Hatamoto 0.x release notes

v0.32.0

Features

• homepage-layout: hero strip, split panel match height, cards container fix, one-per-line strip items (#242)
• admin-dashboard: /admin overview from shipped components and existing data (#243)
• admin-shell-auth: shell notices, auth pages, setup wizard, users/people/profile, shared partial follow-ups (#241)
• admin-settings: settings layout, confirm card, performance/updates KPIs, design tokens grid, plugins, API keys (#237)
• security: plugin markup without site.scripts: actions only in text or quoted values, via the HTML tokenizer (#238)
• homepage-shots: reproducible, framed homepage screenshots from a seeded demo (#233)

Fixes

• neutral default paths (check-neutral is red on main) (#240)

v0.31.0

Features

• release-rehearsal: local rehearsal on the public snapshot; fix 3 things it found (Stream R) (#236)
• admin-editors: one save model, phone editor chrome, entities list, versions (#235)
• sdk-0-12-stability: pin SDK 0.12.0, one refusal message, root STABILITY.md (#232)
• lint-cleanup: staticcheck 0 and blocking, write-path errcheck, neutral bans, fuzz targets (Stream C1) (#231)
• release-supply-chain: NOTICE, bundles, SBOM+attestations, signed tags, gated signed ghcr image, channels private (Stream D2) (#221)
• theme-directory: community theme submissions, signed builds and a /themes directory section (#228)

v0.30.0

Features

• admin: plugin issues as a Needs attention pill, details on the plugin page (#214)
• local-gates: git hooks enforce the CI gates locally (GitHub checks off) (#210)
• plugin-js-permission: site.scripts gates plugin JS, sections and partials (Stream A, P1 blocker) (#206)
• plugin_directory: spacing and shared-cache cap on builder pages (#213)
• plugins-page-in-theme: Plugin directory section so /plugins uses the site theme (#211)
• admin-component-contracts: component contract enforcer, token sweep, one date format, copy guide (#212)

v0.29.1

Features

• docs-layout-v2: edge-to-edge docs, Guides/Reference, cards, docs search, rewritten content (#190)

v0.29.0

Features

• admin-smtp-settings: configure SMTP from the admin (Settings > Email + setup step) (#191)
• B10 cleanup: one page model (page_sections frozen, classic editor removed) (#192)
• close-release-changelog: badges from the live manifests (canary, ramps, halts), ops/* filter, plan closed (#187)
• B9 hardening: budgets in make check, per-node version diff, strict-script CSP opt-in (#183)

Fixes

• API keys page uses default width so the key table doesn't scroll (#188)
• Backups and Performance no longer share the database icon (#184)

v0.28.0

Features

• backups: Settings > Backups, CLI, and a pre-update backup that covers plugins and blocks on failure (#181)
• fix-settings-goldens: settings-spam golden after #171 and #174 merged side by side (#179)
• B8 extension API: widget packs and plugin data sources (#177)
• hatamoto-dev-docs: in-depth docs site at /docs (layout, publish tool, 81 pages) (#170)
• form-spam-protection: enforced captcha (Turnstile/reCAPTCHA v3/hCaptcha) + invisible spam rules for public forms (#171)
• Tremor tabs, select/multiselect, combo chart, delta badges (#174)

Fixes

• spam Test connection tests the typed keys, no save needed (#180)

v0.27.1

Features

• B7 dynamic data: prop bindings and query loop (#173)
• plugin-directory: community plugin submissions, signed builds and a public /plugins page (#168)
• release-changelog: /changelog page in the footer, auto-drafted per release, editable in the CMS (#167)
• Theme primary nav (blocks and parts out of Entities) (#166)
• nightly-channel: canary as a third update channel (canary -> edge +2d -> stable +7d) (#164)
• calendar date range picker (SimpleOnboarding/Tremor style) (#165)

v0.27.0

Features

• light by default, header toggle for dark mode (#160)
• B6 reuse: templates, synced blocks, theme parts (#161)
• daterange-picker-polish: presets apply at once, tidier picker (#158)

v0.26.99

Features

• crawler-range-pills: drop the 7/30/90 day pills beside the analytics date picker (#156)
• schema-post-editor: settings.editor=post opts any type into the post editor (#155)
• resizable and collapsible builder sidebars (#153)
• person-profiles: one person record per human, owned by the user, replacing authors (#146)

v0.26.0

Features

• entities-subnav: Entities secondary sidebar (All + one entry per type) (#144)
• B5 design system (#152)
• B4 widgets and responsive (#151)

v0.25.0

The first Hatamoto 1.x release: the whole CMS rebuilt as one Go binary. Next.js is gone, the admin is server-rendered Go, plugins run as sandboxed WebAssembly, and installs keep themselves up to date from signed releases.

Features

• One Go binary serves the site, admin and API (serve, migrate, user, routes, version); Next.js removed (#80, #101)
• Go admin: entities, schemas, taxonomies, media, menus, forms, redirects, dashboards, users and settings (#89, #92, #93)
• Page editor with a live canvas, and a blog editor with slash menu, autosave and an SEO/AEO panel (#95, #98, #120, #123)
• Builder foundations: page_doc v2 model, canvas protocol v2 and the editor shell (#131, #132, #139)
• Themes: template hierarchy, archives, taxonomy, author and search pages, the default blog theme, theme data functions and section anchors (#81, #106, #107)
• WebAssembly plugins on Extism (wazero) with capabilities, a per-plugin database, routes and cron; signed packages and a registry that installs plugins and themes without a restart (#82, #84, #96, #108)

Fixes

• The sitemap lists the page the homepage serves and drops redirected paths (#138)
• Degraded plugin renders are never page-cached; separate deadlines and a per-function breaker (#109)
• Builder convert keeps the modified date (#142)
• Deploy rollback re-runs from the deployed commit and restores the database correctly (#78)