This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
ReleasePort's take
Light signalRelease v1.17.7 of Algernon fixes a Bolt database retrieval bug that previously returned an empty list when fewer than N items exist.
Why it matters: Patch to v1.17.7 immediately if your deployment uses the Bolt database and experiences missing results for queries requesting the last N items.
Summary
AI summaryFixes a Bolt database retrieval bug returning an empty list when fewer than N items exist.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Clamp handler.lua parent walk to server root. Clamp handler.lua parent walk to server root. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Security | Medium |
Use main mux for SSE auto-refresh feature. Use main mux for SSE auto-refresh feature. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Security | Medium |
Add --hide-dotfiles option to hide hidden files. Add --hide-dotfiles option to hide hidden files. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Embed React 19 and support index.jsx files. Embed React 19 and support index.jsx files. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Add formjson Lua function to return posted form as JSON. Add formjson Lua function to return posted form as JSON. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Add WebAuthn support with 4 new Lua functions. Add WebAuthn support with 4 new Lua functions. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Add maxlen, methodPOST, list:jsonlast, and jsonembed Lua functions. Add maxlen, methodPOST, list:jsonlast, and jsonembed Lua functions. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Dependency | Medium |
Use sqlite package without CGO requirement. Use sqlite package without CGO requirement. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Dependency | Medium |
Update all database-related dependencies. Update all database-related dependencies. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Performance | Medium |
Cache per-directory .algernon configuration. Cache per-directory .algernon configuration. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Fix Bolt database issue retrieving last N items. Fix Bolt database issue retrieving last N items. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Other | Medium |
Update documentation. Update documentation. Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
Security related
- Clamp
handler.luaparent walk to server root, thanks @Dredsen. - Use the main mux when serving SSE for the auto-refresh feature, thanks @Dredsen.
- Add a
--hide-dotfilesfor not serving hidden files, thanks @Dredsen. - Don't enable debug mode automatically when single-file mode is used, thanks @Dredsen.
New features
- Embed React 19 and support
index.jsxfiles, fornpm-less use of React.
Examples
- Update the HyperApp example so that it does not use a token for downloading images.
- Add an example project named Catbook here: https://github.com/xyproto/catbook
Database related
- Update all database-related dependencies.
- Fix an issue in the built-in Bolt database support, where retrieving the last N items from a list with less than N items could return an empty list.
- Use an
sqlitepackage that does not requireCGO.
Performance
- Cache the per-directory
.algernonconfiguration.
New Lua functions
- Add a
formjsonLua function for returning the posted form as JSON. - Add support for
WebAuthnby adding 4 new Lua functions. - Add the
maxlen,methodPOSTandlist:jsonlastandjsonembedfunctions.
General
- Update dependencies.
- Update documentation.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Algernon
Small self-contained pure-Go web server with Lua, Markdown, HTTP/2, QUIC, Redis and PostgreSQL support.
Related context
Related tools
Beta — feedback welcome: [email protected]