Accent CMS 0.24 — now available
Accent CMS 0.24.0 is out. Three of its changes need action when you upgrade, so they come first.
accent serve now uses HTTPS in development. A bare accent serve
binds TLS with a cached self-signed certificate and negotiates HTTP/2
instead of plain HTTP/1.1. The reason is the live-reload stream: it is a
long-lived server-sent-events response, and over HTTP/1.1 it permanently
occupies one of the six connections a browser opens per origin, leaving
five for everything else. Under a reload reconnect, a fresh navigation
and parallel asset loads, a request could sit waiting for a free slot –
the “sometimes a request just hangs” report. HTTP/2 multiplexes every
stream over one connection, so the contention does not exist. If a
script or CI job fetches http:// from a dev server, either switch it to
https:// or add the new --no-tls flag, which restores the previous
behaviour exactly. accent serve --production is unchanged and still
binds plain HTTP.
The plugin registry is now the ecosystem hub, and older binaries
cannot read it. One registry serves plugins, themes and starter
templates, each version listed as a single checksummed, signed archive.
A pre-0.24 accent fails against it with a 404; the remedy is to
upgrade, and there is no shim, because the two formats share no
document. Nothing was ever installed from the old one – it never held an
entry – which is why the break was worth taking now rather than never.
Plugins reach the host through typed capabilities, not HTTP. Sending
mail and using the data store now go through a WIT capability that a
plugin opts into in its manifest, and the /_internal/* endpoints they
used to POST to are gone. Two things follow that the bridge could not
do: host services work during accent build, and a plugin’s data
namespace is derived by the host, so one plugin can no longer read or
overwrite another’s. A plugin that stored data by calling
http://127.0.0.1:{port}/_internal/... needs porting; the bundled
contact-form plugin is ported already and no longer requests any network
access at all.
Beyond those: a static build can now carry your header and routing
configuration with it. build.header_artifacts generates the _headers
or .htaccess your host reads from the same http_headers config
serve uses, so security headers, cache policy and attachment
semantics survive a deploy instead of quietly evaporating – including
the force-download protection against scriptable SVGs, which is an XSS
defence rather than a nicety. The Apache artifact also serves the
no-slash URLs Accent advertises, so the pages in your sitemap stop
answering with a redirect.
The template engine moves several behaviours onto Jinja2 semantics:
booleans and none print as Jinja2 prints them, string filters keep
their input’s safe marking, split returns an indexable sequence, and a
{% set %} inside a {% for %} no longer leaks between iterations.
Document models now govern the core frontmatter fields, so title,
date and their siblings validate like any other field. Themes and
templates that depend on the old output shapes should be checked.
The rest is correctness. The home page is advertised at the site root
rather than at /home, so a sitemap no longer lists a URL that
redirects. Search results no longer render indexed page content as HTML,
and raw HTML in a page body is no longer indexed as searchable text.
Reloading the configuration no longer switches development features back
on in production, discards command-line overrides, or serves mismatched
asset bytes while it finishes. A panicking request answers 500 instead
of dropping the connection, and a panic while a plugin reload held the
registry lock no longer takes down every subsequent request.
Install or upgrade:
curl -fsSL https://accentcms.dev/install.sh | sh
Binaries for all platforms, checksums, and signatures are on the GitHub release page.