Security

• Increase minimum DOMPurify version to 2.0.16 due to recent upstream security advisories

Security

• Increase minimum DOMPurify version to 2.0.16 due to recent upstream security advisories

Security

• Increase minimum DOMPurify version to 2.0.6 due to recent upstream security advisories

Security

• Increase minimum DOMPurify version to 2.0.6 due to recent upstream security advisories

Security

• Bump Dockerfile base image to Alpine 3.8.1 to fix an apk remote code execution vulnerability

This will be the last release line to support Node.js 4, 5 and 7.

Improved

• Backport Docker image infrastructure

Fixed

• Backport fix for non-public images always returning 403 Forbidden (#1438)

Changed

• Bump gm version out of caution to pull in a fully security-patched debug

Improved

• Generate startup log warnings on bad configurations, including insecure secret values and internal parameters
• Add a Dockerfile
• Added zero-downtime upgrade support

Changed

• Update deps
• Enable some more tests and start tracking code coverage with Coveralls
• Expand package.json metadata
• Clarify semver-major local modification policy
• Move most documentation to ReadTheDocs (#1496)

Fixed

• bin/pump-import-collection no longer crashes due to an underscore-contrib reference
• Fix the logged-out mobile homepage's menu icon being black (#1445)
• Fix the JavaScript license page not loading Bootstrap properly (#1432)
• Fix some README config options
• SockJS connections no longer fail due to authorization problems (#1475)

Fixed

• Fix the package shipping with .jade.js files built from the 5.0.x releases

Security

• Fix multiple denial-of-service security vulnerabilities in indirect dependencies