velocitykode/velocity v0.82.2

on GitHub

Everything since v0.76.3 (v0.77.0 through v0.82.2).

Breaking

• str.Markdown and str.InlineMarkdown now render CommonMark + GFM instead of stripping a regex subset; new markdown package behind them.
• auth.ServerSessionStore.Touch replaces the scheme-side activity refresh so a revoked session cannot be resurrected.
• Login throttling reserves a trial before verifying and adds progressive delay per identifier; contract.LoginDelayer / LoginAdmitter hooks and Manager.SetLoginChallenge.
• orm/seed reshaped: seeders register through App.Seeders / SeederModule, not a package-global registry.

Added

• markdown package: safe-by-default rendering, container directives, titled code blocks, markdown.LoadFS collections.
• Database seeders: App.Seeders, vel db seed, vel gen seeder, vel migrate fresh --seed.
• session.NewCacheStore: cache-backed session store with atomic revocation; contract.CacheReplacer capability.
• Router answers 405 with an Allow header when the path exists but the method does not.

Fixed

• ORM plural reads (Get, Pluck, Paginate, RawQuery.Get, eager-loaded hasMany / manyToMany) return an empty slice instead of nil, so empty lists encode as [] (#8).
• Bind / BindXML reject trailing data after the document.
• Redirect targets reject control bytes.
• str.Title and str.Headline are safe for concurrent use.
• Scaffold generators keep the overwrite guard at write time.
• Starters no longer rewrite the request from forwarded headers by default.
• grpc bumped to v1.83.2.

Details and migration notes: CHANGELOG.md.