Released: 2026-03-11. Diff.
Version rationale: patch for additive Go time expansion plus website/dependency hardening without import-model or runtime floor changes.
Expansion
- Added
golang/time/ParseInLocation, interpreting wall-clock inputs in a supplied IANA time zone while preserving deterministicDateoutput and parity coverage around DST boundaries.
Modernization
- Removed root dev dependencies that are now replaceable with Node 22 built-ins or tiny local helpers:
globbyindent-stringlodashrimraf
- Replaced cleanup scripts with a small Node-based remover and bumped the remaining low-risk root tooling deps.
Website
- Added a website build verification harness for representative generated pages, redirects, feed output, and search-index output.
- Updated CI to run website build verification on pull requests as well as
main, so website dependency upgrades get a pre-merge safety net. - Upgraded
website/fromhexo-generator-feed@3tohexo-generator-feed@4, added a small Hexo route patch to preserve Atomtype="html"semantics, and revalidated the site with a clean rebuild plus the website verification harness. - Removed stale website-only packages from the website build/deploy dependency set:
hexo-browsersynchexo-migrator-rsscross-spawn-async
- Added targeted
website/lockfile resolutions so current Hexo packages pick up patcheddompurify,filelist,minimatch, andtarreleases without changing the website feature set. - Kept
yarn website:starton the simpler Hexo-only preview path: it still opens the browser automatically, but live
reload is no longer provided by BrowserSync and local preview now uses manual refresh after edits.
Security
- Added root lockfile resolutions for patched transitive releases in the current tooling stack, including
ansi-regex,brace-expansion,braces,cross-spawn,glob,hosted-git-info,minimatch,rollup, andsemver. - Pinned
node-gyp@latestto the current release so the root workspace now resolves through the patchedmake-fetch-happen/cacache/tarchain.