Hey there,

This is a follow up post with the changes made to the site for the v3.0.0 update.

Security

• Moved blog posts out of wwwroot, because unpublished drafts could be read at /posts/{id}.json. Posts in the old location are moved automatically on startup.
• Sanitized post bodies when saving and serving them, so a post can't run scripts for readers or in the editor.
• Moved staff passwords to salted PBKDF2. Older hashes still work and are upgraded when that account next logs in.
• Removing an account now locks it out immediately, and changing or resetting a password ends every other session on that account.
• Removed the CORS policy that let any site call the API.

Added

• Added an image to link embeds in Discord and other platforms.
• Added a new favicon and home screen icons from the Ellie artwork.

Fixed

• Fixed the Markdown editor corrupting links, images and inline code that contain underscores or asterisks. This applies to newly written Markdown; posts already saved keep their stored HTML.
• Fixed re-saving a post corrupting it by converting its HTML again. Posts now store their Markdown, and older posts are edited as HTML.
• Fixed saving a new post twice, or using + New Post while editing, creating duplicate posts.

Changed

• Public pages and read-only API routes are now served by the Astro site directly, and keep working if the ASP.NET API is down. The site version now comes from web/package.json.
• Removed the ASP.NET backend. The whole site now runs on Astro and Node.js, and uses the same data volumes.
• Logins, account changes, post editing, avatar uploads and team management are now handled by the Astro site. Existing logins and passwords keep working. Malformed requests now get a 400 rather than a 500.
• Same-day posts now stay in a fixed order, most recently created first.
• New accounts can only be given the admin or author role.
• Jwt__Secret is now set once at the top of compose.yaml, and the Astro site won't issue logins with the placeholder value.
• Redesigned the site with a floating pill nav, a darker background with soft glows, rounded buttons and a new rounded heading font.
• Redesigned the home page hero with the Ellie artwork, a two-tone wordmark, and stars over a slowly drifting aurora. The animation stops for visitors who prefer reduced motion.
• Replaced the stat boxes on the home page with a single line under the hero buttons, and made Invite the main button in the nav.
• Reworked the footer into columns of links on every page, including docs, source code, releases and donations.