← All releases

v0.16.1

fixsecurity

Bugfix: `seite serve` now bakes the address it actually serves on into absolute URLs (og:image, canonical, sitemap, feeds) instead of the hardcoded localhost:3000, so --host/--port are respected during local preview.

seite serve respects --host/--port in absolute URLs

When you ran seite serve --port 4000 (or the dev server auto-incremented past a busy port), the absolute URLs baked into the build — og:image, twitter:image, <link rel="canonical">, the sitemap, and RSS/Atom feeds — still pointed at the default http://localhost:3000, ignoring the address actually being served. The only workaround was to hard-code base_url in seite.toml to match.

The dev server now derives base_url from the host and port it actually binds — resolved before the build runs, so even the first render is correct — matching how hugo server and zola serve behave. The 0.0.0.0 / :: bind wildcards render as localhost in generated links.

This covers both standalone seite serve and single-site seite serve --site <name> in a workspace. The multi-site workspace dev server (seite serve with no --site) is unchanged — each site keeps its configured base_url, and per-site rewriting there is a separate follow-up. seite build and seite deploy also continue to use the base_url in seite.toml.

Fixes #86.

Dependency & advisory maintenance

This release also refreshes dependencies flagged by newly published security advisories: anyhow → 1.0.104 and crossbeam-epoch → 0.9.20 (RUSTSEC-2026-0190, RUSTSEC-2026-0204). The two quick-xml parsing advisories (RUSTSEC-2026-0194/0195) are marked not-applicable — seite only serializes XML (sitemap/RSS) and never parses untrusted input, and the flagged copy is transitive via syntect.