Algernon: vanhemmat versiot ja versiohistoria

- Improve value conversions in Lua, ref #119.
- Improve the experimental WebAuthn support.
- Add the --strict-symlinks flag, for not following symlinks that lead out of the served directory.
- Add htmlescape and use it in serverconf.lua.
- Keep the server log and the access logs open, instead of opening and closing them for every line + improve log rotation abilities.
- Rewrite the reverse proxy to use httputil.ReverseProxy.
- Only look ahead at proxied responses that have a Content-Length.
- Also log requests that are handled by a reverse proxy.
- Store Let's Encrypt certificates in $XDG_DATA_HOME/certmagic, $HOME/.local/share/certmagic or /var/lib/algernon.
- When using --domain, also serve the localhost directory for the current IP addresses.
- Add the --dirbaseurl flag, for placing a base URL in front of the links in the directory listing, ref #90.
- Add the SetDirBaseURL Lua function that can be used from serverconf.lua, for the same purpose as --dirbaseurl.
- Replace the graceful package with http.Server.Shutdown from the standard library.
- Set new log files to mode 0640.
- Reject AddReverseProxy endpoint URLs that have no scheme or host.
- Improve how certmagic-related events are logged.
- Improve how --letsencrypt starts and retries.
- Update dependencies.
- Update documentation.

- Fix empty responses when served by reverse proxies, ref #175, thanks @Archie3d.
- Fix a security issues related to paths like /%2fadmin/, thanks @arpitjain099.
- Update dependencies.
- Update documentation.

- Also support case-insensitive file systems when checking for permissions (thanks @manus-use).
- Fix issue #122, open the internal log file with different flags.
- Fix the flag precedence issue, ref #145.
- Make the path handling more robust in connection with React / Hot Module Replacement.
- Render more types of Lua tables, ref #119.
- Encode filenames in connection with the directory listing, ref #144.
- Add the remoteaddr function, ref #114.
- Let KeyValue also support table values, ref #113.
- Add support for global.lua files for initializing the Lua pool, ref #103.
- Also allow SIGUSR2 to clear the cache, thanks @MatrixNeoKozak, ref #174.
- Make argument handling more robust.
- Handle 127.0.0.1 and ::1 as localhost when serving domains.
- Add -D as a short flag for --domain.
- Use html/template for the error message page.
- Escape filenames in error messages when in debug mode.
- Make HMRUpdateHandler more robust.
- Use encodeURIComponent in the registration for example.
- Make two path-related errors into warnings.
- Fix and update the dockerfiles.
- Add container files and scripts for Podman.
- Use the correct host for the auto-refresh feature.
- Update dependencies.
- Add an example that uses SQLite.
- Update example projects.
- Add more tests.
- Add "make cover" for checking the test coverage.
- Use build-time platform detection whenever possible.

Security related
- Add a check for special Windows/NTFS filenames (only applies on Windows). Thanks @Dredsen.
Memory usage while processing data
- Use io.Copy in the reverse proxy to bound memory usage.
- Limit the request body buffer size.
Configuration related
- If HTTP and HTTPS ports are specified, then also use those for ACME / Let's Encrypt. Fixes #173, thanks for the feature request + testing @DaVyze.
- Add a max size check (int64) for the --largesize flag.
- Add a check for if --domain is given, without any certificates/keys being given.
- Restructure how addresses, ports, certificates and protocols can be configured, while still supporting the same flags and arguments.
Other improvements
- Make the React support a bit smarter with top level element detection.
- Improve the ServerInfo() output.
General
- Require Go 1.26.
- Update Dockerfiles.
- Add more tests.
- Update documentation.
- Update dependencies.

Security related
- Fix possible path traversal when --domain is used (thanks @fg0x0).
Fixes
- Fix a possible file descriptor leak after trying to write to /dev/shm.
- Fix a possible issue with setting header values when proxying.
New functionality
- Add new functions for using SQLite, ref #156 (thanks for the feature request, @judell).
- Add support for compiling TypeScript and rendering index.tsx files, ref #166 (thanks for the feature request @fayakun-it-consulting).
- Add multiple ways of specifying ports and protocols, ref #173 (thanks for the feature request @DaVyze).
Other improvements
- Improve how JSX and TSX files are cached.
- Improve error handling when extracting .alg files.
- Add a --noninteractive flag as an alias for the less descriptive --server flag, and also deprecate the --server flag. The short -s flag remains unchanged, and the --server flag is still supported.
- Improve the Lua plugin system wrt. oncurrency.
- Let the desired React version be specified in a comment in index.jsx/index.tsx instead of in an .algernon file. Currently only React 19 is supported and can be specified like this: // React: 19.
- Add more Lua functions for building HTML output programmatically by using the github.com/xyproto/onthefly package.
- Prioritize configuration values from command line flags first, then positional arguments and then serverconf.lua.
Examples
- Add two new example projects under samples/react_tsx and samples/onthefly.
General
- Update dependencies.
- Update documentation.

