode>allowed_origins_patterns\u003C\u002Fcode>, and rules matching outside the configured domains. The error names the key and index.\u003C\u002Fli>\n\u003Cli>Site-cache purges after an admin save are queued after commit and coalesced; \u003Ccode>serve\u003C\u002Fcode> drains the queue on shutdown, and purges never follow redirects.\u003C\u002Fli>\n\u003Cli>While \u003Ccode>storage.uploads.public_url\u003C\u002Fcode> is set, protected uploads are refused (\u003Ccode>attach.ErrProtectedNeedsPrivateBucket\u003C\u002Fcode>).\u003C\u002Fli>\n\u003Cli>\u003Ccode>golem15.journal.site_cache.*\u003C\u002Fcode> keys are deprecated aliases of \u003Ccode>site_cache.purge_url\u003C\u002Fcode> and \u003Ccode>purge_token\u003C\u002Fcode>.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Fixed\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ccode>cors:<profile>\u003C\u002Fcode> headers are sent on every response of the route, including refusals and recovered panics.\u003C\u002Fli>\n\u003Cli>A zero \u003Ccode>bouncer.CookieConfig\u003C\u002Fcode> writes \u003Ccode>SameSite=Lax\u003C\u002Fcode> and \u003Ccode>Secure\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>\u003Ccode>\u002Fapi-docs\u003C\u002Fcode> runs only nonce-carrying scripts.\u003C\u002Fli>\n\u003Cli>A boot warning when turnstile routes have no secret.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Docs also cover features added since 0.1.14.\u003C\u002Fp>\n","2026-10-17T21:26:29+00:00","Stricter boot checks for token cookies and credentialed CORS, queued site-cache purges, and an Upgrading to 0.2 guide.",[],28,false,{"id":17,"slug":18,"title":19},27,"summercms-0-1-27","SummerCMS 0.1.27",{"id":21,"slug":22,"title":23},29,"summercms-0-2-1","SummerCMS 0.2.1",true,"2026-10-15T21:29:02+00:00",[],"summercms-0-2-0",[],"SummerCMS 0.2.0"]