Improvements
- adopt go-pkgz/rest v1.22.0: CORS Vary + enforcing Timeout, drop local reimplementations #2105 @paskal
- replace go-chi/chi router with go-pkgz/routegroup #2103 @paskal
- replace go-chi/cors with go-pkgz/rest CORS #2102 @paskal
- use stdlib http.ServeMux instead of chi in cleanup_test #2101 @paskal
- consolidate request middlewares into middleware.go #2100 @paskal
- replace chi middleware.RealIP with rest.RealIP on the main router #2099 @paskal
- replace chi middleware.NoCache with rest.NoCache on the main router #2098 @paskal
- replace chi middleware.Timeout with the timeout helper, drop chi/middleware #2097 @paskal
- replace chi middleware.Throttle with rest.Throttle on the main router #2096 @paskal
- migrate ssl.go TLS routers from chi to routegroup #2095 @paskal
- update frontend and site dependencies to latest, bump pnpm to 10, clear audit alerts #2091 @paskal
- update backend dependencies to latest #2088 @paskal
- bump the github-actions-updates group across 1 directory with 4 updates #2092 @app/dependabot
- bump webpack-dev-server from 4.9.3 to 5.2.4 in /frontend #2063 @app/dependabot
- bump postcss from 8.4.14 to 8.5.10 in /frontend #2056 @app/dependabot
Bug Fixes
- sanitize comment text in email notifications (GHSA-74pc-3r2m-ppx3) #2093 @paskal
- add --trusted-proxy to gate client-IP forwarding headers #2116 @paskal
- warn on catch-all trusted-proxy, cover more cases, trim wording #2118 @paskal
- surface real avatar-store errors on deleteme, tolerate only not-found #2113 @paskal
- remove user avatar on deleteme request #2104 @paskal
- make user deletion idempotent for users without comments 3fc5d6b
- ui error when no auth providers configured 406df02
- guard against falsy outputPath in eleventy htmlmin transform #2094 @paskal
- handle REST shutdown before server start 589e956