Security related
- Clamp handler.lua parent walk to server root, thanks @Dredsen.
- Use the main mux when serving SSE for the auto-refresh feature, thanks @Dredsen.
- Add a --hide-dotfiles for not serving hidden files, thanks @Dredsen.
- Don't enable debug mode automatically when single-file mode is used, thanks @Dredsen.
New features
- Embed React 19 and support index.jsx files, for npm-less use of React.
Examples
- Update the HyperApp example so that it does not use a token for downloading images.
- Add an example project named Catbook here: https://github.com/xyproto/catbook
Database related
- Update all database-related dependencies.
- Fix an issue in the built-in Bolt database support, where retrieving the last N items from a list with less than N items could return an empty list.
- Use an sqlite package that does not require CGO.
Performance
- Cache the per-directory .algernon configuration.
New Lua functions
- Add a formjson Lua function for returning the posted form as JSON.
- Add support for WebAuthn by adding 4 new Lua functions.
- Add the maxlen, methodPOST and list:jsonlast and jsonembed functions.
General
- Update dependencies.
- Update documentation.

What's Changed
- Bump golang.org/x/crypto from 0.44.0 to 0.45.0 by @dependabot[bot] in #168
Full Changelog: v1.17.5...v1.17.6

Fixes
- Fix HTML detection, ref #164 (thanks @astynax).
Security
- Add an initial Security.md file.
- Add extra sanitation / XXS protection (thanks @Bnyt7).
New features
- Add support for serving the QOI image format.
Code quality
- Simplify favicon / mimetype related code.
- Remove some unused code.
Documentation
- Add more documentation, ref #163 (thanks @myselfghost).
- Add an example for HTMX.
Performance
- Build release executables with GOEXPERIMENT=greenteagc.
Lua related
- If a single file is given as an argument, don't output the server name and version (to make Algernon more suitable for being used as a "Lua runtime", ref #163).
General
- Update CI configuration.
- Update dependencies.

- Fix a missing m character when drawing the banner/logo at start.
- Also show the banner/logo at start on Windows.
- Add HTML sanitization of the filename for the "file not found" page". This fixes an XSS issue.
- Switch from vt100 to the vt package.
- Update go.mod, ref #159.
- Update CI configuration.
- Remove FUNDING.yml.
- Update documentation.
- Update dependencies.

Fixes
- Only listen for the USR1 signal on some platforms. Fixes #157 (thanks for reporting, @kris6673).
New features
- Add a run3 function, ref #158 (thanks for reporting, @myselfghost).
- Add print_nonl that can be used in connection with flush.
- Add the mprint_ret function that can return required JS code instead of inserting it.
- Let flush, redirect and permanent_redirect return true if the connection was not closed when sending.
- Add support for ie. lang: en and language: en in Markdown files.
Updates to the sample projects
- Improve the "mathematical formulas" sample.
- Add a typewriter / server-side flush sample.
- Set the language to en for 3 of the samples.
Various
- Improve error handling in connection with recorders and flushing.
- Improve some warnings and error messages.
- Build with -ldflags "-s -w" -buildvcs=false by default in the Makefile.
- Add an informative message when serving README.md files without -m.
- Update documentation.
- Update dependencies.

Fixes
- Use net/http instead of fasthttp for serving regular HTTP to make the flush() function work again, ref #124 (thanks @diyism and @myselfghost).
- Add support for SQLite, ref #134 (thanks @bearinld004 and @judell, and especially @terminar for creating permissionsqlite).
- Fix #155 by skipping empty <h1></h1> tags (thanks @qithron).
New features
- Make it possible to clear all cache by sending a USR1 signal to Algernon.
- Add a new Markdown theme named setconf.
Various
- Add three new samples.
- Minor performance improvements.
- Some refactoring and cleanup.
- Update documentation.
- Update dependencies.

Platform compatibility
- Patch the pingcap/tidb dependency so that Algernon still compiles for ARM 6 and ARM 7.
Ollama / LLMs
- Add the oc:distance() Lua method for finding the distance between two LLM prompts.
- Let the embeddedDistance Lua function take a 3rd argument: euclidean, manhattan, chebyshev, hamming or cosine.
- Improve the image description example.
Markdown
- Improve how images are served when serving a single Markdown document.
- Fix the double opening of the browser when both -m and -o are specified.
Various
- Also cache .webp images, if caching of images is enabled.
- Update dependencies.
- Update documentation.