perber/leafwiki v0.14.0

LeafWiki v0.14.0

on GitHub

📝 Changelog for v0.14.0

PDFs now embed right in the page, LeafWiki speaks French and Simplified Chinese,
and admins can make the table of contents always visible. Most of the rest of
this release is hardening: how uploaded files are served, how sessions end after
a password change, and how search handles odd input.

🌟 Highlights

• PDF embeds: link a PDF and it renders inline in the page. Only same-origin
  PDFs are embedded; external ones and mobile get a file card with an open
  button. (#1582, #1633, #1637, #1592)
• French and Simplified Chinese UI translations. (#1584, #1587)
• Always show TOC: a new instance-wide admin setting. (#1576)
• Search: opening a result scrolls to the first match (#712, #1389), and
  search no longer crashes on punctuation or unusual FTS5 syntax. (#1578, #1632)
• Git backup: LEAFWIKI_GIT_BACKUP_PATH to choose where the backup
  repository lives (#1563), and runs without changes are much faster because
  existing objects are no longer rewritten (#1635).
• Links: ambiguous [[Title]] links are no longer reported as broken. (#1615)
• Full backups now include the public-access and TOC settings. (#1634)

⚠️ Behavior changes

• Uploaded files outside images, PDF, audio and video are now downloaded
  instead of opened in the browser. Links to .svg, .txt, .md, .csv,
  .json or .html assets trigger a download. SVGs embedded as images still
  render. This closes a stored-XSS vector via uploaded files. (#1622)
• Changing a password ends that user's other sessions. Other devices are
  signed out once their current access token expires (15 minutes by default),
  not instantly. (#1630)
• Updating users via PUT /users/:id is admin-only. Admins change their own
  password in Account Settings, not in User Management. (#1630)

💛 Thanks to our sponsors

A heartfelt thank you to everyone supporting LeafWiki via GitHub Sponsors & Ko-fi.
If you'd like to support LeafWiki too: GitHub Sponsors or a one-time coffee on Ko-fi

🙌 Thanks to contributors

@richardmilles, @Hugo-Galley, @lboehm, @jochumdev, and @yuyami-ya — for the PDF
embed, the French translation, the git backup path, scroll-to-match, and fixes in
this release. Contributions like these are what make LeafWiki better than one
person could build alone.

✨ Features

• feat(viewer): scroll to first search match when opening a result (#712) (#1389) (@richardmilles)
• feat(chatops): add /command for build test pr in PR (#1355) (@Hugo-Galley)
• feat(local): add french langage (#1584) (@Hugo-Galley)
• feat(i18n): add Simplified Chinese (zh) locale (#1587) (@perber)
• feat: pdf embed (#1582) (@lboehm)
• feat(viewer): add instance-wide "always show TOC" admin setting (#1576) (@perber)
• feat(git): implement LEAFWIKI_GIT_BACKUP_PATH (#1563) (@jochumdev)

