v2.21.1

Bug Fixes

• Unescape pipes in table cells like GFM, see #500 (1af90ef).
• Allow repository management configuration via environment variables, see #522 (3e3a8df).
• Fix alignment on the figure embedding, see #523 (860f0a7 by @ribbal).
• Do not create preferences that shadow the environment configuration (0fd5373).

Dependencies

• Update mistune to 3.3.3 (dd6909a).

Compare with v2.21.0

v2.21.0

Features: CodeMirror 6

Finally CodeMirror 6 is here. The majority of work has been done by @onovy in #464.

• Migrate the editor from CodeMirror 5 to CodeMirror 6: the vendored CM5 files are replaced
  by a single bundle built from source with esbuild, all editor features (markdown formatting
  helpers, table editing, list continuation and indentation, link handling, search dialog,
  inline attachment upload and preview toggle) have been ported, and GFM support (task lists,
  strikethrough, tables) is enabled, see #464 #520
  (1c76bd9, cd08166, b8492a4, cea3dab, aa87116, 13d75bb, d1283db by @onovy).
• Add syntax highlighting for wikilinks and embeddings in the editor, see #520 (e1fbc03, 403cfce, c6011e6).
• Highlight trailing whitespace in the editor, see #520 (2d53b93).
• Use a 4-space indent unit in the editor to match the wiki's markdown conventions, see #520 (2825582).
• Enable autocorrect and autocapitalize in the editor on mobile, see #520 (f852d2d).

Bug Fixes

• Restore visual parity with the CM5 editor in both light and dark themes: nested list depth
  coloring, grey inline and fenced code, and the checkbox color, see #520
  (3b7c05f, c26a8c4, 6e8419a, 0a01cac, 28a515f, ff0d7aa, a422d02 by @onovy).
• Fix the invisible editor selection in dark mode caused by a CSS specificity issue, see #520 (8d6d144 by @onovy).
• Prevent content duplication when pasting an image in the editor, see #520 (b0a8acd).
• Preserve the cursor position when an inline attachment upload completes, see #520 (764514a).
• Fix dark mode colors of the DataTable selector dropdown, see #519 (484211a).
• Remove accidental globals in otterwiki.js (5786c57).
• Match article headings for the sidebar table of contents highlight (8629caa).
• Use per-platform pip caches in docker builds (bfc5e73).

Refactoring

• Move the frontend sources and npm tooling into frontend/, see #520 (483ccdf).

Dependencies

• Bump esbuild from 0.19.12 to 0.28.1 and rebuild the editor bundle, see #521 (33b5313 by @dependabot, 5fa9962).

v2.20.8

Security Fixes

• Reject backslash open-redirect bypass in the login redirect (7681e4f).

Features

• Add column0 option for 0-based CSV column selection, see #519 (da90ae8).

Bug Fixes

• Prevent InfoBox overflow on narrow viewports, see #515 (17ba350).
• Use page header capitalization in breadcrumbs, see #516 (8e36f83).
• Keep post-login redirect relative, see #517 (f871fef).
• Fix saving the page index session state in Safari, see #514 (9537cf9 by @ribbal).

Compare with v2.20.7

v2.20.7

Security Fixes

• Use HMAC with SECRET_KEY for the webhook hash, generate the webhook URL server-side,
  and add GIT_REMOTE_PULL_URL_SECURE for backward-compatible hashes, see #443 (bc77b7d by @onovy).
• Prevent style attribute XSS in InfoBox, ImageFrame and Figure embeddings (8c5d311).
• Deny any possibility for malicious redirects, see #504 (15f5a86 by @deseven).
  Thanks to @Fushuling for reaching out and bringing this potential security risk to our attention.

Features

• Open external links in a new tab with an icon, see #215 #507 (e18304f by @ribbal).
• Allow multiple sub-tree items to be unfolded in the page index, see #512 (df49a45 by @ribbal).

Bug Fixes

• Add a TOP focus option and unfold all folders when focus is OFF, see #506 (0bc25d8).
• Safely encode DataTable caption using json.dumps, see #502 (8911f1a by @turfin-logic).
• Lowercase crumb paths for isdir checks on case-sensitive filesystems (d5b1bdc).
• Fix referencing pages plugin, see #498 (473ec48 by @ribbal).

Compare with v2.20.6

New Contributors

• @ribbal made their first contribution in #498
• @turfin-logic made their first contribution in #502

v2.20.6

Features

• Use a dedicated og:image meta image (0f40bfe).
• Add style option to PageIndexEmbedding (1c0b51a).

