Changelog

0.13 — accounts limited to some sites, an accessible admin

0.13.1 (September 28, 2026)

• The admin was reviewed end to end against WCAG 2.2 AA: a "Stay signed in" dialog before a session is dropped, a command palette and confirmation dialogs that work fully from the keyboard, heading levels and names for screen readers, and a statistics chart that can also be read as a table.
• A refused page save no longer loses what was typed, and marks the wrong field.
• Badge, warning and state colours reach enough contrast in light and dark; the reduced-motion setting stops every animation.

0.13.0 (September 28, 2026)

• An account can be limited to some of an installation's sites, with a role per site. A limited account sees only its sites; people, modules, updates, backups and email stay with the administrators of the whole installation.
• The audit log records each entry's site; giving an administrator role asks for the password again, and a change that would remove the last administrator is refused.
• Two medium issues found by the authorization review before release were fixed: comment and forum notices could reach accounts of another site, and two sites' language settings could share one key.

0.10 — a build queue, right-to-left languages, addresses in any script

0.10.0 – 0.10.1 (September 27, 2026)

• Build queue: the saved page is written at once, while lists, feeds and full rebuilds follow in the background. Measured, saving a post went from 1.6 seconds to 0.11, and the "Rebuild site" button from 7.5 seconds to 0.04.
• Arabic, Persian, Hebrew and Urdu pages are drawn right to left.
• Titles in non-Latin scripts keep their letters in the address; Latin addresses did not change.
• An Atom feed for every blog tag and forum category; AVIF image copies where the server supports them.
• Queue review: a page that crashes its process no longer blocks the queue; it is skipped and reported.

0.9 — accessibility and an independent security review

0.9.0 – 0.9.3 (September 27, 2026)

• A WCAG 2.2 AA audit of the live sites: a sticky header no longer covers the focus, page titles name the site, links that open a new tab say so.
• A refused visitor form is drawn again with each error beside its field and everything typed kept.
• Optional MySQL/MariaDB support; a tool to move in either direction, the same backup format for both.
• An independent security review found two high issues, both fixed: server directives could be smuggled into the exported redirect rules, and accepted visitor submissions had no rate limit. There is now a submission budget per address and per site, and notifications are queued.
• Admin sign-in is limited per address and per account name; the installation and upgrade guides were followed end to end on a clean machine.

0.5 — cookieless statistics, Atom, a full export

0.5.0 (September 27, 2026)

• Built-in statistics: views, daily visitors, the most read pages, referring sites. No cookie, no IP address, no third party.
• An Atom feed beside RSS in every language, a forum feed, a time zone per site, dates in the page's language.
• An export that puts the whole site into one file in an open, documented format; the same file reads into another installation. Imports from feeds and from several publishing platforms' exports.
• Security review: an import file from elsewhere can no longer write a redirect over a live page.

0.4 — a broken link report, a faster first paint

0.4.0 – 0.4.4 (September 26, 2026)

• A broken link report that checks every internal link against the files on disk; the language switcher now links only to translations that exist.
• 480/960/1440 px copies of images, with srcset.
• The CSS a page uses is inside the page: on a slow mobile connection, first paint went from about 1.3 seconds to 0.65.
• 15 correctness bugs found by an independent code review, each fixed after a test that caught it. End-to-end tests that use the admin in a real browser the way a person does.