🐛 Bug Fixes

• fix(preview): show a file card instead of a bare button for non-embedded PDFs (#1637) (@perber)
• fix(preview): only embed same-origin PDFs as iframe (#1633) (@perber)
• fix(backup): include public access and TOC settings in full backups (#1634) (@perber)
• fix(search): only trust well-formed operator fields in FTS5 queries (#1632) (@perber)
• fix(links): use tagged switch in classifyTitleMatches (staticcheck QF1002) (Patrick Erber)
• fix(links): store link state (resolved/broken/ambiguous), fix ambiguous wikilinks listed as broken (#1615) (Patrick Erber)
• fix(ui): prevent image preview label clipping (#1628) (@yuyami-ya)
• fix(assets): serve uploaded assets with nosniff and download disposition (#1622) (@perber)
• fix(scripts): resolve GitHub handles in changelog output (#1602) (@perber)
• fix(ui): close dialog before navigating to avoid render race flicker (#1601) (@perber)
• fix(viewer): remove bullet marker from GFM task list items (#1600) (@perber)
• fix(viewer): hide Attached Media label when TOC sidebar is collapsed (#1597) (@perber)
• fix(viewer): show downloads label on mobile TOC button when there are no headings (#1596) (@perber)
• fix(preview): show open button instead of PDF iframe on mobile (#1592) (@perber)
• fix(ci): grant pull-requests:write to build job for the reaction (#1594) (@perber)
• fix(ci): don't let reaction-API flakiness block the build-image-pr job (#1593) (@perber)
• fix(ci): split build-image-pr into secret-free build + code-free push (#1591) (@perber)
• fix(ci): use GHCR_GITHUB_TOKEN for build-image-pr push (#1590) (@perber)
• fix(preview): recover Mermaid diagrams from stale chunk-load failures after redeploy (#1589) (@perber)
• fix(search): stop search crashing on punctuation and edge-case FTS5 syntax (#1578) (@perber)
• fix(preview): remove oversized vertical margin around inline images (Patrick Erber)
• fix(viewer): show page attachments in mobile ToC dropdown (Patrick Erber)
• fix(backup): stop browser autofill from silently overwriting git backup credentials (Patrick Erber)
• fix(editor): flatten paragraph-wrapped table cells when pasting (Patrick Erber)
• fix(shortcuts): stop advertising Explorer/Search hotkeys on Settings (Patrick Erber)
• fix(install): align revision prompt wording with docs (richardmilles)

🧾 Documentation

• docs(issue-template): split platform info into Browser, Client OS, Server OS (#1598) (@perber)
• docs: add Kubernetes deployment example (#1599) (@perber)
• docs(readme): describe the tree-toolbar Refresh button for resync (Patrick Erber)
• docs(readme): note shipped UI languages and welcome translation contributions (Patrick Erber)
• docs(i18n): document how to add a UI language (#1546) (@perber)
• docs: document SMTP, language and git-backup-HTTP flags for v0.13.0 (#1545) (@perber)

🔧 Refactoring

• refactor(users): restrict user update to admins, end sessions on password change (#1630) (@perber)
• refactor(settings): extract shared internal/core/settings store (Patrick Erber)

🧪 Tests

• test(e2e): cover features and fixes since v0.13.0 (#1636) (@perber)

🧰 Chores

• chore: bump source-map-js from 1.2.1 to 1.2.2 in /ui/leafwiki-ui (#1631) (@dependabot)
• chore: bump @types/node in /e2e in the e2e-dependencies group (#1626) (@dependabot)
• chore: bump the npm-dependencies group in /ui/leafwiki-ui with 6 updates (#1625) (@dependabot)
• chore: bump the go-dependencies group with 2 updates (#1624) (@dependabot)
• chore: bump the npm-dependencies group across 1 directory with 29 updates (#1611) (@dependabot)
• chore: bump the e2e-dependencies group in /e2e with 8 updates (#1609) (@dependabot)
• chore: bump brace-expansion from 5.0.9 to 5.0.12 in /e2e (#1620) (@dependabot)
• chore: bump dompurify from 3.4.13 to 3.4.16 in /ui/leafwiki-ui (#1621) (@dependabot)
• chore: bump brace-expansion from 5.0.9 to 5.0.12 in /ui/leafwiki-ui (#1619) (@dependabot)
• chore: bump undici from 8.10.1 to 8.11.2 in /ui/leafwiki-ui (#1618) (@dependabot)
• chore: bump alpine from 28bd5fe to 294b683 (#1606) (@dependabot)
• chore: bump the go-dependencies group with 6 updates (#1605) (@dependabot)
• chore: bump node from 2d984a1 to 0b36e8c (#1607) (@dependabot)
• chore: bump golang from 4c9fe60 to 8a5910f (#1608) (@dependabot)
• chore: bump the github-actions group with 2 updates (#1610) (@dependabot)

🔹 Other Changes

• perf(backup): don't rewrite git objects that already exist (#1635) (@perber)
• perf(tree): don't register rows in collapsed branches as drag/drop targets (Patrick Erber)
• ci(build-image-pr): react to trigger comment and post built image as PR comment (#1588) (@perber)