Bug Fixes

• Add apple-touch-icon and web manifest for Safari/iOS, see #501 (08f509e, 2d07352).
• Filter non-existing prefixes in create page form, see #491 (09fffb7).
• Keep Tools menu and Edit button on Rename/Delete forms, see #494 (02a1d77).
• Show Custom Menu and Page Index consistently in sidebar, see #493 (4fc19b4).
• Focus preview so it can be scrolled with page up/down (7c2e68e).
• Place preview cursor on lines ending with images or links (c7c69fa).

Dependencies

• Upgrade Debian in Docker, see #488 (7747a8c by @onovy).

Compare with v2.20.5

v2.20.5

Features

• Wrap page content in <article> for browser reader mode (c3ec872).
• Add housekeeping security check, restricted to admins, see #476 (1109a5a by @deseven, 30be0d2).
• Report passed security checks alongside issues, see #476 (0e4c76e).

Bug Fixes

• Set autofocus on the main content wrapper (d6928e0).
• Correct blame link to historic revision, see #484 (bc38ec3).
• Set <title> for blame, about, syntax, help, draft, 404, and edit pages, see #485 (e15dbef, dc7dc4a by @civviGH).
• Render repeated footnote references with same number (4179fe1).
• Log mermaid parse errors to the browser console (f81c4a4).
• Serve SVG attachments without PIL thumbnailing (2c4a4b1).
• Forward to original page after login from all permission gates, see #483 (3734d93 by @Harriotskelli, 01327dd, faa85d5).

Dependencies

• Bump gitpython from 3.1.47 to 3.1.50, see #482 (f9b72f4, d3418e4 by @dependabot).
• Bump mistune from 3.2.0 to 3.2.1, see #479 (8db1217 by @dependabot).

Compare with v2.20.4

New Contributors

• @civviGH made their first contribution in #485

v2.20.4

Bug Fixes

• Fix improper text wrapping in sidebar (e2fa225 by @jr-krandino).
• Keep sidebar tree indicator inline with long pagenames (125cb86).
• Load MathJax for plain $...$ and $$...$$ math, see #474 (76898f6).
• titleSs() handles apostrophes correctly, see #453 (257fbc9).

Compare with v2.20.3

New Contributors

• @jr-krandino made their first contribution in #470

v2.20.3

Features

• Add /.well-known/change-password redirect to settings, implementing the W3C well-known change password URL spec (591ea25 by @onovy).

Bug Fixes

• Render fold and spoiler blocks correctly after lists, related to #450 (be08160).
• Make spoiler example functional in help/syntax page, see #463 (87e1282).
• Preserve indentation in commit diff view (e8dbab9 by @onovy).

Dependencies

• Bump gitpython from 3.1.44 to 3.1.47 (fbb5cf2 by @dependabot).
• Bump pillow from 12.1.1 to 12.2.0 (3869aa6 by @dependabot).
• Upgrade mermaid 11.12.3 to 11.14.0 (57b72f9 by @fidergo-stephane-gourichon).
• Upgrade MathJax 3.2.0 to 4.1.1 (34f8e18 by @fidergo-stephane-gourichon).
• Upgrade sortablejs 1.15.3 to 1.15.7 (2b74c6c by @fidergo-stephane-gourichon).
• Upgrade htmx 2.0.6 to 2.0.8 (49a4309 by @fidergo-stephane-gourichon).

New Contributors

• @fidergo-stephane-gourichon made their first contribution in #465

Compare with v2.20.2

v2.20.2

Bug Fixes

• Render alerts correctly after lists, see #450 (6b02637).
• Redirect to / with toast when path sanitizes to empty pagename (357deb8).

Compare with v2.20.1

v2.20.1

Features

• New {{Figure}} embedding for wrapping content blocks (7e72dc1).
• Added YouTube support to {{Video}} embedding (b3bd208, 89459a5).
• Added src= option to {{ImageFrame}} for embedding image attachments (f0dbe4c).
• Support absolute src= paths in {{DataTable}} (881c1f0).

Bug Fixes

• Fix inline markdown rendering in embeddings help (c89ac59).
• Anchor fold/spoiler blocks to line start (a015195).
• Support parenthesis-delimited titles in link reference definitions (1facd98).

Refactoring

• Move {{InfoBox}} and {{ImageFrame}} inline styles to static_css() classes (5f71637)
  and (22ceb2e).

Compare with v2.20.0