v0.3.0

Released: 2026-06-07

Changes since v0.2.0 (61d00bd..e924858).

Features

• Wikilinks and backlinks (PR #62 by @HugoluizMTB): [[Note Title]] syntax renders as a link to the matching note, and each note shows the other notes that link to it.

• Fish shell support (PR #70 by @rafaeloledo): The fed / fed-update / fed-stop helpers are now available for fish in ~/.config/frankmd/fed.fish, with full parity to the bash version (browser detection, env-var forwarding, images-mount lookup).

• Custom Hugo frontmatter template (closes #69): Drop a .hugo_template.md file at the notes root to fully customize the generated frontmatter. Placeholders {{title}}, {{slug}}, and {{date}} are substituted on each new post. Falls back to the built-in template when absent.

• Hugo flat path style: New hugo_path_style = flat config option to keep all posts as slug.md in the current folder instead of the nested YYYY/MM/DD/slug/index.md structure.

• Configurable Thruster ports (PR #43 by @rafaself): THRUSTER_TARGET_PORT and EXTERNAL_PORT are honored by the Docker entrypoint and compose setup.

• Copy button on code blocks in preview mode.

• AI-assisted contributions guide: New AGENTS.md and CLAUDE.md documenting the architecture, conventions, and rules for AI-assisted work in this repo.

Bug Fixes

• macOS browser auto-detection (PR #89, fixes #86 reported by @matheus-rodrigues00): fed now also looks up .app bundles under /Applications/ on macOS in the same priority order as the Linux PATH probe. FRANKMD_BROWSER also accepts a full executable path.

• Saving failed (422) over Cloudflare Tunnel (fixes #63 reported by @davidvidmar): Rails' forgery_protection_origin_check compared the browser's https:// Origin against the http:// base URL it computed behind the SSL-terminating proxy, rejecting every save even though the CSRF token was present and valid. Disabled the origin check in production; the CSRF token itself still protects writes.

• Hugo template emitted a stray hyphen (fixes #69): The generated frontmatter had tags: followed by a bare -, a null YAML list entry that breaks Hugo. Now emits the valid empty list tags: [].

• Broken symlinks in notes directory caused 500: A dangling symlink (e.g. a file linked to a path that doesn't exist inside the container) made NotesService#build_tree raise Errno::ENOENT from File.mtime, taking down every page that listed the tree. Filter children through exist? so a single broken link no longer takes the whole site down.

• Image and asset files in notes directory not served in preview: Preview now reads image and asset files alongside markdown.

• Occurrence highlighting confusing with multi-selection.

• Active line highlight persisting when editor loses focus.

• Ollama models failing with ModelNotFoundError.

• Folder images appearing grayed out and unselectable in image picker.

• Controller config action overrode Rails internals: Renamed to avoid the collision.

• Omarchy README links fixed (PR #45 by @matheusdcunha).

Refactor

• Image generation moved to RubyLLM + OpenRouter: Replaced direct Gemini HTTP calls with RubyLLM through OpenRouter for image generation, with a small monkey-patch to surface the OpenRouter response shape.

Security

• Cleared transitive CVEs for addressable (ReDoS), erb (deserialization guard bypass), faraday and faraday-net_http (protocol-relative URI host-scoping bypass), and net-imap (SCRAM iteration DoS, STARTTLS stripping, command-injection via raw / Symbol arguments). All bumped to patched versions.

Dependencies

• Rails 8.1.3
• puma 7.2.0 -> 8.0.2 (with an explicit bind "tcp://0.0.0.0:..." in config/puma.rb so Thruster and Docker keep working regardless of puma 8's IPv6-by-default behavior)
• ruby_llm 1.14.1 -> 1.15.0
• thruster 0.1.20 -> 0.1.21
• aws-sdk-s3 1.218.0 -> 1.225.0
• bootsnap 1.23.0 -> 1.24.6
• jbuilder 2.14.1 -> 2.15.1
• propshaft 1.3.1 -> 1.3.2
• selenium-webdriver 4.41.0 -> 4.44.0
• addressable 2.8.9 -> 2.9.0, erb 6.0.2 -> 6.0.4, faraday 2.14.1 -> 2.14.2, faraday-net_http 3.4.2 -> 3.4.4, net-imap 0.6.3 -> 0.6.4 (transitive, security)

Infrastructure

• bin/deploy script for one-command production deploys (build + push + restart).
• .lobster/ agent artifacts gitignored.

Test Coverage

• 449 Ruby tests, 1,393 JavaScript tests (1,842 total)