à Accent CMS

Accent CMS 0.26: script policy, portable components, directory previews

announcement Accent CMS Team

Accent CMS 0.26.0 is out. Four changes need action when you upgrade, so they come first.

Before you upgrade

Scripts need a nonce. Served pages now send a Content-Security-Policy with script-src 'self' 'nonce-...' and no 'unsafe-inline'. A script runs only if it loads from your own site or carries nonce="{{ nonce }}". All bundled themes already do this. If your theme has inline scripts, add the attribute to each <script> tag, and move onclick= handlers into a script. To find what breaks before you enforce the policy, set:

http_headers:
  security:
    script_policy:
      report_only: true

Plugins built for plugin API 0.1.0 no longer load. Accent skips them at startup and logs the fix. For a plugin installed from the hub, run:

accent plugin update <name>

The hub already has 0.2.0 builds of accent-contact and llm-tagging. A plugin you built yourself needs a rebuild against the new contract.

[shortcode] syntax is removed. A page that still uses it shows the brackets as text. Rewrite each one as a component, {% name %} ... {% /name %}. accent migrate shortcodes shows what it would change, and --write applies it. It rewrites the shortcodes your theme declares as components and lists the rest with their file and line.

A broken internal link fails accent build. The build lists each broken link and the file to fix. Use --lax to report them as warnings instead. accent validate also reports a link to a draft page as an error now.

Scripts are blocked everywhere Accent renders

The script policy covers all three places Accent produces HTML:

  • accent serve sends a new nonce with every response.
  • accent build has no response to carry a nonce, so it hashes each inline script that has the nonce attribute and writes the hashes into the policy in its header files. accent serve-static sends the same policy.
  • The admin UI runs without 'unsafe-eval'. The editor preview uses the site’s policy, so a script in a draft is blocked in the preview the same way it will be when published. The admin policy is report-only for now.

An injected <script> in page content does not run.

Components work across themes

A standard set of components, callout, accordion, button, card, tag, image, breadcrumb, tabs and tab, has fixed attribute names. Content that uses only these renders under any theme that implements them. accent validate reports a theme that is missing one.

Accent also renders four components itself, with no theme support needed:

  • {% download %} shows a file as a card with its name, type and size.
  • {% video %} plays a video with WebVTT captions.
  • {% diagram %} renders a diagram with a caption and alt text.
  • {% search %} places a search box in a page.

The admin lists every component a theme provides, and the page editor has a Components palette that inserts a component with its required attributes filled in. Component manifests can describe lists and nested objects, and accent validate checks each item. Plugins can declare their own components; accent query components lists every component content can use and where it comes from.

Preview any folder of markdown

accent serve <dir> now turns a directory into a site you can navigate. Every folder with markdown gets a section page, and the built-in viewer has a sidebar tree, breadcrumbs, search (press /), and a light/dark toggle. It respects .gitignore, so pointing it at a repository serves what git tracks. Mermaid and Svgbob diagrams render on the server.

To keep the setup, add --write-config. It writes a config.yaml that reproduces the preview, which accent build and accent validate can also use.

Other changes

  • Faster builds. accent build renders pages on all CPU cores. The 644-page documentation site builds in 2.2 s instead of 12.4 s on a 28-thread machine. The output is identical to a single-threaded build.
  • Alpine Linux. Releases include fully static musl binaries for x86_64 and aarch64. install.sh picks them on musl systems.
  • Stricter installs. install.sh --require-verify stops the install if it cannot check the checksum or the signature.
  • Search highlights your term. A search result opens the page scrolled to the first match, with the match marked.
  • Rename a field without editing every page. List the old name under renamed_from in the model. Pages keep working, and each page is updated the next time it is saved.
  • nav_tree() returns the whole page tree, so a theme can render site navigation with one recursive loop.
  • API rate limiting. api.rate_limit limits API requests per client per minute and answers 429 when a client goes over.
  • Frontmatter edits keep your formatting. Saving from the admin, the CLI, or an agent changes only the fields that changed. Comments, quoting and blank lines stay as they were.
  • Duplicate frontmatter keys are an error, reported with the key’s path, line and column.
  • Quoted numbers are strings. order: "5" no longer passes as an integer. Remove the quotes if validation reports it.
  • Length limits count characters, not bytes, so text with accents or dashes is measured the way you count it.
  • A clearer startup screen. In a terminal, accent serve shows the version, license, mode and address in one block before the log starts.

Security fixes

  • Admin pages are never cached. They now send Cache-Control: no-store. Before, with browser reload off, a shared cache could store an admin page.
  • rustls is updated for RUSTSEC-2026-0285, a TLS 1.3 handshake flaw. It affects the development HTTPS server and accent serve --tls.
  • Site protection with an unset password no longer starts. If a Basic Auth password is still a ${VAR} placeholder at startup, Accent refuses to start and names the variable.
  • Site protection works in development whether browser reload is on or off.
  • The git token no longer appears in the process list. It is passed to git through the environment.

Fixes

  • Pagination works on static hosts. Pages past the first one were missing on a deployed site. Page URLs are now /blog/page/2, and accent serve redirects the old /blog/page:2 form.
  • Force save works after an edit conflict in the admin.
  • accent build --dry-run no longer writes files.
  • A page whose frontmatter cannot be parsed is reported in the log instead of disappearing from the site.
  • A scheduled page appears on its date in an incremental build, and a page that becomes a draft again is removed from the output.
  • accent cache clear also clears processed images.

The GitHub release has the full list of changes.

Install or upgrade:

curl -fsSL https://accentcms.dev/install.sh | sh

Binaries for all platforms, checksums, and signatures are on the GitHub release page.

Changelog on GitHub →

All news