GoBlog 0.10.0: markdown is rendered on the server

GoBlog 0.10.0 changes where your posts turn into HTML. Until now GoBlog sent raw markdown to the browser and rendered it there with showdown.js. From this release, post, page and comment bodies are rendered on the server with goldmark.

Why it matters

Anything that does not run JavaScript used to see an empty post. Search engine crawlers, link-preview bots and reader modes now get the full content in the page itself.

Embeds work again

DOMPurify was stripping every <iframe> and <script> from post bodies in the browser, so YouTube and Instagram embeds had been silently broken. Posts and pages are now rendered unsanitised, because their authors are admins. Comments are sanitised with bluemonday, because commenters are not.

The editor has Write and Preview tabs

The old side-by-side live preview re-rendered as you typed, using a different markdown implementation from the published page. It is gone. The Preview tab now asks the server to render your draft through exactly the same code that renders the published post, so what you preview is what you get.

For theme authors

Use {{ .post.HTML }}, {{ .page.HTML }} and, for each comment, {{ .HTML }}, and drop the showdown and DOMPurify script tags. .Content still works, so a theme that has not been migrated keeps rendering in the browser; it just stays invisible to anything that does not run JavaScript. Writing a theme has the details, including where the sanitisation boundary sits.

If your theme ships its own post.html or page_content.html, it shadows the default theme's and needs its own update before this release changes anything on your site.

Full notes: v0.10.0 on GitHub.