P0 blockers:
- Fix migration numbering conflict and duplicate indexes
- Change comments.post_id FK to ON DELETE CASCADE
- Restrict public post detail endpoint to published posts only
- Fix rate-limiting IP extraction and fallback to ConnectInfo
- Harden HTML sanitizer: deny unknown URL schemes, restrict data URIs
- Remove session token from login response body
- Enforce image pixel/dimension limits on upload and serving
P1 high-risk:
- Validate uploads by magic bytes and decode GIF/WebP
- Add pagination/rate-limiting to search, tag posts, and comments
- Make first-admin registration and slug uniqueness check atomic
- HTML-escape comment author fields
- Improve HTML minify cache key and skip admin/error responses
- Add mobile navigation menu
P2 accessibility/quality:
- Associate form labels with inputs
- Key PostDetail article by slug to re-init scripts on navigation
- Improve image viewer keyboard accessibility
- Make theme toggle SSR-friendly and add aria-label
- Invalidate slug 404 cache on create and pending count on new comment
- Deduplicate tags case-insensitively
P3 cleanup:
- Remove unused tower-http dependency, expand make clean
- Configure DB pool timeouts and verified recycling
- Run background cleanup tasks immediately on startup
- Use SHA-256 for stable disk cache keys
- Log DB errors with Display instead of Debug
- Update README migration instructions
All tests pass (321), clippy clean, dx check clean.
- Add lol_html-based HTML whitespace minifier (utils/html_minify.rs)
that collapses whitespace and strips comments while preserving
<pre>, <code>, <textarea>, <script>, <style> content
- Add Axum middleware (middleware/minify_html.rs) that minifies
text/html responses with per-URL moka cache (256 entries, 300s TTL)
- Wire middleware into the server router in main.rs
- Add CSS minifier to generate_highlight_css build step
- Apply minify_html to rendered markdown output and TOC
- Add http-body-util dependency for body collection in middleware
- Add tests for sanitizer, mime_to_ext, clean_tags, Theme::toggle
- Tighten assertions in highlight, markdown, post status classes
- Add boundary and XSS cases for comments, slug, rate_limit, webp
- Update Cargo.lock for serial_test dev-dependency
- Cache ammonia::Builder with LazyLock (was rebuilt per request)
- Enable tracing release_max_level_info to strip tracing overhead at compile time
- Remove TraceLayer and tower-http trace feature from production
- Increase DB pool size 10→20 (configurable via DB_POOL_SIZE)
- Increase SSR cache TTL 300s→3600s (configurable via SSR_CACHE_SECS)
Benchmark: 7,444 → 9,840 req/s, P99 latency 27.6ms → 11.1ms
- Replace image crate's WebP with zenwebp for better quality/speed
- Add webp.rs module with configurable quality and method
- Update .env.example with WEBP_QUALITY and WEBP_METHOD
- Add WebP decode support in image serving pipeline
- Add detailed timing logs for WebP conversion
- Remove tower_governor (unused, governor used directly instead)
- Remove tower-http fs feature (only trace is used)
- Remove 4 unused web-sys features: HtmlDocument, HtmlScriptElement, HtmlButtonElement, HtmlElement
- Slim tokio features from full to rt-multi-thread,macros,fs,time,sync
- Enable yaml-load feature in syntect to support loading .sublime-syntax files
- Load custom syntax definitions from syntaxes/ directory via SyntaxSet::into_builder
- Add Swift and Kotlin syntax definitions as .sublime-syntax files
- Fix alias table to properly resolve full language names (javascript,
typescript, python, swift, kotlin, golang) via file extension lookup
- Redirect ts/typescript to JavaScript highlighting (syntect v5.3.0 does not
support TypeScript's Sublime Text v2 syntax format)
- Add documentation comments to generate_highlight_css.rs binary
wasm-split is incompatible with Dioxus fullstack SSR/hydration.
The feature causes hydration failures because split WASM chunks
are not available during client-side hydration of server-rendered HTML.
Changes reverted:
- Remove wasm-split feature from dioxus and dioxus-router
- Remove --wasm-split flag from dx build in Makefile
Enable Dioxus 0.7 automatic WASM bundle splitting by route:
- Add wasm-split feature to dioxus and dioxus-router in Cargo.toml
- Add --wasm-split flag to dx build in Makefile
- Router definitions stay as plain #[route] — splitting is automatic
Dioxus 0.7.9 handles splitting automatically when the feature and
CLI flag are enabled. Per-route #[wasm_split] attributes are not
required (and not supported by this version's derive macro).
