---
title: v0.16.1
date: 2026-07-20
description: 'Bugfix: `seite serve` now bakes the address it actually serves on into absolute URLs (og:image, canonical, sitemap, feeds) instead of the hardcoded localhost:3000, so --host/--port are respected during local preview.'
tags:
- fix
- security
---

## `seite serve` respects `--host`/`--port` in absolute URLs

When you ran `seite serve --port 4000` (or the dev server auto-incremented past a busy port), the absolute URLs baked into the build — `og:image`, `twitter:image`, `<link rel="canonical">`, the sitemap, and RSS/Atom feeds — still pointed at the default `http://localhost:3000`, ignoring the address actually being served. The only workaround was to hard-code `base_url` in `seite.toml` to match.

The dev server now derives `base_url` from the host and port it actually binds — resolved **before** the build runs, so even the first render is correct — matching how `hugo server` and `zola serve` behave. The `0.0.0.0` / `::` bind wildcards render as `localhost` in generated links.

This covers both standalone `seite serve` and single-site `seite serve --site <name>` in a workspace. The multi-site workspace dev server (`seite serve` with no `--site`) is unchanged — each site keeps its configured `base_url`, and per-site rewriting there is a separate follow-up. `seite build` and `seite deploy` also continue to use the `base_url` in `seite.toml`.

Fixes [#86](https://github.com/seite-sh/seite/issues/86).

## Dependency & advisory maintenance

This release also refreshes dependencies flagged by newly published security advisories: `anyhow` → 1.0.104 and `crossbeam-epoch` → 0.9.20 (RUSTSEC-2026-0190, RUSTSEC-2026-0204). The two `quick-xml` parsing advisories (RUSTSEC-2026-0194/0195) are marked not-applicable — seite only **serializes** XML (sitemap/RSS) and never parses untrusted input, and the flagged copy is transitive via `syntect`.